C3RB3R Ransomware Encrypting Synology NAS Devices on Outdated DSM Builds

Scope: Synology DSM on NAS devices, all unpatched builds across the 7.4, 7.3, 7.2.2, and 7.2.1 lines (and earlier lines per Synology’s own advisory)

Severity: Red

Security firm 360 reported on October 29, 2026 that it had handled multiple ransomware response cases involving C3RB3R, a variant of the Cerber ransomware family, encrypting files on Synology NAS devices with a .L0CK3D extension and dropping a ransom note in every affected folder. There is a genuine dispute over the exact entry point: Synology’s own customer notice points to CVE-2024-10441, a flaw patched back in December 2024, while 360’s independent analysis points to two more recent flaws, CVE-2026-13639 and CVE-2026-13684, fixed on September 18, 2026. Both are critical, unauthenticated, remotely exploitable flaws rated 9.8 on CVSS. The practical implication for administrators is the same regardless of which theory is correct: a device that only applied the 2024 patch but skipped the September 2026 update remains exposed if 360 is right, so the only safe path is running the newest available build for your DSM line, not simply confirming an older patch was applied at some point. Synology has stated there is no workaround beyond updating. Administrators running Synology NAS devices must update DSM to the latest build for their version line today, specifically 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9, or 7.2.1-69057-12 or later, enable automatic DSM updates, and maintain at least one backup copy the NAS itself cannot reach or modify.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.