NAS Guides · Published 2026-11-03

Synology LOCK3D / C3RB3R Ransomware Attack

Direct answer up front, then the trade-offs that matter. This page covers synology lock3d c3rb3r ransomware and answers: What is a NAS and do I need one?.

Quick Answer

In late October 2026, a wave of ransomware attacks encrypted files on thousands of Synology NAS devices worldwide. The malware, tracked as C3RB3R (a Cerber variant), appends a .L0CK3D or .LOCK3D extension to every file and drops a read-me3.txt ransom note in each folder. Synology attributes the campaign to exploitation of vulnerabilities that were already patched in older DSM versions, which means an unpatched device exposed to the internet is the primary risk. The fastest protection is to update DSM and every installed package, turn on automatic updates, and pull the NAS back behind a VPN instead of leaving the management interface open to the public internet.

Key Takeaways

• C3RB3R encrypts files with RSA-4096 plus AES or ChaCha20; no free universal decryptor exists, so recovery depends on clean offline backups.
• Synology states attackers leveraged flaws fixed in 2024, so devices running outdated DSM are the main targets (Source: Synology Security Advisories, accessed 2026-11-03).
• A second, separately patched flaw — PHP2Shell (CVE-2026-109618 / CVE-2026-109619, CVSS 9.8) — affects packages such as Calendar, Mail Station, and WordPress and was fixed on 2026-10-22 (Source: Synology Security Advisories, accessed 2026-11-03).
• RAID is not a backup: the encryption walks every mounted volume, including local USB and Hyper Backup destinations on the same machine.
• The single most effective step is removing the NAS from direct public exposure and requiring a VPN for remote access.
• Patching must cover packages, not just DSM: the PHP2Shell flaws lived in Calendar, Mail Station, and the PHP runtime and were fixed on 2026-10-22 (Source: Synology Security Advisories, accessed 2026-11-03).

What Happened

Starting around 28 October 2026, Synology owners began reporting that files on their NAS had been renamed with a .L0CK3D extension overnight. Each directory contained a new read-me3.txt file labeled "C3RB3R INSTRUCTIONS" demanding cryptocurrency for a decryptor. Reports surfaced across Reddit's r/synology community, BleepingComputer forums, and multiple regional security outlets within a 12-hour window, indicating a coordinated, automated campaign rather than isolated incidents (Source: Reddit r/synology, accessed 2026-11-03; Source: BleepingComputer, accessed 2026-11-03).

The ransom note and file signature match C3RB3R, a variant of the long-running Cerber family. Victims describe the encryption as near-instant across all shared folders, with some users noting their NAS fans spun at full speed through the night as the encryptor scanned storage. Because the payload targets the filesystem directly, it does not care whether the data is family photos, business documents, or database images.

Synology's official position is that the attackers are exploiting a vulnerability already resolved in December 2024 (tracked under Synology-SA-24:20). In other words, the vendor's message is blunt: devices that were kept current were not the ones hit (Source: Synology Security Advisories, accessed 2026-11-03). That said, several independent responders note that some victims reported recent DSM versions, which keeps the exact entry point officially unconfirmed and argues for hardening the whole exposure surface rather than trusting a version number alone.

How the Attack Works

The encryptor uses strong, asymmetric cryptography. Analysis of victim samples shows RSA-4096 combined with AES or ChaCha20, the same class of scheme that makes brute-force recovery mathematically impossible (Source: BleepingComputer, accessed 2026-11-03). There is no known free decryptor, so paying the ransom is the only path the attacker offers — and paying does not ensure a working key.

Two intrusion paths appear repeatedly in incident write-ups. The first runs through containers. Many owners run GitLab, Confluence, or other web services inside Container Manager and map their ports straight to the internet. When an unpatched container is breached, the attacker can escape to the host, drop a persistence script into the Linux cron daemon, and wait silently before launching the encryptor (Source: BleepingComputer, accessed 2026-11-03). The second path targets Synology's own packages. The PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619, each scored CVSS 9.8) let an unauthenticated request reach vulnerable PHP code inside packages such as Calendar, Mail Station, and WordPress, which then executes attacker commands (Source: Synology Security Advisories, accessed 2026-11-03).

