NexusSec.Many small offices keep their most important files on a Synology NAS, and many of those boxes are reachable from the internet for remote access. This post reflects what was published up to 1 November 2026.
What happened
Reports describe a ransomware strain called C3RB3R, from the Cerber family, encrypting files on Synology NAS devices since early October 2026. Encrypted files get a .L0CK3D extension, and a ransom note is left in every folder.
In a statement on 29 October, Synology said attackers are exploiting a vulnerability it fixed in December 2024, covered by its advisory SA-24:20 and identified in coverage as CVE-2024-10441, on devices running outdated versions of DSM. Reports say Synology later told customers the campaign is not related to the PHP2Shell flaws disclosed in October.
The cause is disputed
The security firm 360 links the cases it investigated to two newer flaws, CVE-2026-13639 and CVE-2026-13684, which Synology fixed on 18 September 2026. One response team also reported an affected NAS running a recent DSM 7.4.1 build, which would not fit the older flaw, although no new zero-day has been shown. Reports also note that public exploit code for the 2024 flaw appeared on GitHub on 25 October.
The practical advice is the same whichever account is right: the fixes for all of these flaws are in current DSM releases.
Can locked files be recovered?
No public decryptor exists for C3RB3R. Updating DSM stops new infections through these flaws, but it does not decrypt files that are already locked. Recovery depends on backups the ransomware could not reach.
What to do now
- Update DSM and every Package Center package to the latest release for your model. Compare the full build string, including the update number at the end, because the same build with a lower update number can still be vulnerable.
- Take the DSM login page off the internet. For remote access, use a VPN on your firewall instead of exposing the NAS directly.
- Check for signs of compromise: run Security Advisor, look in Task Scheduler for scripts you do not recognise and in User & Group for unknown administrator accounts. If you find either, contact Synology Support before you start cleaning up.
- Turn on automatic DSM updates.
- Check your backups: keep at least one copy off the NAS, for example Hyper Backup to another site or snapshot replication, and confirm the backup jobs are actually completing.
See backups that survive ransomware for how to keep one copy out of reach, and our incident response guide if a NAS has already been hit.
