Synology NAS Ransomware 2026: C3RB3R Attacks, Patches and What To Do

Last updated 3 November 2026. This is a developing story. Synology and outside researchers still disagree on which flaw the attackers are using, and we will update this post as the details settle.

On 29 October 2026, Synology published a notice telling customers that attackers were exploiting a vulnerability, patched back in December 2024, to break into NAS devices running outdated versions of its DiskStation Manager (DSM) operating system and encrypt the data on them for ransom. The same day, the anti-ransomware team at Chinese security firm 360 reported repeated attacks on Synology boxes by a strain it calls C3RB3R, a variant of the old Cerber ransomware family. Victims find their files renamed with a .L0CK3D extension and a ransom note called read-me3.txt in their folders. The Shadowserver Foundation tracks more than 380,000 Synology devices that are reachable from the public internet, according to BleepingComputer.

This matters well beyond home users. In Pakistan, the UAE and the rest of the GCC, a Synology box in the back office is a very common way for small and mid-sized companies to hold shared folders, accounting files, CCTV footage and nightly copies of their POS or ERP database. We build POS, inventory and ERP systems for these businesses, and the question we hear most whenever a NAS story breaks is simple: are our backups still safe? This post covers what is confirmed, what is still disputed, and what to check this week. Sources are at the end.

What is the C3RB3R ransomware attack on Synology NAS?

C3RB3R is a ransomware campaign that targets Synology network storage devices running old DSM versions. Attackers get in through a known DSM vulnerability, encrypt files, add a .L0CK3D extension, and leave a note pointing victims to a paid "C3rb3r Decryptor" on a dark web site. Synology has confirmed the attacks and told customers to update DSM immediately.

The name comes from 360's analysis. Synology's own notice does not name the ransomware family, give a CVE number or say how many devices have been hit. Several reports say the activity started in early October and only became public at the end of the month. We have not seen a reliable victim count from any source, so treat claims of "thousands of devices encrypted" as guesses for now.

Unlike phishing, nobody in your office has to click anything. If an old DSM login page is reachable from the internet, the box itself is the way in.

Which Synology vulnerability are attackers exploiting?

That is the part still in dispute. Synology says attackers are using a flaw it fixed in December 2024 and points to advisory Synology-SA-24:20, which covers CVE-2024-10441, a critical remote code execution bug rated 9.8 out of 10. 360 says the attackers are using two newer critical flaws, CVE-2026-13639 and CVE-2026-13684, fixed in September 2026.

If 360 is right, a NAS that got the 2024 patch but missed the September 2026 update is still exposed. That is why the safe answer is the same either way: install the newest DSM build available for your model, rather than the minimum fixed version. The table below puts the two advisories side by side, using version numbers reported from Synology's advisory pages.

Two notes. Outlets quote slightly different SA-24:20 builds, so confirm your model on Synology's advisory page. The SA-26:14 row is a single-source report from Guru3D that we could not confirm elsewhere.

Singapore's Cyber Security Agency issued an alert on SA-26:13 on 23 September 2026, describing weak randomness in the login logic and other bugs that could let a remote attacker read or write files on the device.

How do you know if your Synology NAS has been hit?

The clearest sign is files that suddenly end in .L0CK3D and will not open, along with a text file named read-me3.txt in shared folders. The note asks for payment in bitcoin through a Tor website. If you see either, treat the device as compromised and stop using it for new work until it has been checked.

Other things to look for:

• Shared folders that are slow or show high CPU and disk activity at odd hours, which can mean encryption is still running.

• Snapshots, snapshot schedules or Hyper Backup tasks that have disappeared. Recovery guides warn that attackers with admin access can delete these.

• New admin accounts you did not create, or changes in the DSM log centre you cannot explain.

• A USB drive or second volume attached to the NAS that now also has .L0CK3D files. At least one victim account says a local Hyper Backup USB drive was encrypted along with the main volume.

Do not delete the ransom note or the encrypted files. Recovery specialists say both may be needed later, either for a decryptor if one is released or for working out exactly when the attack started.

Can you decrypt .L0CK3D files or get your data back?

