C3RB3R Ransomware Hits Synology NAS: Patch DSM to 7.4-90075 Before Files Are Lost

C3RB3R exploits a pair of critical authentication bypass vulnerabilities in Synology's DSM web management interface. CVE-2026-13639 is a logic flaw in the DSM WebAPI authentication handler that allows unauthenticated requests to reach privileged API endpoints by crafting a specific token structure. CVE-2026-13684 is a related session validation bypass that permits attackers to elevate an unauthenticated session to administrator level without valid credentials.

Together, these flaws give an unauthenticated attacker full administrative access to any Synology NAS running vulnerable DSM versions. The attack does not require brute-forcing credentials or social engineering. An attacker with network access to the DSM management port (TCP 5000/5001 or custom) can achieve full administrative control in seconds.

Once administrative access is established, the attacker uploads the C3RB3R binary via the DSM file manager, executes it through the DSM terminal or task scheduler, and the ransomware begins its encryption pass. The entire initial access and deployment process takes under five minutes on a typical undefended device.

The ransomware uses a multi-threaded file walker to maximize encryption speed. It prioritizes 187 high-value file extensions for full ChaCha8 encryption, uses partial encryption for all other file types to reduce encryption time while still destroying usability, and skips critical system directories to keep DSM operational -- ensuring the ransom note remains readable and the victim can access the payment instructions.

Synology NAS devices are particularly exposed because many organizations:

• Enable remote administration via port forwarding on consumer routers
• Run DSM without requiring VPN access to the management interface
• Fail to apply firmware updates promptly due to manual update processes
• Store primary backups on the same device as production data

Any Synology NAS reachable via the open internet on its management port is a viable target for this campaign until patched.

All Synology NAS devices running self-managed DSM installations are at risk. The vulnerability affects the web management interface present in all DSM deployments -- the attack does not require any specific application or service beyond the baseline DSM install.

Affected DSM branches and the last vulnerable version in each:

DSM 7.0, 7.1, and earlier branches are end-of-life and receive no patch. Operators on those versions must either upgrade the DSM major version or migrate to newer hardware.

The blast radius of a successful C3RB3R infection extends beyond the NAS device itself. Synology NAS systems commonly serve as:

• Primary backup targets for Windows servers, workstations, and Mac systems via Synology Active Backup and Hyper Backup
• File servers hosting shared documents, contracts, and operational data
• Surveillance storage for IP camera footage using Synology Surveillance Station
• Media servers and application data stores for Docker-hosted business applications

An organization whose NAS holds both its working data and its backup copies faces complete data loss with no local recovery path if C3RB3R runs successfully. Ransomware recovery planning built around a locally attached NAS must be redesigned to include at least one air-gapped or immutable offsite copy that cannot be reached by an attacker with NAS admin access.

Check your Synology DSM version immediately: navigate to Control Panel > Update and Restore > DSM Update. The version string appears in the top right corner of the DSM web interface.

C3RB3R uses a hybrid encryption model that makes file-by-file recovery without the attacker's key mathematically infeasible. The ransomware generates a unique 256-bit key for every file it targets, encrypts the file contents using ChaCha8 (a stream cipher variant of ChaCha20), then wraps the per-file key using RSA-2048 public-key encryption.

The RSA-2048 public key is embedded in the C3RB3R binary. Only the attacker holds the corresponding RSA-2048 private key. Without it, the per-file ChaCha8 keys cannot be recovered, and the encrypted file contents cannot be decrypted. There are no known flaws in C3RB3R's key generation or encryption implementation that would permit brute-force or cryptanalytic recovery.

For context on the current threat landscape, Synology's security response team issued a direct customer warning:

"We have identified active exploitation of vulnerabilities in DiskStation Manager that has led to data encryption on affected systems. Customers who have not applied the September 2026 security updates are at immediate risk. We strongly recommend patching immediately and reviewing for signs of compromise." -- Synology Security Advisory SA-26:13

After encryption: The malware drops read-me3.txt in every affected directory, including the root of each shared folder. The ransom note contains a victim ID unique to the infected device, a Tor payment portal URL, and instructions for Bitcoin payment of 0.037 BTC. The note states that the decryption key is stored on the attacker's server and will be deleted within 72 hours if payment is not received -- a common ransomware tactic to create urgency.

