---
id: "CMP-202610-c3rb3r-cerber-ransomware-is-encrypting-internet-exposed-syno"
kind: "campaign"
aliases: []
title: "C3RB3R (Cerber) ransomware is encrypting internet-exposed Synology NAS devices and their backups; Synology confirms attacks on outdated DSM"
severity: "critical"
cvss: null
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Synology DSM", "fixed": ["7.4-90075", "7.3.2-86009-4", "7.2.2-72806-9", "7.2.1-69057-12"], "vendor": "Synology", "affected": "outdated DSM; < 7.4-90075, < 7.3.2-86009-4, < 7.2.2-72806-9, < 7.2.1-69057-12 (one case on 7.4.1 unexplained)"}, {"name": "Synology NAS", "fixed": [], "vendor": "Synology"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: "2026-10-29T00:00:00+00:00"
first_seen_at: "2026-10-30T18:37:03+00:00"
updated_at: "2026-10-30T18:37:03+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-30T18:37:03+00:00"}]
---

# C3RB3R (Cerber) ransomware is encrypting internet-exposed Synology NAS devices and their backups; Synology confirms attacks on outdated DSM

Since early October 2026, 360's anti-ransomware team and other responders report a wave of C3RB3R (a Cerber variant) attacks that encrypt files on Synology NAS devices, including backups stored there. No user interaction is needed. Exposed NAS units on outdated DiskStation Manager (DSM) are at risk. On Oct 29 Synology confirmed attackers are exploiting a flaw patched in December 2024 (Synology-SA-24:20). 360 instead names CVE-2026-13639 and CVE-2026-13684 (CVSS 9.8, unauthenticated file read/write; Synology-SA-26:13, Sept 18 2026). So the exact entry point is disputed. One IR team saw a victim already on a recent DSM 7.4.1 build and cannot rule out a new flaw, or abuse of packages, containers (a GitLab container is suspected) or credentials. Some reports also tie it to the PHP2Shell flaws in PHP-based packages. Social posts call it a 0-day, but that is unconfirmed. Macau's PJ and RSM Hong Kong have issued alerts. No free decryptor is known.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :Synology DSM affected outdated DSM; < 7.4-90075, < 7.3.2-86009-4, < 7.2.2-72806-9, < 7.2.1-69057-12 (one case on 7.4.1 unexplained) fixed 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9, 7.2.1-69057-12
- :Synology NAS affected ? fixed ?

## How to check

Look for files renamed with the .L0CK3D extension and a ransom note named read-me3.txt in each folder (it points to a Tor site). In Log Center, check for unusual logins or mass file changes. List every Synology unit with its DSM version and check whether DSM management, packages or containers are reachable from the internet.

## Fix

Update DSM now to a fixed release or later for your branch: 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 or 7.2.1-69057-12. Also apply the SA-24:20 and PHP2Shell package fixes, and turn on automatic DSM and package updates. Stop forwarding NAS management ports and use a VPN instead. Remove unused packages, containers and services. Enable the firewall with trusted IPs only, disable the default admin account, and enforce 2FA. Enable immutable/tamper-protected snapshots and keep one offline backup. If a device is hit, unplug it from the network, keep the note, logs and samples, and do not pay.

## Timeline

- 2026-10-30T18:37:03+00:00 analyst

## Documents

- [describes] @dinodaizovi: "Waking up from a nap, thousands of Synology NAS devices have already been hit b https://x.com/dinodaizovi/status/2116229881197432993
- [describes] Synology urges users to update DSM following ransomware attacks on outdated DSM versions https://www.synology.com/en-global/company/news/article/C3RB3R
- [describes] C3RB3R Ransomware Is Encrypting Synology NAS Devices That Missed a September Patch (TrebSec) https://www.trebsec.com/briefs/2026-10-29-synology-c3rb3r-ransomware.html
- [discussion] @dinodaizovi: There we go: https://t.co/xiZru3NHo9 https://x.com/dinodaizovi/status/2116229330611384352

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_