NAS security · Live advisory · Updated 11 November 2026
C3RB3R and your Synology. What to do this week.
Since late October 2026, ransomware called C3RB3R has been encrypting Synology NAS units running out-of-date DSM. Here is how to check yours, the settings that actually stop it, and what not to touch if your files already end in .L0CK3D.
Viktor (Dante) BurcevskiWildfire Data Recovery · IACIS CFCE 6 November 2026 · 9 min read · 22 references
AI-generated illustration. C3RB3R is locking the files on out-of-date Synology NAS units this week. No real device, brand or client is depicted.
If a Synology NAS in your office has missed a few updates, this is the week to look at it.
On 29 October 2026, Synology warned that attackers are exploiting a vulnerability it patched in December 2024 to encrypt data on devices running outdated DSM, and then demand a ransom. [1] Security news sites have since described a large wave of reports, with files renamed to .L0CK3D and a note called read-me3.txt left behind. Shadowserver tracks more than 380,000 Synology units that can be reached from the internet worldwide. [4] Nobody has published an Australian count.
The fixes already exist, and three checks cover most of the risk. None of them needs special tools.
Three checks for today
Do them in this order. Each one is explained below.
01 · VERSION
Is DSM up to date?
Compare your build with the latest safe builds. Check now
02 · EXPOSURE
Can the internet reach it?
Port forwarding, router auto-configuration and QuickConnect all count. See how
03 · COPIES
Would a copy survive?
Immutable snapshots, plus one copy that is offline or uses separate logins. See what works
Prefer a guided version? Our free NAS ransomware check checks your DSM build, asks 12 questions about how the NAS can be reached, and prints a first-hour card.
What’s happening
What C3RB3R is, and what is still unconfirmed.
AI-generated illustration. The bug C3RB3R uses was patched long ago, so a NAS that missed its updates has been a slow-burning risk ever since.
C3RB3R is reported as a variant of the older Cerber ransomware. It encrypts files on the NAS, renames them with a .L0CK3D extension and leaves a read-me3.txt note asking victims to buy the attackers’ decryptor. [4] The note also claims that any third-party recovery attempt will destroy the files. That line is there to stop you calling anyone. What actually damages recoverable data is writing to the disks after the attack, which is covered below.
Synology’s statement points to advisory SA-24:20, a group of critical bugs demonstrated at the Pwn2Own hacking contest in 2024. [1] The most serious, CVE-2024-10441, scores 9.8 out of 10 and lets a remote attacker run code without logging in. Synology released the fixes through November 2024 and added the last one, for DSM 6.2, on 5 December 2024. [2] That is why its warning says the bug was patched in December 2024.
There is a second advisory to know about. On 18 September 2026 Synology fixed two more critical bugs that need no login, CVE-2026-13684 and CVE-2026-13639, in advisory SA-26:13. [3] Security firm 360, as reported by IT-Connect, links C3RB3R to these newer bugs rather than the 2024 ones. [5] Synology has not said so. Either way, the practical answer is the same: update to the builds in the table below, which close both.
On 10 November 2026 Synology published a third critical advisory, SA-26:19. It fixes CVE-2026-76954, a flaw in DSM’s Auth API that lets a remote attacker read or write files without logging in, scored 9.8 out of 10, and CVE-2026-85101, a way past the login for rsync, scored 8.6. Synology lists no workaround and does not say either bug is being exploited or linked to C3RB3R. Its fixed builds are now the safe minimums in the table below.
Why small businesses are the target
Every major NAS ransomware wave has relied on devices that are reachable from the internet and have missed updates, and C3RB3R is exploiting fixes that have been available for months or years. ASD responded to 139 ransomware incidents in 2025 to 2026 and puts the average self-reported cybercrime loss for a small business at $55,400. [20]
Check 01 · Version
Check your DSM version in two minutes.
AI-generated illustration. A two-minute look at your DSM version shows whether your NAS has the fixes.
Sign in to DSM, open Control Panel and then Info Center. The General tab shows the DSM version, for example DSM 7.2.2-72806 Update 3. Synology’s advisories write the same build as 7.2.2-72806-3, so “Update 3” and “-3” mean the same thing.
Minimum safe DSM builds by version, as at 11 November 2026
Your DSM
Safe minimum (11 Nov 2026)
Support status
DSM 7.4
7.4.1-90080 Update 1
Supported. Maintenance runs to June 2028.
DSM 7.3
7.3.2-86009 Update 5
Supported. Maintenance to October 2027, extended life to October 2028.
