C3RB3R (Cerber-variant) Ransomware Campaign Against Internet-Exposed Synology NAS Devices (Unpatched / End-of-Life DSM; Disputed Entry Vector: CVE-2024-10441 vs CVE-2026-13639 / CVE-2026-13684)

Key facts for C3RB3R Synology NAS ransomware

Detection coverage for C3RB3R Synology NAS ransomware

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5044 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: C3RB3R .L0CK3D Encryption and read-me3.txt Ransom Note on Synology NAS Shares — Post-Exploitation Impact

Parses Synology Log Center file-service syslog (WinFileService Event) for files renamed or created with the .L0CK3D/.LOCK3D extension and the read-me3.txt ransom note ('C3RB3R INSTRUCTIONS') dropped by C3RB3R in every folder, grouped by NAS, user and client IP. Flags activity on backup-looking paths because C3RB3R also encrypts on-device backups (inhibiting recovery). This is the highest-fidelity indicator of active C3RB3R encryption (ChaCha8 per-file keys wrapped with RSA-2048) on DSM.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1486, T1083, T1490
• Data sources: Synology Log Center syslog (file service transfer log), linux file events
• Severity: critical
• Confidence: high

Splunk SPL

index=nas sourcetype=syslog "WinFileService Event" earliest=-4h
| eval file_path=replace(_raw, "^.*Path:\s*(.+?),\s*File/Folder:.*$", "\1"), fs_user=replace(_raw, "^.*User:\s*([^,]+),.*$", "\1"), client_ip=replace(_raw, "^.*IP:\s*(\S+).*$", "\1")
| where match(file_path, "(?i)\.l[o0]ck3d$") OR match(file_path, "(?i)/read-me3\.txt$")
```TL-2026-5044 C3RB3R renames files to .L0CK3D (digit zero) or .LOCK3D and drops read-me3.txt in every folder```
| eval backup_path=if(match(file_path, "(?i)(hyper ?backup|\.hbk|/backup|snapshot|\.sparsebundle)"), 1, 0)
| bin _time span=10m
| stats count AS events, dc(file_path) AS distinct_paths, count(eval(match(file_path, "(?i)read-me3\.txt$"))) AS ransom_notes, sum(backup_path) AS backup_hits, earliest(file_path) AS sample_path BY _time, host, fs_user, client_ip
| eval note="TL-2026-5044 C3RB3R ransomware artifacts (.L0CK3D / read-me3.txt) on Synology NAS share; backup_hits>0 means on-device backups touched (T1490)"
| table _time, host, fs_user, client_ip, events, distinct_paths, ransom_notes, backup_hits, sample_path, note

Microsoft KQL

Syslog
| where TimeGenerated > ago(4h)
| where SyslogMessage has "WinFileService Event"
| extend FilePath = extract(@"Path:\s*(.+?),\s*File/Folder", 1, SyslogMessage), FsUser = extract(@"User:\s*([^,]+),", 1, SyslogMessage), ClientIP = extract(@"IP:\s*(\S+)", 1, SyslogMessage)
| where FilePath matches regex @"(?i)\.l[o0]ck3d$" or FilePath matches regex @"(?i)/read-me3\.txt$"
| extend BackupPath = iff(FilePath matches regex @"(?i)(hyper ?backup|\.hbk|/backup|snapshot|\.sparsebundle)", 1, 0)
| summarize Events = count(), DistinctPaths = dcount(FilePath), RansomNotes = countif(FilePath matches regex @"(?i)read-me3\.txt$"), BackupHits = sum(BackupPath), SamplePath = take_any(FilePath) by Computer, FsUser, ClientIP, bin(TimeGenerated, 10m)
| project TimeGenerated, Computer, FsUser, ClientIP, Events, DistinctPaths, RansomNotes, BackupHits, SamplePath

Sigma

title: C3RB3R Ransomware File Artifacts on Linux/NAS Host (.L0CK3D, read-me3.txt)
id: 3b8e1a52-7c64-4f0d-9a1e-5044a0000003
status: experimental
description: Creation of files with the .L0CK3D or .LOCK3D extension or the read-me3.txt ransom note, the on-disk artifacts of the C3RB3R (Cerber variant) ransomware on Synology NAS.
references:
    - https://www.hkcert.org/security-bulletin/security-alert-ransomware-attacks-targeting-synology-nas-devices_20261102
    - https://www.synology.com/en-global/security/advisory/Synology_SA_24_20
    - https://noransom.net/en/ransomware/c3rb3r/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-02
tags:
    - attack.impact
    - attack.t1486
    - attack.t1490
    - attack.discovery
    - attack.t1083
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|endswith:
            - '.L0CK3D'
            - '.LOCK3D'
            - '/read-me3.txt'
    condition: selection
falsepositives:
    - Files legitimately named read-me3.txt by unrelated software
level: critical

Known false positives:

• Backup or archive tools legitimately creating a file called read-me3.txt
• Users naming personal files with a .lock3d suffix

Tuning notes: Enable Log Center file-transfer logging on every share and forward it to the SIEM; adjust the replace/extract expressions if your syslog template differs and the backup_path regex to your Hyper Backup/snapshot layout. Alert on any single read-me3.txt hit, then isolate the NAS and capture memory before shutdown (keys may be recoverable mid-encryption).

• 🔒 Internet-Exposed Synology DSM Management Port Access — C3RB3R Exposure · unlock with TL Creds
• 🔒 C3RB3R Ransomware Artifacts Written From Windows Endpoints to NAS Shares · unlock with TL Creds
• 🔒 C3RB3R Ransom Payment Portal (Tor/.onion) Access from Corporate Hosts · unlock with TL Creds
• 🔒 Synology DSM Web/SCGI Process Spawning Shell or Downloader — Exploitation · unlock with TL Creds
• 🔒 C3RB3R Windows Payload svcPrvinit.exe and Shadow Copy Deletion — Inhibit System Recovery · unlock with TL Creds