As of 3 November 2026, there is no confirmed free decryptor for C3RB3R. Patching DSM closes the hole but does not reverse encryption that has already happened. Your realistic options are restoring from a backup the attacker could not reach, rolling back to a snapshot that survived, or paying, which comes with no guarantee and which we do not recommend.

How much you can recover depends on how far the attacker got. If they only encrypted shared folders, Btrfs snapshots and Hyper Backup versions are often still intact, and you can roll back to the newest snapshot taken before the first encrypted file appeared. If they had full admin rights in DSM, the picture is worse. Snapshots stored on the same box, local backup targets and mounted network shares can all be wiped or encrypted.

The ransom site reportedly offers a free test decryption of one small file, which proves nothing about what happens after payment. A public research project on GitHub studying the encryption reports that key recovery has not been achieved so far.

Why does this matter for businesses in Pakistan, the UAE and the GCC?

Because the Synology box is often the only backup a small business has. In shops, clinics, pharmacies and trading companies from Karachi to Riyadh, a common setup is one NAS holding shared folders, accounts files and a nightly copy of the POS or ERP database. If it is encrypted, the live data and the backup go together.

There are also compliance costs. Businesses in Pakistan that are integrated with FBR or provincial tax systems, and businesses in the UAE and Saudi Arabia moving to e-invoicing, are expected to keep invoice and sales records for years. A ransomware hit that wipes a year of POS history is a tax problem as well as an IT problem. If you run a restaurant on a provincially integrated POS, our guide to restaurant POS integration with PRA, SRB and KPRA covers what records you need to keep.

We have not seen any report that ties C3RB3R victims to Pakistan or the Gulf specifically, and Synology has not published a country breakdown. The attack is opportunistic: it hits whatever is exposed and unpatched. Regional authorities do watch Synology products. The UAE Cyber Security Council has issued alerts on Synology vulnerabilities before, including a Media Server flaw in February 2025 and a Replication Service flaw in March 2025, published through ADGM. Expect similar alerts if local victims come forward.

What should you do this week? A checklist for business owners

Start with the update, then cut internet exposure, then test your backups. Most of these steps take under an hour for someone who knows DSM.

1. Log in to DSM and go to Control Panel, then Update and Restore. Install the newest DSM version offered for your model, then update every installed package in Package Center.

2. Turn on automatic updates for DSM and packages, which is what Synology recommends in its notice.

3. Check your router for port forwarding to the NAS, usually ports 5000, 5001, 80 or 443. If staff do not need the DSM login page from outside the office, close those ports.

4. If people need remote access, put it behind a VPN or a zero-trust access service instead of opening DSM to the internet. Review whether QuickConnect needs to stay on.

5. Turn on two-factor sign-in for every admin account, disable the default admin account, and remove old staff accounts.

6. Check that snapshots are running. On models that support it, make them immutable so they cannot be deleted for a set number of days.

7. Make sure at least one backup copy lives somewhere the NAS cannot write to: a cloud bucket with versioning, a second site, or a drive that is disconnected after each backup.

8. Do a test restore of one real file, such as yesterday's POS database backup. A backup you have never restored is a guess.

9. If your model is too old for current DSM versions, plan to replace it. A device that no longer gets security updates should not be reachable from the internet at all.

If you already see .L0CK3D files, the order changes. Unplug the network cable, disable port forwarding and QuickConnect, pause Hyper Backup and any Cloud Sync tasks so they do not copy encrypted files over good ones, and then call whoever manages your IT before you try a restore.

Common mistakes we see with office NAS setups

Most NAS ransomware cases come down to setup choices made years ago and never revisited.

• The NAS was installed once, the installer left, and nobody has logged in to update it since. Old DSM versions are exactly what this campaign targets.

• Port 5000 or 5001 was forwarded on the router so the owner could check files from home, and it was never closed.

• The only backup of the NAS is a USB drive plugged into the NAS. When the box is encrypted, so is the drive.

• The POS or ERP server writes its nightly backup to a mapped network drive on the NAS, and there is no second copy anywhere else.

• Everyone uses the same admin login, and the password is on a sticky note or in a WhatsApp group.

