CVE-2026-13639 & CVE-2026-13684 (CVSS 9.8): C3RB3R Ransomware Is Encrypting Synology NAS Devices — Patch DSM Now

If your organisation uses Synology NAS devices — for shared file storage, backups, or surveillance footage — read this before you do anything else. A ransomware campaign deploying C3RB3R (a variant of the long-running Cerber family) has been silently encrypting files on unpatched Synology DiskStation Manager (DSM) installations since at least early October 2026. On October 29, Synology issued an official press release urging all customers to update DSM immediately. With no public decryptor available, the only path to protection is patching — or rebuilding from offline backups.

What Is C3RB3R? Background on the Cerber Family

C3RB3R is a modern variant of Cerber, one of the most prolific ransomware families of the past decade. Originally emerging as a Ransomware-as-a-Service (RaaS) offering in 2016, Cerber went quiet for years before resurfacing with fresh tooling and targeting NAS devices — repositories that organisations treat as “safe” internal storage but which often run internet-facing services without the same scrutiny as endpoint devices.

Security researchers at Chinese firm 360 confirmed the C3RB3R attribution in late October, noting that the ransomware leverages unauthenticated remote access to DSM, gains execution, and then proceeds to encrypt all accessible file shares. The malware appends .L0CK3D to every encrypted file and drops a read-me3.txt ransom note containing a Tor-hidden payment portal. The demanded ransom — reported by some victims as roughly 3.9 million South Korean Won in Bitcoin — is adjusted dynamically, so do not treat that figure as definitive. Pay no ransom until you have verified whether your backups are recoverable.

The Vulnerabilities: Two CVEs in Dispute, One Urgent Action

There is a notable discrepancy in the reporting, and understanding it matters for your patching strategy:

Source	Attributed CVE(s)	Patch Date	Advisory
Synology (official)	CVE-2024-10441	December 2024	Synology-SA-24:20
360 Security (researcher)	CVE-2026-13639, CVE-2026-13684 (CVSS 9.8)	September 18, 2026	Synology-SA-26:13

Synology’s official position is that the campaign exploits a flaw patched in December 2024 and targets only devices that were never updated to that fix. However, researchers at 360 identify two additional critical vulnerabilities — an insufficient-entropy login flaw (CVE-2026-13639) and an incorrect output-encoding bug in the SCGI component (CVE-2026-13684) — which were patched only in September 2026. Both carry a CVSS score of 9.8.

The practical implication is serious: a device that applied the December 2024 patch but has not received the September 2026 update may still be exposed if 360’s analysis is correct. Synology has not publicly withdrawn its position, and 360 has not withdrawn theirs. Until one side concedes, the safest approach is to ensure your DSM build meets or exceeds the September 2026 minimums listed below. Treat this as a belt-and-suspenders moment.

Attack Chain: How C3RB3R Takes Your Data Hostage

Based on available technical reporting, the C3RB3R attack chain on Synology NAS follows this general pattern:

1. Reconnaissance & scanning: Attackers scan for Synology DSM management ports (typically port 5000/5001) exposed to the internet using Shodan-style tooling. India has a significant footprint of Synology NAS devices with the management interface reachable from the public internet.
2. Initial access: The attacker exploits the unauthenticated vulnerability (either the 2024 or 2026 flaw) to gain a shell or execute commands on DSM without needing valid credentials.
3. Execution & privilege escalation: C3RB3R runs with DSM-level privileges, giving it access to all mounted volumes and file shares — including Btrfs and ext4 volumes.
4. Data enumeration & encryption: Every accessible file share is enumerated and encrypted using a hybrid encryption scheme. The ransomware renames files with the .L0CK3D extension and writes the ransom note to each directory.
5. Backup destruction: Critically, any backup folder or snapshot stored on the same device — including Synology’s own Hyper Backup jobs pointed at a local volume — is also encrypted, wiping the self-contained recovery path.

The campaign has been running since at least early October 2026, meaning organisations that have not yet patched have been exposed for over four weeks. If your device has been online and unpatched during this window, treat it as potentially compromised and investigate before resuming normal operations.

Which DSM Versions Are Fixed?

The fixed builds published in Synology-SA-26:13 (September 18, 2026) are the minimum required versions. Always install the latest available update for your branch:

• DSM 7.4: 7.4-90075 or later
• DSM 7.3: 7.3.2-86009-4 or later
• DSM 7.2.2: 7.2.2-72806-9 or later
• DSM 7.2.1: 7.2.1-69057-12 or later

To check your current build: go to Control Panel → Update & Restore → DSM Update. If you are below these minimums, update immediately. If your model is end-of-life and no longer receives updates, isolate it from the network now and plan replacement.

Why NAS Devices Are a High-Value Target — and an Underguarded One

In most organisations I work with across India — from mid-market manufacturing firms in Pune to financial services companies in Mumbai — Synology NAS devices occupy a curious position: they are trusted as backup infrastructure, yet administered with far less rigour than servers. Firewall rules that block inbound access to AD servers often leave DSM management ports open, either deliberately (for remote access) or through oversight. Default credentials, expired SSL certificates, and auto-update settings left disabled are common findings during security audits.

This matters because the C3RB3R campaign is specifically designed to exploit that gap. Unlike ransomware that focuses on Windows endpoints and moves laterally, this campaign goes directly after the backup repository — the device organisations believe will save them when ransomware hits their workstations. When the NAS falls, recovery options collapse. This is the same pattern we documented in the GMO Internet ransomware incident earlier this year — attackers are increasingly targeting backup infrastructure first.

