Synology Users Should Be Afraid Of C3RB3R Ransomware
Over the last few days, users of Synology products have been hit by C3RB3R Ransomware. This apparently encrypts their drives and then the users are charged $3000 to $6000 in Bitcoin to release the contents. Affected files reportedly receive the LOCK3D extension. Most of the reports that I have heard of are in South Korea. But I have heard reports elsewhere.
Now security researchers have come out with two vulnerabilities that cover this. These are CVE-2026-13639 and CVE-2026-13684 and both are a 9.8 out of 10 which make them today problems. Synology has also noted this to make your life easier. If you have a Synology box, you should be running at least these versions:
DSM Branch
Minimum Fixed Version
DSM 7.4
7.4-90075
DSM 7.3
7.3.2-86009-4
DSM 7.2.2
7.2.2-72806-9
DSM 7.2.1
7.2.1-69057-12
If there are updates to the above versions available, install them. But a security patch addresses the underlying vulnerability but doesn’t reverse existing encryption. Thus you still need a separate recovery strategy. For example, I recommend backing up the NAS to BackBlaze as if you get pwned by hackers, you simply wipe the NAS and restore it from the backup.
Other things that you should consider are:
Never, ever expose your NAS to the Internet. Because if they can’t see it, they can’t hack it.
Review all accounts with administrative access to the NAS. Remove unused accounts and assign only the permissions each user requires. Avoid using administrator credentials for everyday file access. And for bonus points, enable multifactor authentication if you can.
Now Synology isn’t the only company to be a target of hackers. QNAP for example went through this. The point is that you have to be aware to the danger and take action to minimize the danger to yourself and your organization. Because taking no action is not a strategy. Ever.
This entry was posted on October 30, 2026 at 8:18 am and is filed under Commentary with tags Synology. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Synology Users Should Be Afraid Of C3RB3R Ransomware
Over the last few days, users of Synology products have been hit by C3RB3R Ransomware. This apparently encrypts their drives and then the users are charged $3000 to $6000 in Bitcoin to release the contents. Affected files reportedly receive the LOCK3D extension. Most of the reports that I have heard of are in South Korea. But I have heard reports elsewhere.
Now security researchers have come out with two vulnerabilities that cover this. These are CVE-2026-13639 and CVE-2026-13684 and both are a 9.8 out of 10 which make them today problems. Synology has also noted this to make your life easier. If you have a Synology box, you should be running at least these versions:
If there are updates to the above versions available, install them. But a security patch addresses the underlying vulnerability but doesn’t reverse existing encryption. Thus you still need a separate recovery strategy. For example, I recommend backing up the NAS to BackBlaze as if you get pwned by hackers, you simply wipe the NAS and restore it from the backup.
Other things that you should consider are:
Now Synology isn’t the only company to be a target of hackers. QNAP for example went through this. The point is that you have to be aware to the danger and take action to minimize the danger to yourself and your organization. Because taking no action is not a strategy. Ever.
Share this:
Like this:
Related
This entry was posted on October 30, 2026 at 8:18 am and is filed under Commentary with tags Synology. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.