{"id":31044,"date":"2026-11-09T18:35:15","date_gmt":"2026-11-09T18:35:15","guid":{"rendered":"https:\/\/www.kaspersky.co.uk\/blog\/?p=31044"},"modified":"2026-11-09T18:35:15","modified_gmt":"2026-11-09T18:35:15","slug":"synology-c3rb3r-attack","status":"publish","type":"post","link":"https:\/\/www.kaspersky.co.uk\/blog\/synology-c3rb3r-attack\/31044\/","title":{"rendered":"C3RB3R attacks Synology: why you shouldn’t put off NAS updates"},"content":{"rendered":"

Many people think of a home network-attached storage (NAS) device as a large hard drive connected to their router. They store videos, photos, documents, and backups on it, then barely think about the device for years. That\u2019s a huge mistake.<\/p>\n

In October 2026, attackers began infecting Synology NAS devices with C3RB3R (Cerber<\/em>) ransomware. Many users report that they can no longer open files on their network storage, and that text files containing ransom demands are appearing in their folders. And this isn\u2019t happening because someone accidentally downloaded a malicious file: anyone who forgot to update their network storage in time is at risk.<\/p>\n

In this article, we explain exactly who\u2019s at risk and how to protect your data.<\/p>\n

Who C3RB3R targets and how the attack works<\/h2>\n

We\u2019re used to thinking that malware gets onto a device after someone downloads a suspicious file or follows an attacker\u2019s instructions. But the vast majority of C3RB3R infections happen without any user interaction at all \u2014 the attacker only needs to reach a vulnerable NAS service. Specialized scanners likely help find such devices by automatically looking for Synology NAS systems and checking their DiskStation Manager (DSM) version.<\/p>\n

In October, many Synology owners began reporting C3RB3R attacks. Synology officially confirmed<\/a> the issue and said the attackers were exploiting a vulnerability that had been fixed back in December 2024. Based on the description, this appears to be CVE-2024-10441<\/a> \u2014 a vulnerability that lets an attacker execute arbitrary code in the NAS operating system without authentication.<\/p>\n

At the same time, researchers at 360.cn reported<\/a> that the C3RB3R attacks they examined also involved two other critical vulnerabilities, each rated 9.8: CVE-2026-13639<\/a> and CVE-2026-13684<\/a>. These vulnerabilities allow arbitrary file reads or writes and denial-of-service (DoS) attacks. Synology hasn\u2019t confirmed that these vulnerabilities have been used in this campaign. The company patched them in its September DSM update.<\/p>\n

Either way, the vulnerabilities mentioned above allow attackers to target a NAS remotely. For attackers to access your storage, get ransomware onto it, and run it, only two conditions need to be met:<\/p>\n

    \n
  1. You haven\u2019t updated your network-attached storage for a long time<\/li>\n
  2. The Synology DiskStation Manager (DSM) interface is accessible from the internet (or the local network)<\/li>\n<\/ol>\n

    That\u2019s it. The attacker doesn\u2019t need your password or any action from you. Every<\/em> Synology NAS owner who hasn\u2019t <\/strong>updated the system in time<\/strong><\/a> is at risk<\/strong>.<\/p>\n

    If you haven\u2019t installed updates yourself recently and don\u2019t remember whether automatic updates are enabled, we recommend first blocking internet access to your NAS and then updating the device manually as soon as possible \u2014 otherwise, you could easily end up among the victims.<\/p>\n

    Keep in mind that until the updates are installed, the device remains vulnerable to attacks from the local network. So, if your Synology NAS is accessible to other users on the LAN \u2014 for example, it\u2019s shared with neighbors or connected to a university, office, or dorm network \u2014 the safest option is to disconnect the Ethernet cable and turn off Wi-Fi if your NAS model supports it. Then download the update files to your computer, disconnect the computer from both the wired network and Wi-Fi, connect the NAS directly to the computer with an Ethernet cable, and update its operating system and applications in a fully isolated environment.<\/p>\n