It is also worth noting that Synology’s investigation into this C3RB3R campaign originated during its broader analysis of the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), highlighting how a single advisory thread can uncover multiple unrelated attack chains affecting the same platform.

What You Should Do Right Now

Here is a prioritised action list — treat this as a weekend emergency if you have unpatched Synology devices in your environment:

1. Patch DSM immediately. Log into every Synology device across all branches and confirm the build number meets the September 2026 minimums. Enable automatic updates if not already done — Synology does not exploit-notify via email by default.
2. Disable the DSM management interface from the internet. There is almost never a legitimate reason for DSM’s web GUI (ports 5000/5001) to be directly reachable from the public internet. Put it behind your VPN or Zero Trust Network Access (ZTNA) gateway. On FortiGate, use application control policies to restrict DSM traffic to trusted source IPs.
3. Check your backups — before you need them. Run a test restore right now. If your Hyper Backup job is pointing at a local volume on the same NAS, your backup is not a backup — it is a co-located copy that will be encrypted alongside the primary data. Set up at least one isolated backup destination: an immutable S3-compatible bucket, Synology C2 Storage, or an offline disk rotated offsite.
4. Enable account lockout and 2FA. Go to Control Panel → User & Group → Advanced and set a strict login lockout policy. Enforce TOTP-based 2FA for all accounts — especially admin accounts. This reduces the blast radius of any credential-stuffing attack that leverages the SCGI flaw.
5. Audit internet-facing services. Use the Synology Security Advisor (built into DSM) to scan for exposed services. Disable any service you do not actively use: WebDAV, FTP, SFTP, rsync, and Photo Station are common attack surfaces.
6. Investigate if you have been running unpatched. If your device was internet-exposed and unpatched during October 2026, do not simply patch and move on. Image the system disk, check for modified files in system directories, look for new scheduled tasks, and confirm integrity against a known-good baseline. C3RB3R may have dropped a secondary payload.
7. Segment your NAS from production servers. Even after patching, NAS devices should not have unrestricted SMB/NFS access to domain-joined servers. Use Zero Trust microsegmentation — allow only specific source IPs to mount shares, and enforce this at the firewall level. A compromised NAS should not be a pivot into your AD environment.

India-Specific Context

Shodan data consistently shows India as one of the top five countries for internet-exposed Synology management portals — a legacy of the rapid NAS adoption in Indian SMEs during the pandemic-era remote work expansion. Many of these devices were provisioned quickly, with remote management enabled for convenience, and never hardened. CERT-In’s CERT-In has not yet issued a specific advisory on this campaign at the time of writing, but given the active exploitation, I expect one shortly. Do not wait for a CERT-In notice — this is a live, damaging campaign.

If you are a Managed Service Provider (MSP) in India managing Synology devices for multiple clients, prioritise a bulk firmware check across your fleet today. A single unpatched client NAS that gets encrypted will have a disproportionate operational and reputational impact — especially if it hosts their day-to-day shared storage rather than just backups.

Frequently Asked Questions

Is my Synology NAS at risk if it is behind a NAT router with no port forwarding?

If the DSM management port is not forwarded through the router and QuickConnect is disabled, your device’s direct attack surface is significantly reduced. However, you are still vulnerable to attacks that originate from within your network — a compromised workstation that can reach the NAS will attempt to encrypt mounted shares. Patching is still mandatory, and local network segmentation remains best practice.

I have enabled Synology’s Hyper Backup — am I safe?

Not if the backup destination is a local volume, an external drive permanently attached to the NAS, or another NAS on the same network without immutability enabled. C3RB3R specifically targets all attached storage volumes. Only backups stored in a location that the NAS cannot directly write to — such as immutable S3 buckets, Synology C2 with retention lock, or physically offline media — are safe. Test a restore now to confirm your backup is actually usable.

I have already been encrypted. Should I pay the ransom?

As a general rule, no — and certainly not before exhausting all alternatives. There is no public decryptor for C3RB3R as of this writing. Paying the ransom funds the criminal enterprise and does not guarantee file recovery. If you have offline backups that pre-date the encryption event, restore from those. If you have no clean backups, engage a professional incident response firm before making any payment decision. Preserve the encrypted data; do not wipe the device yet, as future decryptors sometimes emerge.

Does this affect Synology Surveillance Station (NVR) devices?

Any Synology device running a vulnerable DSM version is potentially in scope — including NVR builds. The implications for physical security infrastructure are significant: if your surveillance footage is stored on a Synology device and the device is encrypted, you lose visibility into your premises at the exact moment you need it most. Check DSM builds on all Synology hardware in your environment, not just file-server NAS units.

---

NAS ransomware campaigns like C3RB3R are a reminder that backup infrastructure is attack infrastructure when it is not properly secured. A Zero Trust architecture treats every internal device — including NAS units — as an untrusted endpoint until proven otherwise. That means enforcing least-privilege access, requiring authentication before mounting shares, and never exposing management interfaces to uncontrolled networks.

If you are unsure whether your Synology environment is properly hardened, or if you need help designing a Zero Trust backup architecture that survives ransomware, reach out to me for a no-obligation security assessment. I have spent three decades helping organisations across India build infrastructure that fails safely — before an attacker finds the gap first.