Skip to content
audiotale.net
Sign in
NewsNews

Synology C3RB3R ransomware on DSM NAS: update to the latest DSM, Synology cites SA-24:20

Synology says attackers are encrypting NAS data on outdated DSM versions; its advisory and one security firm name different flaws, so here are the fixed builds and what to do.

audiotale.net team

· 5 min read

Written by AI from the sources linked below. How we use AI

On this page
  1. Key points
  2. What to do
  3. What happened
  4. Background
  5. How it works
  6. What it means
  7. What we don't know yet
  8. What to watch next
  9. Sources

Synology has warned owners of its DiskStation NAS devices that attackers are encrypting data on outdated DSM versions with C3RB3R ransomware, and has told them to update DiskStation Manager (DSM) at once. The company says the attackers exploit a vulnerability patched in December 2024 and points to advisory Synology-SA-24:20, but it has not named the specific CVE. Other reporting names different, newer flaws, so the safest step is to bring DSM to the latest build for your model, not only to the 2024 fix.

Key points

  • Synology's notice of 29 October 2026 says attackers are exploiting a vulnerability patched in December 2024 on outdated DSM versions, and links to Synology-SA-24:20.
  • BleepingComputer reports that encrypted files get a .L0CK3D extension and a ransom note called read-me3.txt appears; victims are told to buy a "C3rb3r Decryptor" on a dark web portal.
  • Synology-SA-24:20 (published 5 November 2024) covers CVE-2024-10441, a critical (CVSS 9.8) remote code execution flaw, plus two moderate flaws, CVE-2024-50629 and CVE-2024-10445.
  • The security firm 360, as summarised by Gridinsoft, instead links its investigated cases to CVE-2026-13639 and CVE-2026-13684, both rated 9.8 and fixed in Synology-SA-26:13 on 18 September 2026.
  • Synology lists no workaround for either advisory: updating is the fix.

What to do

Who is affected: DiskStation Manager running a build older than the fixed versions below. Synology-SA-24:20 lists fixed builds DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7 and (moderate severity only) 6.2.4-25556-8. The newer Synology-SA-26:13 lists DSM 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 and 7.2.1-69057-12 as the minimum fixed builds ("or later" in each case).

What to do now:

  1. Open Control Panel, then Update & Restore, and install the newest DSM update offered for your model. Do not stop at the 2024 build; the 2026 advisory needs the newer numbers above.
  2. Turn on automatic updates, as Synology urges.
  3. Block access to the DSM management interface from the internet. BleepingComputer lists this among its recommendations, and Gridinsoft suggests a VPN for remote access instead of exposing DSM.
  4. Check that you have a backup that is not stored on the same NAS. A copy on compromised storage is not a safe recovery path.

If you are already hit: Gridinsoft advises isolating the NAS from the network, powering it down only if isolation is not possible (shutdown loses evidence in memory), keeping the ransom note, sample files, DSM version, package list and logs, and contacting Synology Support or an incident responder. We found no confirmed free decryptor for C3RB3R.

How to check your version: in DSM, Control Panel, Info Center shows the DSM version; compare it with the builds above.

What happened

On Thursday 29 October 2026, Synology published a notice titled "Synology urges users to update DSM following ransomware attacks on outdated DSM versions". It says threat actors are exploiting a vulnerability patched in December 2024 and are encrypting data to demand ransom. It tells users running vulnerable versions to update immediately and to enable automatic updates. It does not name a CVE.

BleepingComputer, reporting on 2 November, adds that the first reports appeared more than two weeks before the advisory, and notes that the date in Synology's wording (December 2024) does not match the linked advisory, which was published in November 2024. It also notes that Synology rarely issues attack warnings; the previous one it recalls was in August 2019, after brute-force attacks led to eCh0raix ransomware infections.

According to the same report, encrypted files get the .L0CK3D extension and a read-me3.txt note is dropped. Victims are told to pay thousands of dollars to buy a "C3rb3r Decryptor". BleepingComputer had not reached a Synology spokesperson for comment.

Background

The C3RB3R name echoes Cerber, a ransomware-as-a-service operation that emerged in 2016 and shut down at the end of 2019, according to BleepingComputer. The C3RB3R variant was first spotted in December 2021, when it went after Atlassian Confluence and GitLab servers using CVE-2021-26084, CVE-2021-22205 and CVE-2023-22518.

Synology-SA-24:20 is titled "DSM (PWN2OWN 2024)": the flaws came from the Pwn2Own hacking contest. Synology's advisory page lists three CVEs:

CVE Severity CVSS 3.1 What it is
CVE-2024-10441 Critical 9.8 Output encoding flaw in the system plugin daemon, allowing remote code execution
CVE-2024-50629 Moderate 5.3 Flaw in the webapi component, allowing limited file reads
CVE-2024-10445 Moderate 4.3 Improper certificate validation in the update function, allowing limited file writes

How it works

The two accounts disagree about the way in, and the public record does not settle it.

Synology's own notice points to the 2024 advisory. CVE-2024-10441 needs no login and no user interaction (its vector is network, low complexity, no privileges), so an exposed, unpatched NAS is easy prey.

The second account comes from 360. Gridinsoft summarises the report as saying its response service handled multiple Synology NAS cases during October, identified the ransomware as C3RB3R and tied its incidents to CVE-2026-13639 and CVE-2026-13684. Synology's own advisory SA-26:13, published on 18 September 2026, lists both as critical, CVSS 9.8, needing no authentication: CVE-2026-13639 is insufficient entropy in login logic and CVE-2026-13684 is improper output encoding in SCGI, and each allows arbitrary file read and write and denial of service. Gridinsoft stresses that the two reports do not show whether they describe the same victims or the same entry route. A third search result ties the attacks to flaws in Synology-SA-26:14; we could not open that advisory and do not rely on it.

Gridinsoft also says the sample skips 27 system directories and some executable and script files, so a NAS that still responds does not mean its data is safe.

What it means

For home and small-business owners, a NAS that is reachable from the internet and was last updated before late 2024 is at risk; so is one that was not updated after September 2026. Shadowserver, cited by BleepingComputer, tracks over 380,000 internet-exposed Synology NAS devices, though it does not say how many are patched or how many are honeypots.

For administrators, the lesson is the long gap: a flaw fixed in 2024 is still paying off for attackers in late 2026. Management interfaces should sit behind a VPN, not on a port forward.

For Synology, the missing CVE leaves owners unsure which fix matters. Until it says more, updating to the newest build covers both advisories.

What we don't know yet

  • Which CVE the attackers actually use. Synology says a 2024 flaw; 360 names two 2026 flaws.
  • How many devices have been encrypted.
  • Whether a free decryptor will appear. We found no confirmed one.
  • Whether the ransomware group is the same as the earlier C3RB3R operation, beyond the shared name.

What to watch next

An updated Synology notice naming the CVE, any addition of these flaws to CISA's Known Exploited Vulnerabilities catalogue, and security-vendor write-ups with indicators of compromise. For more on how attackers chain flaws in edge devices, see our article on the Ivanti Connect Secure exploit chain.

Sources

SaveStart the discussion

Written by

audiotale.net team

The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.

Read next