C3RB3R ransomware encrypts Synology network storage running outdated DiskStation software
November 3, 2026 (Synology warned October 29; reported November 2 to 3, 2026)
Synology warned that attackers are encrypting files on DiskStation Manager (DSM) network storage devices that run outdated software, and that customers have reported infections. The ransomware, called C3RB3R, adds the extension .L0CK3D to encrypted files and leaves a ransom note named read-me3.txt in each affected folder. Synology's notice did not name the exploited flaw and pointed to its November 2024 advisory, SA-24:20, which lists CVE-2024-10441, a critical remote code execution flaw rated 9.8. That flaw was fixed in December 2024, and the fixed versions start at DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7 and 6.2.4-25556-8. Separately, Qihoo 360 says C3RB3R has also exploited CVE-2026-13684 and CVE-2026-13639, both rated 9.8, which Synology fixed in September 2026. Security Boulevard lists the Synology notice as also extending its PHP2Shell fixes to older DSM releases. Synology has not said how many devices are affected.
Why it matters
Network storage often holds backups, so ransomware that reaches it can lock both the data and the copies meant to restore it. The main flaw named has had a fix for almost two years, which makes this a story about devices that were never updated.
What defenders can take from it
- Update DSM to a fixed version for your model, and turn on automatic updates.
- Do not leave the storage device's management page or file services reachable from the internet. Use a VPN for remote access.
- Keep at least one backup copy offline or in a separate account that the device cannot overwrite, and test that you can restore from it.