- 360 says a Cerber variant called C3RB3R hit Synology NAS devices it examined, entering through CVE-2026-13639 and CVE-2026-13684, both patched on September 18, 2026.
- Synology's October 29 notice blames outdated DSM installs but names no CVE. ZimaSpace says the evidence does not show one entry point for every device.
- Check that DSM is current, keep NAS management ports off the public internet, and hold one offline backup the NAS cannot reach.
The storage box nobody treats as a server
A network-attached storage device, or NAS, sits in a cupboard. It holds the files a business cannot afford to lose. It is also a computer, and it needs updates like any other. That is the real subject of this story.
Chinese security firm 360 says its anti-ransomware service has taken repeated calls for help since October. The callers own Synology NAS devices. 360 sampled some of the affected devices. It identified the ransomware as C3RB3R, a variant of the long-running Cerber family. According to 360, Cerber has targeted NAS devices for years.
What 360 found
360 says the break-ins it examined began with two remote flaws. They are CVE-2026-13639 and CVE-2026-13684. Both were disclosed in September.
360 calls this a typical "1day" attack. That means criminals used a flaw that was already public and already fixable.
Synology released updates on September 18, 2026, the day it disclosed the flaws. 360 says only about a month has passed since then. In its view, many devices are still not updated. It adds that many users do not know the flaws exist.
Synology's advisory SA-26:13 groups CVE-2026-13684 and CVE-2026-13639 with a third flaw, CVE-2026-13635. The advisory, which 360 reproduces, says the three allow a remote attacker to read or write any file. They also allow a denial-of-service attack, which knocks a device offline. A third use is to get non-sensitive information. The attack attribution to the first two flaws is 360's own.
In the cases 360 examined, a fix existed before the attackers arrived. Applying the update was left to the owner.
Two accounts, one common thread
A report from ZimaSpace adds the vendor's position. It says Synology's October 29 notice confirms attacks on outdated DSM installations. DSM is the operating system on Synology devices. ZimaSpace says the attacks aimed to encrypt data and demand payment.
The notice points to an older advisory, SA-24:20. It does not name the CVE used.
ZimaSpace reads the notice as pointing to a flaw patched in December 2024. It also stresses that 360's finding covers only the incidents 360 investigated. Public evidence, it says, does not show a single way in for every device.
So 360 names two September flaws, and Synology names none. We should not join the two accounts into one confirmed attack chain.
What they share is plainer and more useful. Both describe devices running software that was not current.
How the attack works
360 says C3RB3R follows a familiar routine. Once inside, it skips 27 system directories. That keeps the device running so the encryption can continue. It then walks through every other folder and encrypts the files it finds. It skips common programs, scripts and files it has already locked.
Each file gets its own 256-bit key and a 64-bit nonce, which is a one-time value. The ChaCha8 cipher scrambles the file contents. The malware then locks that key, and details of how the file was handled, with an RSA-2048 public key built into the sample. It attaches the result to the end of the file.
In general terms, the key to unlock the file stays with the attacker.
Locked files get the extension .L0CK3D, written with a zero. A note called read-me3.txt appears in each affected folder. It carries a 6-character device ID. 360 says files on a built-in extension list are fully encrypted. Other files are encrypted only in part.
Why recovery is harder than it looks
ZimaSpace adds cautions that matter in a crisis. Renaming a file back to its old extension does not restore its contents. A photo can show up in a folder listing and no longer open as an image.
Clues also have limits. A missing ransom note does not show a device is clean. A familiar extension alone does not reveal which flaw let the attacker in. ZimaSpace advises keeping sample files and logs before any cleanup.
What to ask your team
360 gives a practical checklist. Put these questions to whoever runs your storage.
Is every Synology device on a DSM version that includes the September 18 updates? Can anyone reach the management port from the public internet? 360 advises against that. For outside access, it recommends the vendor's relay service or a VPN.
Has the default administrator account been switched off? Do all accounts have strong passwords, two-step verification and automatic IP blocking? Does the firewall allow only needed ports? Is the admin console open only to trusted addresses?
Does one backup of important data stay disconnected from the NAS? 360 says that copy should be offline and isolated. Then ransomware cannot encrypt it too. Who reads the log centre for odd logins or mass file changes? 360 says to cut the network at once if signs appear.
The lesson here is simple. A patch protects only the devices that receive it. For a box in a cupboard, someone must be named as responsible for updating it.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: 360 (Qihoo 360 security research team).
