Internet-facing Synology NAS devices are being encrypted by the C3RB3R ransomware. Attackers exploit two critical CVSS 9.8 DSM flaws that Synology patched back in September.
According to an October 29, 2026 report from the China-based security research team 360, internet-facing Synology NAS devices are being hit by a ransomware campaign tracked as C3RB3R. Attackers get in through two critical flaws in Synology's DiskStation Manager (DSM) operating system. Encrypted files are renamed with the .L0CK3D extension, and a ransom note called read-me3.txt is dropped into every folder.
Both flaws are listed in Synology advisory SA-26:13. CVE-2026-13639 stems from insufficient entropy in the login logic, while CVE-2026-13684 is an improper output encoding issue in the SCGI component. Synology rated both as critical with a CVSS score of 9.8. Per the advisory, each allows arbitrary file read and write plus denial of service remotely, with no authentication and no user interaction required.
The patch shipped in September, the attacks began in October
The timing is the striking part. Synology published the fixes on September 18, 2026, and the campaign reportedly picked up in early October. There is no zero-day here, only unpatched devices. The fixed builds are DSM 7.4-90075, DSM 7.3.2-86009-4, DSM 7.2.2-72806-9 and DSM 7.2.1-69057-12. Anything below those versions is affected, and Synology lists no alternative workaround in its advisory. Updating is the fix.
One further detail deserves attention: a victim running a DSM 7.4.1 build was also reported. That suggests access does not always come through these two flaws, and that outdated packages, containers or stolen administrator credentials may also be in play. There is currently no confirmed free public decryptor.
Why this carries extra weight for smaller businesses
In most Turkish small and mid-sized companies, a NAS is the backup target. Project files at a construction office, document archives at a shipping agency, patient records at a clinic, technical drawings at a production facility — all of it tends to land on a single NAS. When ransomware encrypts the device the backup lives on, an incident moves from "no data lost, we restore" to "there is no copy left."
There is a legal dimension too. If a NAS holding personal data is encrypted, that is a data breach under Turkey's Law No. 6698, which triggers the notification duty to the Personal Data Protection Authority. The technical loss comes with an administrative process attached.
What Kamer Bilişim recommends
- Take the NAS management interface off the public internet. Remove port forwards on the router and firewall, and allow remote access only through a VPN. This campaign targets directly exposed devices, so this single step closes most of the attack surface.
- Check your DSM version and update. If you are below any of the four builds above, your device is affected. After updating, disable the default admin account and turn on two-step verification and automatic IP blocking.
- Keep a copy that the NAS cannot reach. The NAS should never be your only copy. Under the 3-2-1 rule, at least one copy must sit physically disconnected from the device and the network, or in immutable cloud storage. Enable snapshot protection, and actually rehearse a restore at least once a year.
If you are unsure whether your device is affected, searching your shared folders for files with the .L0CK3D extension and for read-me3.txt is a quick first check. If you would like us to review your NAS configuration, backup architecture and remote access policy together, you can reach us through our contact page.
Source: Synology Security Advisory SA-26:13 (September 18, 2026) and the 360 ransomware research team report (October 29, 2026).