• Important business data lives in spreadsheets on the shared drive with no version history. If that sounds familiar, our post on signs your business has outgrown Excel explains what to move to.

What to watch next

The open question is the entry point. If Synology confirms the newer SA-26:13 flaws are involved, anyone who patched only in 2024 needs to update again. Watch for a revised Synology advisory and any technical follow-up from 360.

Also watch for a free decryptor (none announced so far), for victim reports from the region, and for alerts from the UAE Cyber Security Council, Saudi Arabia's National Cybersecurity Authority or Pakistan's national CERT.

Key takeaways

• Synology confirmed on 29 October 2026 that ransomware is hitting NAS devices running outdated DSM.

• 360 calls the strain C3RB3R, a Cerber variant that renames files to .L0CK3D and drops a read-me3.txt note.

• Synology blames a December 2024 flaw (SA-24:20), while 360 blames two September 2026 flaws (SA-26:13), so install the newest DSM build, not the minimum.

• No free decryptor has been confirmed, and patching does not undo encryption that has already happened.

• Close DSM to the internet, turn on automatic updates and two-factor sign-in, and keep one backup the NAS cannot reach.

• Test a real restore of your POS or ERP backup this week.

Frequently asked questions

Is my Synology NAS affected by C3RB3R?

It is at risk if it runs an old DSM version and any DSM service is reachable from the internet. Check your DSM version in Control Panel, compare it with the fixed builds in Synology's advisories, and close any router port forwarding to the NAS that you do not need.

What DSM version fixes the C3RB3R vulnerability?

For DSM 7.4 the September 2026 advisory lists 7.4-90075 or later, and for 7.3 it lists 7.3.2-86009-4 or later. Because the exact flaw is disputed, install the newest version Synology offers for your model.

What does the .L0CK3D extension mean?

It means the file has been encrypted by the C3RB3R ransomware. The original content is still inside, but you cannot open it without the attacker's key or a clean backup.

Is there a free C3RB3R decryptor?

Not as of 3 November 2026. Researchers are studying the encryption, but no working free tool has been confirmed. Be careful of websites that claim to sell one.

Should I pay the C3RB3R ransom?

We advise against it. Payment does not guarantee a working key, it marks you as a payer for future attacks, and it may raise legal questions depending on your jurisdiction. Try snapshots and offline backups first, and get professional help before deciding.

Is QuickConnect safe to leave on?

QuickConnect makes DSM reachable from outside your network, which is the kind of exposure this campaign uses. If nobody needs remote access, turn it off. If they do, a VPN is a safer route.

Need help securing your business data and backups?

Deixtra builds POS, inventory, ERP and e-commerce systems for businesses in Pakistan, the UAE and the GCC, and we set up the backup side as part of the job: scheduled database backups, off-site copies that the office network cannot overwrite, and restore tests that prove the data comes back. If your POS or ERP backups currently sit on a single NAS, send us your setup on WhatsApp and we'll come back with a written scope and a fixed quote.

This post is for general information and is based on public reporting as of 3 November 2026. Details of the C3RB3R campaign, including which vulnerabilities are being exploited, are still being confirmed. Check Synology's official advisories for your exact model, and get qualified help if you believe a device has been compromised.

Sources

• Synology urges users to update DSM following ransomware attacks on outdated DSM versions, Synology

• Synology-SA-26:13 DSM, Synology

• Synology warns of C3RB3R ransomware attacks targeting NAS devices, BleepingComputer

• Hackers Exploit Patched Synology NAS Vulnerabilities to Deploy C3RB3R Ransomware and Encrypt Files, Cybersecurity News

• Synology warns of ransomware on NAS devices with outdated DSM, ITdaily

• Multiple Vulnerabilities in Synology DiskStation Manager (DSM), Cyber Security Agency of Singapore

• Synology NAS Devices Hit by L0CK3D Ransomware Campaign, Guru3D

• Synology LOCK3D / C3RB3R Ransomware Attack, NAS Compares

• C3RB3R: collaborative research on .L0CK3D ransomware affecting Synology NAS, GitHub