Commercial recovery tools: Multiple data recovery vendors have confirmed that commercial tools are ineffective against this C3RB3R variant. File carving recovers only files that were partially encrypted or that existed in unallocated disk space at the time of encryption. For most organizations, the only viable recovery path is restoring from an offline or immutable backup created before the compromise occurred.

Related supply chain attack context: see our earlier post on the Miasma GitHub repository attack, which similarly demonstrates how attackers target trusted infrastructure rather than endpoint endpoints to maximize data access.

Published infrastructure IOCs for this C3RB3R campaign are limited -- the attackers operate without persistent C2 domains or IPs in the current reporting. The following behavioral and file-system indicators are confirmed from victim and researcher analysis. Monitor for these signals across any environment with Synology NAS devices.

File system indicators (confirmed):

• Files with the .L0CK3D extension appearing across shared folders
• Files named read-me3.txt appearing in multiple directories simultaneously
• Rapid growth in file modification events across NAS shared folders (mass rename events)

Process/behavioral indicators (generated from known attack pattern):

• The DSM web service process spawning unfamiliar child processes or shell commands via the task scheduler
• Simultaneous writes to large numbers of files from a single process (ransomware encryption pass)
• New user accounts created in DSM admin panel without corresponding change management activity
• DSM administration sessions authenticated from unexpected source IPs

Network indicators (generated from DSM exposure pattern):

• External IP addresses authenticating to DSM management ports TCP 5000 or 5001
• POST requests to /webapi/auth.cgi or /webapi/entry.cgi from IP ranges outside expected administration subnets
• Unexpected outbound connections from the NAS IP to Tor exit nodes (ransom portal check-in)

These two Sigma rules detect C3RB3R's file-system artifacts and authentication bypass activity against DSM management interfaces. Both carry experimental status -- validate against your environment's log sources before enabling automatic blocking. A high volume of .L0CK3D file creation events in a short window is a near-certain indicator of active ransomware encryption.

Patch immediately. If your Synology NAS management interface is reachable from the internet without VPN, assume you are already targeted. Apply the patch, then audit for signs of compromise before restoring normal operations.

Patch priority: Update DSM to the fixed version for your branch before doing anything else. The authentication bypass cannot be exploited on patched systems.

C3RB3R's targeting of Synology NAS represents a calculated attack on the weakest link in most organizations' ransomware recovery strategy. NAS devices play a dual role that makes them uniquely destructive targets: they hold the primary data AND the primary backup.

The traditional ransomware response -- restore from backup -- fails completely when the NAS holding those backups is the device that was encrypted. Organizations that relied on Synology Hyper Backup, Active Backup for Business, or manual rsync jobs writing to a local NAS share discovered that their recovery path was gone the moment C3RB3R finished its encryption pass.

This campaign also reveals a broader pattern in ransomware evolution: attackers have shifted focus from endpoints to shared storage infrastructure. The reason is mathematical. A single ransomware execution on a Windows endpoint encrypts files accessible to that user. A single ransomware execution on a NAS serving 50 users encrypts everything accessible to all 50 users -- often including backups. The multiplier effect makes NAS targeting far more destructive per attack than endpoint targeting.

For defenders, three structural changes are required beyond this patch:

First, implement the 3-2-1 backup rule with an immutable offsite component: three copies of data, two different media types, one offsite and one immutable (cloud object storage with versioning and object lock enabled, or physical tape in a separate physical location). A NAS-to-NAS backup is not sufficient.

Second, segment NAS administration. The DSM management interface should never be reachable from the same network segment as general users or from the internet. Use a dedicated management VLAN accessible only via VPN with phishing-resistant MFA.

Third, enable Synology's built-in ransomware protection features: Snapshot Replication with immutable snapshots, ransomware protection policies in Hyper Backup, and the built-in anomaly detection in DSM Security Advisor.

For organizations in healthcare, legal, and financial services -- sectors frequently targeted by C3RB3R -- this incident is a direct prompt to review NAS backup architecture before the next campaign arrives. See also our analysis of the Brevo supply chain attack for context on how attackers pivot from compromised infrastructure to downstream victim organizations.