DSM 7.2.2
7.2.2-72806 Update 10
Maintenance ended December 2025, though Synology still shipped this security fix. Move to 7.3 or 7.4 if your model allows.
DSM 7.2.1
7.2.1-69057 Update 13
As for 7.2.2.
DSM 7.2
No fix for the 2026 bugs
Update to 7.2.2 or later if your model allows. If not, take the NAS off the internet.
DSM 7.1
No fix for the 2026 bugs
Extended life ended June 2025. The 2024 fix is 7.1.1-42962 Update 7.
DSM 6.2
No fix for the 2026 bugs
Updates stopped on 1 October 2024. The 2024 fix is 6.2.4-25556 Update 8.
Builds from Synology-SA-26:19 and SA-24:20; support dates from Synology’s Software Life Cycle Policy (updated 13 October 2026) and its DSM 6.2 notice. [22][2][6][7] Always recheck Synology’s advisory page before acting.
Try it
Type your DSM version.
Copy it exactly as Info Center shows it. Nothing you type leaves this page.
Examples:
Waiting for a version.
The check compares your build with the safe minimums in the table above.
Version table as at 11 November 2026. This check reads the number you type; it cannot see your NAS or tell whether it has already been attacked.
Checking more than the version? Our free NAS ransomware check adds a 12-question exposure check and a printable first-hour card.
While you are in DSM, turn on automatic updates (Control Panel, Update & Restore), as Synology recommends. [1] One exception: if the NAS is already showing .L0CK3D files, do not update it yet. Read what to do if you have been hit first.
Check 02 · Exposure
Is your NAS reachable from the internet?
AI-generated illustration. Port forwarding, UPnP and QuickConnect can open a path from the internet straight to your NAS.
A bug that needs no login is only dangerous to a NAS an attacker can reach. There are three common ways a NAS ends up reachable from the internet, and owners often know about only the first.
01
Port forwarding
Your router sends outside traffic straight to the NAS, often on ports 5000 and 5001 for the DSM sign-in page. Check the port forwarding list in your router.
02
Router auto-configuration
DSM can ask the router to open ports for you using UPnP. Look in Control Panel, External Access, Router Configuration, and turn UPnP off on the router too.
03
QuickConnect
Synology’s relay service reaches the NAS without opening ports, but it still makes it reachable. Find it under Control Panel, External Access, QuickConnect.
When researchers found a zero-click bug in Synology Photos in 2024, they estimated that 1 to 2 million devices were exposed through port forwarding or QuickConnect. Turning off port forwarding and QuickConnect blocked attacks from the internet, though a device on the same office network could still reach the NAS. [8] If staff need remote access, use a VPN on your router or firewall instead, so they join the office network first and the NAS stays hidden.
Newer hardware is not immune. On the first day of Pwn2Own Ireland in October 2025, researchers fully compromised a Synology DS925+, a BeeStation Plus and Synology’s ActiveProtect backup appliance. [9] Fixes follow these contests, which is why keeping current matters more than which model you own.
Check 03 · Copies
The settings that actually stop it.
AI-generated illustration. An offline copy that attackers cannot reach or delete is your lifeline if ransomware gets in.
Security checklists tend to list a dozen settings as if they were equal. They are not. This table shows which settings stop which kind of attack.
Which NAS settings stop which kind of attack
Setting
Stops password guessing
Stops no-login bugs like C3RB3R
Saves you if an attacker gets admin
Disable the default admin, strong passwords
Stops many
No
Partly
Two-step sign-in and auto block
Stops
No
Stops password-only logins
Change the default ports
Deters only
Barely
No
No port forwarding, UPnP or QuickConnect; VPN instead
Stops internet attacks
Stops internet attacks
No
Update within 48 hours, auto-update, remove unused apps
Not relevant
Stops known bugs
No
Ordinary snapshots
Recovery only
Recovery only
Fails: admin can delete them
Immutable snapshots, separate backup login, offline copy
Recovery
Recovery
Recovery
Two rows do most of the work. Taking the NAS off the internet and patching quickly are the only settings that would have stopped every NAS ransomware wave on record. ASD’s Essential Eight asks for critical fixes on internet-facing devices within 48 hours. [13] Account settings still matter: Synology recommends disabling the default admin account, turning on auto block and running Security Advisor. [10] IT-Connect’s C3RB3R advice also includes updating or removing unused packages such as PHP, Mail Station and Calendar. [5]
Changing ports is not protection
Synology itself says changing the default DSM ports cannot prevent targeted attacks; it only deters common ones. [11]
Immutable snapshots: read the fine print
DSM 7.2 added snapshots that cannot be deleted during a set protection period, built for exactly the stolen-admin case. They depend on the model, and encrypted shared folders are not supported. [12]
Give backups their own login
At ASD’s higher Essential Eight levels, administrators cannot delete backups, and at the top level even backup administrators cannot delete them during their retention period. [13] In practice: copy to a second device or cloud account with different credentials.
