Ransomware is locking Synology NAS boxes that skipped September’s update. Check your DSM version today

By George Bailey   Published: 10/30/26   4 min read
Cyber News

If your files and your backups both live on a Synology NAS, ransomware is now going after that box. The security firm 360 says a Cerber variant called C3RB3R has been encrypting Synology devices since early October, using two flaws Synology fixed on September 18.

Get the CyberExperts Daily Brief: the day's top security news in 5 minutes. Free.

The attack is the old kind. Nobody needs to click anything. A NAS that missed the September DSM update and is reachable from the internet is the target.

A NAS that holds your files and your backups is one box to encrypt. The fix has been out since September 18.

Ransomware is locking Synology NAS boxes that skipped the September update

On October 29, 360’s anti-ransomware team reported repeated attacks on Synology NAS devices by C3RB3R, a variant of the Cerber ransomware family. Files get the extension .L0CK3D, and each folder gets a ransom note named read-me3.txt. 360 says the entry point is two remote, unauthenticated flaws in DiskStation Manager, CVE-2026-13639 and CVE-2026-13684, both rated 9.8.

Synology fixed both in advisory Synology-SA-26:13 on September 18, along with six other DSM flaws. The advisory lists no mitigation, so the update is the fix.

One caution from a secondary report: TrebSec says an incident response team has seen a victim already on a recent DSM 7.4.1 build and cannot rule out another entry route, such as a package, container or stolen credentials. Treat the DSM update as necessary, and the checks below as the rest of the job.

Home offices and small teams that keep files and backups on one NAS

The exposed group is every Synology unit on DSM 7.4 before 7.4-90075, 7.3 before 7.3.2-86009-4, 7.2.2 before 7.2.2-72806-9 or 7.2.1 before 7.2.1-69057-12. That includes the forgotten boxes at branch offices, in labs and in home offices.

The damage is worst for people who treat the NAS as the backup. Ransomware that can write to a shared folder can also hit backup copies stored where the NAS has write access. TrebSec says no free public decryption tool has been confirmed, so recovery depends on a copy the attackers could not reach.

Update DSM, keep it off the internet, and make one copy the NAS cannot touch

Forward this

For whoever looks after our file server or the NAS in the back office: ransomware is encrypting Synology NAS devices that missed the update Synology released on September 18, and it hits the backups stored on the same box. Can we check the DSM version on every Synology we own, update it today, make sure its admin page is not reachable from the internet, and confirm one backup copy lives somewhere the NAS cannot write to?

Details

Hunt / verify

Source: Synology advisory SA-26:13; 360 report on C3RB3R (Chinese)

Sources

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].