Synology alerts on C3RB3R ransomware surge hitting NAS devices

Synology warned that attackers exploited a flaw patched in December 2024 against devices running outdated DSM. Synology published an urgent advisory on Oct. 29, 2026, flagging a spike in C3RB3R ransomware attacks against its network-attached storage appliances. The vendor rarely issues such alerts, and the last comparable warning followed eCh0raix ransomware infections in August 2019, according to the company’s security bulletin. Encrypted files receive the .L0CK3D extension, and each affected folder contains a ransom note named read-me3.txt with a unique six-digit code and a Tor network address that directs victims to a dark web portal for purchasing a C3rb3r Decryptor.

C3RB3R encrypts files with ChaCha8, generating a 256-bit key per file, and shields those keys with RSA-2048, according to malware analysis. The malware skips 27 system directories, gives full encryption to 187 high-priority extensions, and partly encrypts other target files to expedite execution speed. Demand amounts begin at roughly 0.036960 bitcoin, equivalent to about $2,952, and double after five days to approximately 0.073920 bitcoin or $5,904.

Synology said in its advisory that attackers used a flaw patched in December 2024 to hit devices running outdated DSM software. The primary flaw is CVE-2024-10441, an unauthenticated remote code execution vulnerability carrying a CVSS score of 9.8, originally uncovered during Pwn2Own 2024 by DEVCORE researchers Pumpkin Chang and Orange Tsai. Techaeris reported that a public proof of concept and technical write-up for the December 2024 bug appeared on GitHub on Oct. 25, four days before Synology released its advisory.

The attribution picture remains contested. The Chinese security vendor 360 attributes the C3RB3R campaign to two critical DSM vulnerabilities, CVE-2026-13639 and CVE-2026-13684, which were patched on Sept. 18, 2026. An incident response team identified as Solar reported observing an affected Synology NAS running DSM 7.4.1, a build that falls outside the scope of the 2024 vulnerability explanation. Affected users also reported that the ransomware dropped its ransom notes and added the file extension more than two weeks before the official vendor advisory was issued.

Shadowserver is monitoring more than 380,000 Synology NAS devices that are currently exposed to the Internet, although this figure represents total exposure rather than the confirmed number of infected or vulnerable devices. CHOSUNBIZ reported that South Korean domestic damage reports began surfacing on Oct. 28. The Korea Internet & Security Agency acknowledged receiving customer reports while declining to disclose the total scale of damage. Prominent South Korean institutional users of Synology systems include SBS for video storage, SK Shipping for file sharing and remote backup, and Korean Air Lines’ aerospace division for internal collaboration.

Synology recommends that users immediately update their DSM software and enable automatic updates. Devices manufactured in 2025 and later come with automatic updates enabled by default, while older models may not. The vendor also advises blocking public Internet access to the NAS management interface and using a VPN for remote access instead of direct port forwarding. Users should inspect their Task Scheduler for unknown scripts and check User and Group settings for unauthorized administrator accounts someone may have created.

Techaeris reported that Synology separately detailed PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both carrying CVSS scores of 9.8, and that PHP version 7.3 receives no patches because it has reached end-of-life status. Techaeris noted that MailStation devices require a manual package update via Package Center. The C3RB3R name derives from a 2016 Ransomware-as-a-Service operation also known as Cerber, which accounted for more than 80 percent of all ransomware attacks and a quarter of enterprise endpoint infections before disappearing at the end of 2019.

Before targeting NAS devices, C3RB3R operators hit Atlassian Confluence and GitLab servers starting in December 2021, exploiting remote code execution flaws CVE-2021-26084 and CVE-2021-22205 alongside authentication bypass CVE-2023-22518. AppleInsider recommended that owners of Synology NAS units and other network-accessible hardware establish regular schedules to check manufacturer support pages directly for updates rather than relying solely on built-in notification tools, since auto-updaters can occasionally fail or report false status.

A Synology DS918+ owner reported on Reddit that attackers targeted their device, but 3-2-1 backup principles prevented data loss. Another Reddit user disclosed an Oct. 29 attack on a Synology DS2422+ model where attackers encrypted 70 terabytes of data alongside a Bitcoin ransom demand of $3,000. A Synology spokesperson was not immediately available when BleepingComputer contacted them for additional details.

The vulnerabilities linked to the campaign include CVE-2024-10441, CVE-2024-50629, and CVE-2024-10445. Synology’s advisory lists specific historical patch thresholds including DSM versions 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7, and 6.2.4-25556-8.