Once inside, the payload traverses every mounted volume — /volume1, /volume2, and attached USB drives — and encrypts local backups alongside original files. Snapshots help only if they are immutable and stored where the ransomware process cannot rewrite them. Compared with a single stolen laptop, a NAS is a higher-value target precisely because it concentrates years of backups in one place.

Who Is at Risk

The common thread among victims is exposure plus staleness. Devices that were reachable from the public internet — through QuickConnect, manual port forwarding, or an open UPnP mapping on the router — and had not applied DSM or package updates are the clear majority of cases (Source: Synology Security Advisories, accessed 2026-11-03). Two-factor authentication and a changed default admin account reduce account-takeover risk but do nothing against an unauthenticated package exploit, which is why several 2FA-protected victims were still encrypted.

Small businesses running customer docs, media teams storing masters, and home users keeping decades of photos are all in scope. The attack is not limited to one model family; reports span DSM 7.2.1 and 7.4.x releases. Newer ARM-based units have shown fewer cases, but no model should be considered immune if it sits on the public internet unpatched. The campaign also shows that 2FA and a renamed admin account narrow account-takeover risk but do nothing against an unauthenticated package exploit, which is why several protected owners were still encrypted (Source: BleepingComputer, accessed 2026-11-03).

How to Check If You Are Affected

Open File Station and sort by modification time. A sudden cluster of files renamed to .L0CK3D or .LOCK3D, or a read-me3.txt appearing in folders you did not create, is the unmistakable signal. If you see either, stop here and do not reboot or reinstall — that can overwrite forensic logs you or a responder may need.

Next, review Control Panel → Security → Security Advisor and the DSM update screen. If DSM or any package shows an available update, the device was behind, which is the condition attackers exploit. Check Log Center for odd login sources, unexpected package installs, or cron entries you did not schedule. Finally, confirm whether any management port (5000/5001, or the HTTPS alternative) is forwarded on your router or exposed through a reverse proxy without authentication.

How to Harden Your Synology NAS

Start with patches. Go to Control Panel → Update & Restore → DSM Update and install everything, then repeat for Package Center so Calendar, Mail Station, WordPress, phpMyAdmin, and the PHP runtime itself are current. Synology resolved PHP2Shell in PHP 7.4.33-0131 and later builds on 2026-10-22, and extended fixes to DSM 6.2, 7.0, and 7.1 on 2026-10-29 (Source: Synology Security Advisories, accessed 2026-11-03). Enable Automatically install important updates so future critical fixes land without manual action.

Then shrink the attack surface. Disable QuickConnect if you do not need it, remove manual port forwarding for DSM, and turn off UPnP on the router so the NAS cannot silently open its own path to the internet. For remote access, publish the NAS only through a VPN (WireGuard or OpenVPN) or Tailscale, never the bare management port. If you run containers, do not map their ports to the WAN; keep them on an internal network and reach them through the VPN.

User accounts should use strong unique passwords plus 2FA; the default admin account should stay disabled; and Account → Advanced should limit failed-login attempts and block suspicious IPs. These steps will not stop a zero-day, but they remove the unauthenticated paths that this campaign actually used.

A Backup Plan That Survives Ransomware

Backups are the only reliable recovery here, and not all backups qualify. The encryptor reaches any writable location on the same machine, so a USB drive or Hyper Backup task stored on the NAS itself is not enough. Adopt a 3-2-1 shape: three copies, two different media, one offline or immutable.

Use Hyper Backup to a remote Synology, a supported cloud target, or an air-gapped USB disk you connect only during the backup window. Turn on Advanced Retention with immutable (WORM) snapshots where your target supports it, so a compromised NAS cannot delete old versions. Keep at least one copy the ransomware process cannot write to — a detached disk or a bucket with object-lock retention. Test a restore quarterly; an untested backup is a hope, not a recovery plan.

