C3RB3R ransomware hits outdated Synology NAS devices through patched DSM flaw

What happened

Threat actors are using the C3RB3R ransomware family to target Synology Network Attached Storage (NAS) devices running outdated versions of DiskStation Manager (DSM). Synology said it observed threat actors exploiting a vulnerability patched in December 2024 to target these devices, adding that "these attacks aim to encrypt data and extort ransom."

Customers have reported devices hit by C3RB3R, which encrypts files, appends a .L0CK3D extension and drops a ransom note named read-me3.txt in each encrypted directory. To avoid system crashes that could disrupt its encryption, it skips 27 directories and certain extensions, such as BAT, DLL, EXE, LNK, MOD, MSI and SYS.

Synology did not name the exact flaw, but it linked to Synology-SA-24:20, which covers CVE-2024-10441 (CVSS 9.8), a bug in the DSM system plugin daemon that lets remote attackers execute arbitrary code. Separately, Qihoo 360 said C3RB3R has a "long history" of attacking NAS devices, including by exploiting CVE-2026-13684 and CVE-2026-13639 (both CVSS 9.8). Synology fixed those two in September 2026 in Synology-SA-26:13. They allow remote attackers to read or write arbitrary files and conduct denial-of-service attacks.

Why it matters

Synology NAS devices have been ransomware targets before, including the StealthWorker brute-force attacks Synology warned about in August 2021. None of the three critical flaws needs authentication, so attackers do not need stolen credentials to get in. Patching only for the 2024 advisory is not enough: a device on DSM 7.2.2-72806-1 has the 2024 fixes but is still exposed to the two 2026 flaws. Because C3RB3R avoids files that would crash the system, the NAS can keep running while user data is encrypted.

Who is affected

Synology NAS devices on DSM builds older than the fixed releases in Synology's advisories:

• DSM 7.4 and 7.3 (SA-26:13)
• DSM 7.2.2 and 7.2.1 (SA-24:20 and SA-26:13)
• DSM 7.2, 7.1 and 6.2 (SA-24:20)

What to do now

1. Upgrade DSM 7.4 to 7.4-90075 or above.
2. Upgrade DSM 7.3 to 7.3.2-86009-4 or above.
3. Upgrade DSM 7.2.2 to 7.2.2-72806-9 or above, which also covers SA-24:20.
4. Upgrade DSM 7.2.1 to 7.2.1-69057-12 or above, which also covers SA-24:20.
5. Upgrade DSM 7.2 to 7.2-64570-4 or above.
6. Upgrade DSM 7.1 to 7.1.1-42962-7 or above.
7. Upgrade DSM 6.2 to 6.2.4-25556-8 or above.
8. Turn on automatic DSM updates so future security patches install as soon as they ship.

What we don't know yet

• Which CVE the attackers are exploiting in this wave. Synology described it only as a vulnerability patched in December 2024.
• How many devices C3RB3R has hit.
• Whether DSM 7.2, 7.1 and 6.2, which SA-26:13 does not list, are affected by the two 2026 flaws.