Keep one copy offline
A drive that is unplugged and stored away cannot be encrypted through the network. IT-Connect’s advice on C3RB3R pairs write-protected snapshots with at least one offline backup. [5]
Already hit?
If your files already end in .L0CK3D.
AI-generated illustration. If your NAS has been hit, unplug it and leave it as it is: no updates, reboots or repairs.
The first hour decides how much can be recovered. Everything below is about protecting what is still on the disks.
Do this
Unplug the NAS’s network cable, or cut its internet access at the router.
Photograph the ransom note, a few renamed file names and the sign-in screen, and note the time.
Write down the DSM version if you can see it without changing anything.
Tell your IT provider, and call a recovery lab before anyone works on the disks.
Keep any offline or offsite copies disconnected until the NAS has been dealt with.
Don’t do this
Don’t update DSM on the affected unit yet. During the 2022 DeadBolt attacks, a forced QNAP firmware update removed what paying victims needed to decrypt. [14]
Don’t reboot it over and over, reset it, reinstall DSM or initialise the drives.
Don’t run a repair or let a rebuild start.
Don’t delete the encrypted files or the notes.
Don’t restore a backup onto the same volume before it has been assessed. [16]
Don’t pay before getting advice.
To keep this list beside the NAS, print the first-hour card from our free NAS ransomware check. It can also look up a file extension or ransom note name you don’t recognise.
Why so cautious? QNAP’s recovery tool for the 2021 Qlocker ransomware only worked when nothing new had been written to the disks. [15] And paying is no guarantee: during DeadBolt, no more than 8% of victims paid, and the attackers’ offer of a master key was never shown to work. [17]
Australian obligations to keep in mind
If your business turns over more than $3 million and pays a ransom, you must report the payment to ASD within 72 hours. [18] If the Privacy Act covers your organisation, an attack that may have exposed personal information can be a notifiable data breach, so start that assessment now rather than after the recovery. [19]
When an encrypted NAS reaches our Brisbane lab, we copy every disk before anything else, check which snapshots and copies survived, and rebuild the volume from the copies. We cannot promise a result and we never claim to decrypt ransomware, but working from copies means nothing we try can make the originals worse.
Older units
When there is no patch for your model.
AI-generated illustration. For older units that no longer get security fixes, time is running out: take them off the internet and plan their replacement.
Some Synology models cannot run DSM 7.2.1 or later, so Synology’s 2026 DSM fixes will never reach them. Synology’s lifecycle policy shows that extended life for DSM 7.1 ended in June 2025 for models whose last version is 7.1, including the DS1815+, DS415+, DS215j and DS3615xs. [6] DSM 6.2 stopped receiving updates on 1 October 2024. [7]
If your NAS is one of them, take it off the internet entirely: no port forwarding and no QuickConnect. Keep it on the office network behind a firewall, make sure everything on it also exists on another device, and plan its replacement. Hard drives are scarce in 2026, with Western Digital saying it is pretty much sold out for the year, so start early. [21]
Moving to a new NAS is a data move, not an upgrade. The usual mistakes are initialising the wrong disks or creating a new pool over the old data. If the data matters, copy the old disks before the move. Our RAID, NAS and server recovery page explains how failed arrays reach our bench and what decides the cost.
22 references · All visible
The sources behind this advisory.
Synology’s own statement and advisories come first. Security press reports are labelled as such; one firm’s attribution of C3RB3R to the 2026 bugs has not been confirmed by Synology. Links checked 6 November 2026; SA-26:19 added 11 November 2026.
Critical, 10 November 2026; fixed builds for DSM 7.4, 7.3, 7.2.2 and 7.2.1. These are now the safe minimums.
Viktor (Dante) Burcevski
Executive Data Engineer/Owner, Wildfire Data Recovery. IACIS Certified Forensic Computer Examiner (CFCE). Wildfire’s Brisbane laboratory accepts matters from across Australia.
Unplug the network cable and leave the drives as they are. Tell us the model, the DSM version if you know it, and what you can see. We will explain the options and the limits before any work starts.
