Synology NAS Hit by C3RB3R Ransomware: Update DSM Now, Before It Finds You

Synology NAS C3RB3R Ransomware: Update First, Ask Later

Synology NAS owners have a clear job this week: update DSM now. A ransomware strain called C3RB3R, from the Cerber family, has been encrypting files on Synology NAS devices since early October 2026, renaming them with a .L0CK3D extension and dropping a bitcoin ransom note in every folder. On October 29, Synology confirmed the attacks and told every user on an older release to update DSM right away.

The demand starts at about 0.037 bitcoin, roughly 2,952 dollars at reported figures, and doubles after five days. That doubling clock is designed to panic victims into paying fast. Do not. Paying does not guarantee your files back, it funds the next attack, and it puts you on a list of people who pay. The first move is always the same: disconnect the affected device from the network if you can, do not overwrite your backups, and check whether you have a clean copy somewhere else.

Synology blames the intrusions on a flaw it patched in December 2024. The anti-ransomware team at China's 360 points instead to two critical vulnerabilities fixed on September 18, 2026. That disagreement matters, because it changes who is at risk. If the 360 team is right, even some users who thought they were current could be exposed. If Synology is right, the victims are mostly people who skipped updates for a long time. Either way, the advice is identical: get to the latest DSM release today.

The Zero-Day Question

A report circulating on October 30, attributed to a second incident response team called Solar, raises a harder question. It describes a victim already running a recent build of the DSM 7.4 branch and raises the suspicion of a zero-day, a flaw still unknown to the vendor. That claim is unverified, and it should be treated as a warning, not a fact.

Still, it is a useful reminder of how ransomware reporting works. Early in an outbreak, different teams see different victims, and their conclusions differ. One team sees old, unpatched boxes. Another sees a patched box that still got hit. Both can be telling the truth about their own cases. The safest response is to assume the worst for your own setup: update, check your exposure, and tighten access, even if you think you are already safe.

That means more than just clicking update. Turn off services you do not use, especially anything exposed to the internet. Check that remote access is limited to people who need it, with strong passwords and two-factor authentication turned on. And check your backups: a backup that lives on the same NAS, or that is always connected, is not a backup when ransomware arrives. It is just another folder to encrypt.

How to Protect a NAS in 30 Minutes

Start with the update. Log in to DSM, install the latest release, and restart if it asks. Then go through the external access settings and close anything you do not recognise. If you use QuickConnect or port forwarding, make sure you actually need it, and that it is locked down.

Next, check your snapshots and backups. Synology's snapshot tools can save you here, but only if snapshots were turned on before the attack and stored in a way the ransomware cannot reach. A separate, offline or immutable backup is the gold standard. If you do not have one, set one up this weekend, before you need it.

Finally, watch for the signs. Files renamed with .L0CK3D, ransom notes in folders, or a NAS that suddenly runs slowly or shows strange activity are all reasons to disconnect and investigate. If you are hit, our guide on what to do after a data breach covers the first steps, and our piece on MFA fatigue attacks is a useful reminder that attackers also target the humans around the box, not just the box itself.

The Bigger Lesson

A NAS feels like a safe, private alternative to the cloud. In many ways it is. But it is also a server in your home or office, and servers need maintenance. The C3RB3R outbreak is not a reason to abandon NAS storage. It is a reason to treat it like the server it is: update it, back it up properly, and do not leave it open to the internet by accident.

Synology users who updated promptly and kept offline backups should be fine. Users who left an old DSM release running, exposed to the web, with no separate backup, are the ones this ransomware was built for. The gap between those two groups is about 30 minutes of work. Do it today, while you still have a choice.