Synology has warned that C3RB3R ransomware attacks against NAS devices on outdated DiskStation Manager builds are ongoing. Encrypted files get a .L0CK3D extension, and more than 380,000 Synology NAS units are exposed to the internet.
Synology has warned customers that a ransomware campaign known as C3RB3R is still hitting its NAS devices. According to BleepingComputer's 2 November 2026 report, attackers exploit a flaw in outdated DiskStation Manager (DSM) builds to encrypt the files stored on the unit. Encrypted files are renamed with a .L0CK3D extension, and a ransom note called read-me3.txt points victims to a Tor payment portal that asks thousands of dollars for a "C3rb3r Decryptor".
Reports disagree on the entry point. Synology says the exploited vulnerability was patched in December 2024 and refers owners to advisory Synology-SA-24:20, which covers CVE-2024-10441, a remote code execution flaw. Security vendor 360 instead attributes the incidents it investigated to CVE-2026-13639 and CVE-2026-13684, patched by Synology in September 2026 under Synology-SA-26:13; IT-Connect reports both carry a CVSS score of 9.8 and need no authentication. Gridinsoft notes the mismatch is not evidence of a new zero-day or of attacks against fully patched DSM — each case has to be judged on its own logs.
Why this matters
In a small or mid-sized company a NAS usually does two jobs at once: it is the shared file server and it is where the backups live. Encrypt it and you take out the working data and the recovery plan in one move. BleepingComputer, citing Shadowserver, puts the number of internet-exposed Synology NAS devices at more than 380,000. How many of those are unpatched is unknown, but exposing the management interface straight to the internet keeps coming up as the common mistake.
There is a second trap in how DSM reports updates. Tom's Hardware wrote on 29 October 2026 that on a compromised DS918+ the interface showed the system as up to date while critical updates were in fact missing. A green tick in the panel is not proof that the patch is installed.
What it means for Turkish SMEs
Construction offices, shipping agencies, clinics and accounting firms across Türkiye keep project files, scan archives and database dumps on a NAS, and often open a port on the router so staff can reach it from site or from home. Those two habits together produce exactly the setup this campaign looks for.
There is a compliance angle as well. If the encrypted NAS holds personal data — identity details, contact records, health information — the incident is a personal data breach. Under Article 12 of Law No. 6698, the data controller must notify the Personal Data Protection Board as soon as possible. The notification clock therefore starts running alongside the technical recovery.
What Kamer Bilişim recommends
- Check and update DSM and its packages by hand, then turn automatic updates on. Do not trust the panel's "up to date" message — compare your build against the version numbers in Synology's SA-24:20 and SA-26:13 advisories, and remove packages you no longer use.
- Take the management interface off the internet. Remove the port forwards on the router and serve remote access over a VPN instead. Disable the default admin account, switch on two-factor authentication and enable automatic IP blocking.
- Move the backup off the NAS. RAID is not a backup. Enable write-protected snapshots on shared folders and keep at least one copy on separate, offline or immutable storage — then schedule a restore test, not just the backup job.
If a device has already been encrypted, do not reset or rebuild it: isolate it from the network and preserve the ransom note, sample encrypted files, the DSM version and the logs. To review your NAS, backup and remote access setup together, or for help with a post-incident assessment, reach us through our contact page.
Source: BleepingComputer, IT-Connect, Gridinsoft, Tom's Hardware
Source: BleepingComputer