Common Mistakes to Avoid

The biggest is treating RAID as a backup. RAID 1, 5, or 6 protects against a dead disk, not against encrypted files — the encryptor sees every volume as ordinary files and locks them all, and pulling the drives out will not decrypt anything (Source: BleepingComputer, accessed 2026-11-03). Another mistake is trusting "updated" without verifying: some victims believed they were current yet were missing package-level fixes, so check Package Center explicitly, not just DSM.

A third error is leaving the management UI on the public internet because "it is behind a strong password." This campaign shows unauthenticated package flaws bypass credentials entirely. Another gap is assuming snapshots alone save you; snapshots help only when they are immutable and stored where the encryptor cannot rewrite them, while ordinary writable snapshots on the same volume are fair game. Finally, do not pay the ransom expecting a working key, and do not reboot a live infection before preserving logs — both choices reduce your already-limited recovery options.

Frequently Asked Questions

What is the C3RB3R ransomware and how is it linked to Synology?

C3RB3R is a variant of the Cerber ransomware family. In the late-October 2026 wave it specifically targeted Synology NAS devices, renaming files with a .L0CK3D extension and leaving read-me3.txt ransom notes (Source: Reddit r/synology, accessed 2026-11-03). The link is the device, not a Synology-made payload; attackers reached the NAS through unpatched software, not through the hardware itself.

Can I decrypt my files without paying?

For this campaign there is no known free decryptor, because the encryption uses RSA-4096 with AES or ChaCha20 (Source: BleepingComputer, accessed 2026-11-03). Recovery depends on having an untouched offline or immutable backup. Paying is the attacker's only offered route and does not assure a working key.

Does updating DSM fully protect me?

Updating DSM removes the old-firmware path Synology says was exploited, which addresses the majority of cases (Source: Synology Security Advisories, accessed 2026-11-03). It is necessary but not sufficient: you must also update every package, disable public exposure, and secure containers, because the PHP2Shell flaws lived in packages, not the DSM core.

Is Synology Drive affected by the PHP2Shell flaw?

No. Synology lists IDrive as a third-party package and explicitly states that Synology Drive is not affected by PHP2Shell (CVE-2026-109618 / CVE-2026-109619) (Source: Synology Security Advisories, accessed 2026-11-03). Affected packages include Calendar, Mail Station, WordPress, phpMyAdmin, Joomla, MediaWiki, KodExplorer, vtigerCRM, Web Station, and the PHP runtime.

Should I turn off QuickConnect and port forwarding?

If you do not need direct remote access, yes. Removing DSM from public exposure and reaching the NAS through a VPN eliminates the unauthenticated entry points this campaign used (Source: Synology Security Advisories, accessed 2026-11-03). QuickConnect is convenient but expands the attack surface; weigh that against your actual remote-access needs.

What should I do first if I think I am infected?

Disconnect the NAS from the network immediately, but do not reboot or reinstall. Preserve the running state and logs so a responder can analyze the entry point, then restore from a clean offline or immutable backup after confirming the system is patched and cleaned.

Sources

• Synology Security Advisories — Synology-SA-26:14 PHP2Shell (CVE-2026-109618, CVE-2026-109619, CVSS 9.8; fixed 2026-10-22, extended to DSM 6.2/7.0/7.1 on 2026-10-29): https://www.synology.com/en-global/security/advisory/Synology_SA_26_14 (accessed 2026-11-03)
• BleepingComputer — NAS ransomware victim reports and ID Ransomware C3RB3R tracking: https://www.bleepingcomputer.com/forums/index.php?app=forums&module=forums&pid=5848250&section=findpost (accessed 2026-11-03)
• Reddit r/synology — surge of C3RB3R victim posts across late October 2026: https://www.reddit.com/r/synology/ (accessed 2026-11-03)

Affiliate Disclosure: SecureNAS Hub may earn a commission from qualifying purchases made through links on this page, at no extra cost to you. Facts and figures are attributed in the Sources list; nothing on this page is a fabricated test result. See our full disclosure. Product images are either supplied by the manufacturer or clearly labelled as illustrative renders; each one is captioned accordingly. Last reviewed 2026-11-03.