C3RB3R Ransomware Is Encrypting Unpatched Synology NAS Devices Through Old DSM Flaws — Files Renamed .L0CK3D, Notes Left as read-me3.txt

High · 2026-11-04 · By H.A

Synology warns that attackers are exploiting long-patched DiskStation Manager vulnerabilities on outdated, internet-facing NAS devices to deploy C3RB3R ransomware, and urges immediate DSM updates.

Overview

Synology has warned customers that attackers are exploiting a long-patched vulnerability in DiskStation Manager (DSM) to encrypt data on NAS devices that were never updated, and to demand ransom. Owners reporting infections say the ransomware is C3RB3R, which appends a .L0CK3D extension to files and leaves a ransom note named read-me3.txt in every encrypted folder.

The vendor has not said which specific CVE is being abused. It pointed customers to advisory Synology_SA_24_20, a bundle of three DSM fixes published in late 2024. Separately, security researchers who have tracked C3RB3R for years link the group to two newer DSM flaws that Synology fixed in September 2026. Synology has not confirmed that those two are part of this wave.

The pattern is a familiar one. A NAS sits on the internet for years with its admin interface exposed and auto-update switched off, and a ransomware crew sweeps for it once a working exploit circulates.

The Campaign

Advisory Synology_SA_24_20, which Synology referenced, covers three bugs:

• CVE-2024-10441 (CVSS 9.8): improper output encoding in the system plugin daemon, leading to remote code execution.
• CVE-2024-50629 (CVSS 5.3): an encoding flaw in the webapi component that allows limited file reads.
• CVE-2024-10445 (CVSS 4.3): improper certificate validation in the update function that allows limited file writes.

Researchers tracking C3RB3R also connect it to Synology_SA_26_13, published in September 2026:

• CVE-2026-13684 (CVSS 9.8): an output-encoding flaw in SCGI enabling arbitrary file read/write and denial of service.
• CVE-2026-13639 (CVSS 9.8): insufficient entropy in the login logic, again enabling arbitrary file read/write and denial of service.

Once on a device, the encryptor walks the file system. It skips 27 directories and files with extensions such as BAT, DLL, EXE, LNK, MOD, MSI and SYS so that the system keeps running. That way the owner can still log in, read the note and pay.

Synology has not published a victim count. The reports so far come from individual customers posting about locked volumes.

Timeline

• Late 2024: Synology fixes CVE-2024-10441, CVE-2024-50629 and CVE-2024-10445 (Synology_SA_24_20).
• September 2026: Synology fixes CVE-2026-13684 and CVE-2026-13639 (Synology_SA_26_13).
• Late October 2026: Customers report C3RB3R infections, and Synology warns of active exploitation against outdated DSM.
• 3 November 2026: Wider public reporting of the campaign.

Tradecraft

• Opportunistic targeting: The campaign hits internet-reachable DSM web interfaces running outdated builds. Nothing so far suggests specific victims were chosen.
• Use of n-day bugs: The attackers use vulnerabilities that have had fixes for close to two years, which shows how many appliances are never patched.
• Keeping the host alive: The excluded directories and extensions keep the NAS working so the ransom note can be read.
• History of NAS targeting: NAS ransomware has a long record. QNAP devices were hit by eCh0raix (QNAPCrypt) in 2019, and in 2021 Synology warned of StealthWorker brute-force botnets dropping ransomware. Researchers describe C3RB3R as having a "long history" against NAS devices.

Indicators of Compromise

No network indicators or hashes have been published for this wave. Host-level signs:

• Files renamed with the .L0CK3D extension
• read-me3.txt ransom notes in shared folders
• Unexpected DSM processes, scheduled tasks or new admin accounts created near the time encryption began

Detection

• In Log Center, look for logins from unfamiliar IPs, new administrator accounts, or package installs you did not perform.
• Search shared folders for the ransom note and the new extension:

find /volume1 -name 'read-me3.txt' 2>/dev/null | head
find /volume1 -name '*.L0CK3D' 2>/dev/null | wc -l

• Check the running DSM build under Control Panel > Info Center and compare it with the fixed versions below.
• Look at firewall or router logs for inbound connections to DSM ports (5000/5001 by default) from the internet.

Recommended Actions

Update DSM to at least these builds (the Synology_SA_24_20 thresholds), then apply the latest release for your branch so the September 2026 fixes are also in place:

• DSM 7.2.2: 7.2.2-72806-1 or later
• DSM 7.2.1: 7.2.1-69057-6 or later
• DSM 7.2: 7.2-64570-4 or later
• DSM 7.1: 7.1.1-42962-7 or later
• DSM 6.2: 6.2.4-25556-8 or later

Also:

• Take DSM off the internet. Use a VPN or Synology's relay services rather than port-forwarding 5000/5001.
• Turn on automatic security updates, as Synology recommends.
• Enable the auto-block, 2FA and account-lockout features, and disable the default admin account.
• Keep immutable or offline backups. Snapshot Replication with immutable snapshots, or a backup target the NAS cannot write to, is what gets data back after an attack like this.
• If infected: disconnect the device from the network, preserve the ransom note and logs, and contact Synology support before wiping. Do not assume paying will return the data.

Analyst Assessment

The core flaw has had a fix for about two years, so the campaign mostly measures how many consumer and small-business NAS units are exposed and never updated. Synology has not named the CVE, and researchers point to the newer September 2026 bugs. Owners who patched in 2024 but not since should therefore not assume they are safe. Expect the campaign to continue for weeks as scanning picks up the remaining exposed devices. An unpatched, internet-facing NAS should be treated as a matter of when, not if.