Synology DSM: C3RB3R ransomware encrypts NAS data on outdated DSM builds
Severity: critical · Patch status: patched · Since 2026-10-29 · CVE-2024-10441, CVE-2024-10445, CVE-2024-50629
Synology says threat actors are exploiting a DSM vulnerability it patched in December 2024 to encrypt data on NAS devices that have not been updated, and it urged immediate DSM updates in a statement dated 2026-10-29. The statement does not name the flaw in the text we could retrieve; it links the November 2024 advisory Synology-SA-24:20, which covers CVE-2024-10441 (critical, CVSS 9.8, remote code execution), CVE-2024-50629 (limited file read) and CVE-2024-10445 (limited file write). The malware is C3RB3R, a Cerber-family ransomware that renames files with a .L0CK3D extension and leaves a read-me3.txt note offering a 'C3rb3r Decryptor' sold on a dark-web portal. Public reports of C3RB3R on NAS devices start in mid-October 2026: a BleepingComputer forum thread's first post is dated 2026-10-17 and does not name the vendor. BleepingComputer, citing Shadowserver, reports more than 380,000 Internet-exposed Synology NAS devices; that is an exposure count, not a count of vulnerable or compromised devices, and its as-of date is not stated. Fix: upgrade to the SA-26:13 builds where they apply (7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9, 7.2.1-69057-12), and at least the SA-24:20 builds on the older branches (7.2-64570-4, 7.1.1-42962-7, 6.2.4-25556-8). Synology's September 2026 advisory SA-26:13 (CVE-2026-13639, CVE-2026-13684, both CVSS 9.8) is a separate, later set of DSM fixes; Synology's statement does not tie the ransomware to it. The earlier Cerber campaigns against Confluence and GitLab used CVE-2021-26084, CVE-2021-22205 and CVE-2023-22518; those are not DSM flaws and are history only.
What to do
- Upgrade DSM to the SA-26:13 build for your branch: 7.4-90075 or later, 7.3.2-86009-4 or later, 7.2.2-72806-9 or later, or 7.2.1-69057-12 or later. The 7.2.2-72806-1 build in the earlier record is not enough for those branches.
- On the 7.2, 7.1 and 6.2 branches, install at least 7.2-64570-4, 7.1.1-42962-7 or 6.2.4-25556-8 (Synology-SA-24:20), and check Synology's advisory for a later build, because SA-26:13 coverage of those branches is not confirmed.
- Enable automatic DSM updates.
- Remove Internet exposure of the DSM management interface and restrict it to VPN or internal networks (our recommendation; Synology's statement does not say this).
- Search NAS shares for .L0CK3D renamed files and read-me3.txt notes. Isolate any affected device from the network before you restore or rebuild it.
- Restore from backups stored off the NAS. Do not pay for the decryptor.
Fixed versions
- 7.4-90075
- 7.3.2-86009-4
- 7.2.2-72806-9
- 7.2.1-69057-12
- 7.2-64570-4
- 7.1.1-42962-7
- 6.2.4-25556-8
Sources
All live incidents on Threat Watch