    Another strong reason to update your network storage is the recently discovered PHP vulnerabilities<\/a>. Synology has already released urgent updates for its operating system and the Mail Station and Synology Calendar applications<\/a>.<\/p>\n

    What happens to files after infection<\/h2>\n

    Once C3RB3R ransomware gets onto network-attached storage, it starts traversing every accessible folder containing user data and encrypts the files inside \u2014 photos, documents, archives, videos, and audio recordings \u2014 adding the .L0CK3D<\/em> extension to encrypted files. If a user tries to open one, the system reports that the file is corrupted or in an unknown format. Unfortunately, simply renaming the file won\u2019t remove the encryption.<\/p>\n

    \"C3RB3R<\/a>

    This is what files look like after C3RB3R encrypts them<\/p><\/div>\n

    The attackers also helpfully leave a text file named read-me3.txt in folders containing encrypted files, with instructions on how to decrypt the data on your storage. Apparently, all you need to do is\u2026 open the totally-not-suspicious<\/span> Tor Browser and pay the attackers for a decryptor that supposedly restores all your files. Needless to say, there\u2019s no guarantee you\u2019ll get your files back intact.<\/p>\n

    \"C3RB3R

    C3RB3R leaves a ransom note like this in every folder containing encrypted files. A truly generous offer: decrypt one file for free, then pay for the rest<\/p><\/div>\n

    Losing all or most of your files may not be the only unpleasant consequence. Attackers often blackmail victims by threatening to publish stolen data \u2014 account credentials, intimate photos, work documents, and other confidential information. If the victim refuses to pay the ransom, the criminals threaten to make all of this data public. They may contact you with these demands by email or through social media.<\/p>\n

    Often, such threats are nothing more than a scam, and we covered these schemes \u2014 and what to do if you\u2019re being blackmailed \u2014 in detail in our post How scammers use email for blackmail and extortion<\/strong><\/a>. But if your NAS has actually been encrypted, unfortunately you can\u2019t rule out data theft.<\/p>\n

    What to do if ransomware has already infected your Synology NAS<\/h2>\n

    If ransomware has already attacked your NAS, you may face one of two situations.<\/p>\n

      \n
    1. You caught the ransomware in the act and are watching in horror as more and more files are encrypted and renamed before your eyes.<\/li>\n
    2. The user folders have already been encrypted, and the .L0CK3D extension has been added to all your files.<\/li>\n<\/ol>\n

      What should you do?<\/p>\n

      1. Immediately disconnect the NAS from all networks (but don\u2019t power it off)<\/h3>\n

      The NAS needs to be completely isolated from the internet and the rest of your home network. Disconnect every cable from the NAS except the power cable<\/strong>. If your NAS model connects to the local network over Wi-Fi, disable the wireless connection too. You can either disable it on the NAS itself (some Synology models have a Wi-Fi button that turns off wireless networking when held down) or simply unplug your router. This cuts off the attackers\u2019 remote access to the device and prevents the infected NAS from reaching other computers and storage devices.<\/p>\n

      If external USB drives are connected to the NAS to expand its storage capacity, disconnect those too \u2014 there\u2019s a chance the ransomware hasn\u2019t reached them yet.<\/p>\n

      Pause synchronization and backup jobs associated with the NAS on computers and in cloud services. This helps prevent damaged files from spreading to other copies and overwriting versions that are still intact.<\/p>\n

      2. Decide whether to power off the NAS<\/h3>\n

      If you catch Cerber in the act, your first instinct may be to pull the NAS power cable, but you shouldn\u2019t do that: a sudden loss of power can corrupt data being written to disk. It\u2019s better to use the NAS\u2019s normal shutdown procedure, but keep in mind that doing so removes one possible way to recover files that have already been encrypted. A specialist may, with some luck, be able to extract a recovery key<\/a> from the device\u2019s RAM. Once power is removed, RAM is cleared.<\/p>\n