Synology C3RB3R ransomware: update DSM on your home NAS now
Synology warned that attackers are encrypting outdated DSM devices with C3RB3R ransomware. How home NAS owners update, turn off internet admin exposure, and verify the DSM build.
If a Synology NAS sits in a closet holding family photos, Time Machine backups, or media, treat this as a same-day check. On October 29, 2026, Synology published a press release warning that attackers are exploiting a vulnerability patched in December 2024 against devices still running outdated DSM. The goal is simple: encrypt the data and demand ransom. Follow-up reporting on November 2, 2026 (BleepingComputer, with a November 3 update quoting Synology) ties the wave to C3RB3R ransomware. Synology’s own release does not name the ransomware.
This is not the same page as our general home NAS patching checklist. That piece is the ongoing habit. This one is the current campaign: update DSM, stop exposing the admin UI to the internet, and look for the ugly signs that encryption already started.
What Synology said
From Synology’s October 29 press release:
- Threat actors are targeting outdated DSM versions.
- The vulnerability in play was patched in December 2024.
- Attacks aim to encrypt data and extort ransom.
- Synology urges everyone on vulnerable versions to update DSM immediately.
- Synology also recommends enabling automatic updates.
Synology points readers to advisory Synology-SA-24:20 for the fixed builds. That advisory, first published November 5, 2024 (with the DSM 6.2 fix added December 5, 2024), includes one Critical unauthenticated remote code execution issue (CVE-2024-10441) plus two Moderate file-access issues: a remote limited file read (CVE-2024-50629) and an adjacent-network limited file write (CVE-2024-10445). DSM 6.2 is rated Moderate on that advisory, not Critical. Synology has not publicly named which CVE (if any) is the entry point for this wave. BleepingComputer says a Synology spokesperson directed questions back to the same 2024 advisory.
Separately, The Hacker News reports that Qihoo 360 attributes the C3RB3R cases it examined to two later Critical bugs from Synology-SA-26:13 (published September 18, 2026): CVE-2026-13684 and CVE-2026-13639, both CVSS 9.8 and unauthenticated. Synology has not confirmed that attribution. Treat both advisory floors as in scope until Synology says otherwise. Do not treat “360 confirmed the entry point” as settled fact.
Affected users quoted by BleepingComputer describe encrypted files with a .L0CK3D extension and a ransom note named read-me3.txt, pushing a “C3rb3r Decryptor” purchase. If you see those names on shares, stop and isolate. Do not start random decrypt tools from the internet.
Fixed DSM builds to aim for
Install the newest DSM your model still supports. For the finish line on today’s checklist, use the higher of the two Synology advisories that apply to your branch:
From Synology-SA-26:13 (September 18, 2026), upgrade to at least:
| DSM branch | Fixed release (or later) |
|---|---|
| DSM 7.4 | 7.4-90075 |
| DSM 7.3 | 7.3.2-86009-4 |
| DSM 7.2.2 | 7.2.2-72806-9 |
| DSM 7.2.1 | 7.2.1-69057-12 |
From Synology-SA-24:20 (the advisory Synology’s October 29 note still links), older branches need at least:
| DSM branch | Fixed release (or later) |
|---|---|
| DSM 7.2 | 7.2-64570-4 |
| DSM 7.1 | 7.1.1-42962-7 |
| DSM 6.2 | 6.2.4-25556-8 |
A build that only clears SA-24:20 on 7.2.2 or 7.2.1 (for example 7.2.2-72806-1 through 72806-8) is still below the SA-26:13 floor. DSM 7.3 and 7.4 are their own branches, so check those rows above rather than treating them as “newer 7.2.2.” If your NAS cannot run a supported DSM anymore, treat that as a replacement problem.
What to do on your own NAS today
- Open DSM from a browser on your home network (not from a random public Wi-Fi session).
- Go to Control Panel > Update & Restore (wording can vary slightly by DSM version).
- Check for DSM updates, read the notes, then install. Expect a reboot. Pause big file copies and backup jobs first if you can.
- After reboot, open Control Panel > Update & Restore again (or Info Center) and read the DSM version string. Compare it to the tables above for your exact branch. A newer build in the same branch still fails if it is below that branch’s floor (for example 7.2.2-72806-2 is newer than 72806-1 and still short of 72806-9).
- Turn on automatic updates if you had them off. Synology recommends it in its October 29 release for a reason.
- Stop exposing the DSM management interface to the public internet. Treat these as two separate controls:
- Remove router port forwards aimed at DSM (often 5000 / 5001, plus anything else pointed at the admin UI).
- Separately decide whether QuickConnect stays on. Synology’s own docs say QuickConnect lets clients reach the NAS over the internet without setting up port forwarding, so skipping a forward does not turn QuickConnect off. If QuickConnect is enabled, the DSM login can still be reachable from outside through Synology’s relay. Prefer a VPN into the house when you need files away from home.
- Change the admin password if it is old, shared, or default-adjacent. Prefer a named admin account and a password manager entry.
If update install fails, take a screenshot of the error, note the current DSM version, and use Synology’s support docs or contact Synology support. Do not leave a failed updater sitting for a week.
If you already see .L0CK3D or read-me3.txt
- Unplug the NAS from the network (Ethernet and Wi-Fi). Pause sync and backup jobs that push into the encrypted volume.
- Do not format yet. Keep ransom notes, a few encrypted file samples, and logs if you can copy them to a separate drive.
- Do not pay as your recovery plan. Payment does not guarantee decryptors work, and it does not remove the hole that let them in.
- Restore only from a backup that was offline or otherwise not writable by the NAS during the attack. Test a restore of a few files first.
- Rebuild or reinstall DSM, apply a fixed build, rotate passwords, and only then reconnect shares.
HKCERT’s November 2, 2026 alert walks a similar isolate, preserve, remediate, then restore sequence. It also notes that Synology separately released PHP security updates (for PHP2Shell issues) through Package Center, and that Synology has not said whether those were involved in the ransomware attacks. Install any PHP package updates Package Center offers while you are there.
Do this / don’t do that
Do
- Update DSM now and confirm the version string yourself.
- Enable automatic DSM updates.
- Keep the admin UI off the public internet.
- Keep a backup that the live NAS cannot silently overwrite.
Don’t
- Do not assume “the NAS still serves photos” means it is patched.
- Do not leave DSM on a 2024-vulnerable build because “it works.”
- Do not leave DSM admin ports forwarded, and do not leave QuickConnect on “just in case,” without understanding that those are two different exposure paths.
- Do not run mystery decryptors from random websites.
Bottom line
Synology’s October 29, 2026 press release, amplified in early November reporting, says outdated DSM boxes are being hit for ransom, with C3RB3R-style encryption showing up in the wild. On your own Synology: install a DSM build that clears Synology-SA-26:13 for supported 7.2.1+ branches (and Synology-SA-24:20 for older branches Synology still documents there), turn on auto-updates, pull the admin UI off the internet (port forwards and QuickConnect are separate decisions), and prove the version after reboot. Family photos are not a reason to skip firmware. They are the reason to install it.
Image: Official Synology logo image from synology.com.
