C3RB3r ransomware is still encrypting Synology NAS devices, with no free or working decryptor. Hundreds of devices worldwide have been hit, according to Decryption Digest, with attackers demanding about 0.037 bitcoin for a tool sold as the C3rb3r Decryptor. Encrypted files get a .L0CK3D extension, and a ransom note named read-me3.txt is left behind.

Recovery without paying is not realistic. Each file gets its own 256-bit ChaCha8 key, wrapped with RSA-2048, and only the attacker holds the matching private key. Commercial recovery tools have proved ineffective, so the only reliable recovery is an offline or immutable backup made before the attack.

Which flaw is being exploited is still disputed

Synology warned on 29 October that attackers were exploiting a vulnerability patched in December 2024, pointing to its advisory Synology-SA-24:20. Its most serious flaw is CVE-2024-10441, a remote code execution flaw rated 9.8. Synology has not named the exact flaw. Researchers at Chinese firm 360 instead link it to two flaws patched on 18 September 2026, CVE-2026-13639 and CVE-2026-13684, also rated 9.8. The latest DSM release covers both advisories, so the dispute does not change the fix.

Why NAS devices are prized targets

A NAS box often holds both an organisation's working files and its backups, so one intrusion can remove both data and recovery. The attack needs no stolen password: attackers reaching an exposed DSM management interface can gain administrative control in seconds, according to Decryption Digest.

Owners should update DSM to 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 or 7.2.1-69057-12, remove port forwards for ports 5000 and 5001, and put admin access behind a VPN. Enable two-factor authentication, check for .L0CK3D files and read-me3.txt notes, and keep one backup offline or immutable. DSM 7.0 and 7.1 have no patch, so those devices must be upgraded or replaced.