• 🔒 Network Share Discovery Before NAS Encryption — Lateral Movement Reconnaissance · unlock with TL Creds
• 🔒 C3RB3R Synology DSM WebAPI Login/Token Burst from External Source — Exploitation · unlock with TL Creds
• 🔒 C3RB3R-Linked and Community-Observed IP Communication — C2/Staging · unlock with TL Creds

Indicators of compromise for C3RB3R Synology NAS ransomware

As of 2026-11-03, Threadlinqs Intelligence tracks 20 indicators of compromise for TL-2026-5044.

Sample indicators (3 of 20)

• IP address: 193.176.179[.]41
• Domain: j3qxmk6g5sk3zw62i2yhjnwmhm55rfz47fdyfkhaithlpelfjdokdxad[.]onion
• URL: hxxps://github[.]com/Ntn10/cve-2024-10441-synology-rce

Defanged, TLP:CLEAR. Full set of 20 indicators: unlock with TL Creds.

How C3RB3R Synology NAS ransomware works

HKCERT (alert dated 2026-11-02, risk level High) warns of a wave of ransomware attacks on Synology Network-Attached Storage devices that encrypt stored data and demand a ransom. The HKCERT alert names no ransomware family, no CVE IDs and no attribution; it cites Synology's statement that threat actors are exploiting a vulnerability originally patched in December 2024 on end-of-life DiskStation Manager (DSM) versions. Separately, Synology released PHP security updates for PHP2Shell (CVE-2026-109618 / CVE-2026-109619, Synology-SA-26:14) affecting PHP-dependent packages (Calendar, IDrive, Joomla, KodExplorer, MailStation, MediaWiki, phpMyAdmin, vtigerCRM, Web Station, WordPress); the vendor has not confirmed that PHP2Shell is involved in these attacks, and secondary reporting says Synology explicitly rules it out.

Secondary reporting (360's anti-ransomware team, public warning 2026-10-29) identifies the ransomware as C3RB3R, a variant of the Cerber family. 360 says the campaign began about 2026-10-01 and abuses two unauthenticated remote DSM flaws, CVE-2026-13639 (insufficient entropy in login logic, CWE-331) and CVE-2026-13684 (improper output encoding in SCGI, CWE-116), both rated CVSS 9.8 and patched by Synology on 2026-09-18, describing it as a '1day' campaign against internet-exposed devices, with many victims in China. Synology's own warning instead points to CVE-2024-10441 (CVSS 9.8, unauthenticated RCE in the DSM system plugin daemon, found by DEVCORE at Pwn2Own 2024, patched in SA-24:20 on 2024-12-05) on end-of-life DSM. One secondary source reports a public PoC on GitHub on 2026-10-25. The entry-vector dispute is unresolved in the available sources; defenders should treat all three CVEs as relevant and patch/retire exposed DSM.

Malware behavior per secondary sources: files are encrypted with ChaCha8 using a per-file 256-bit key and 64-bit nonce, with keys wrapped by an embedded RSA-2048 public key; encrypted files are renamed with the .L0CK3D extension; 27 system directories are skipped to keep the device functional, files matching a built-in extension list (187 types per one source) are fully encrypted and other files partially encrypted for speed; on-device backups are encrypted as well. A read-me3.txt note ('C3RB3R INSTRUCTIONS') with a six-digit device ID is left in each folder, directing victims to a Tor payment page that offers one free test decryption up to 1024 KB and claims data was exfiltrated (the exfiltration claim is not independently verified). One source reports an initial demand of 0.036960 BTC (~USD 2,952) doubling after five days. No public decryptor exists; one source says memory dumping while encryption is still running recovered keys for a victim. Windows-side artifacts (svcPrvinit.exe, mutex, wmic shadow copy deletion) and the three IPs listed are from a 2023 C3RB3R wave documented by a recovery-service site, not the 2026 Synology wave; they are included for hunting context only. Several secondary details (ransom amount, 187 extensions, PoC date, exfiltration claim) come from single sources and were not corroborated by Synology or HKCERT.

MITRE ATT&CK techniques by tactic:

Execution

T1059 Command and Scripting Interpreter

Defense Evasion

T1070.004 Indicator Removal: File Deletion

Discovery

T1083 File and Directory Discovery; T1135 Network Share Discovery

Initial Access

T1133 External Remote Services; T1190 Exploit Public-Facing Application

Impact

T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery; T1657 Financial Theft

Privilege Escalation

T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking

Remediation for C3RB3R Synology NAS ransomware

Patches

• Synology-SA-24:20 (CVE-2024-10441): DSM 7.2.2 72806-1 or later, 7.2.1 69057-6 or later, 7.1 42962-7 or later, 6.2 25556-8 or later
• 360-cited CVE-2026-13639 / CVE-2026-13684 (patched 2026-09-18, SA-26:13 per one source): DSM 7.4 build 90075 or later, 7.3.2-86009-4, 7.2.2-72806-9, 7.2.1-69057-12 (per secondary sources)
• Synology-SA-26:14 PHP2Shell: PHP update via Package Center

Immediate actions

• Update DSM to the latest supported build immediately (HKCERT/Synology)
• Install PHP security updates via Package Center on DSM 7.4, 7.3, 7.2, 7.1, 7.0 and 6.2; for DSM earlier than 6.2 disable the affected PHP-dependent packages
• Reduce network exposure: disable unnecessary services and remote access, do not expose DSM management to the internet
• Isolate suspected infected devices, preserve evidence (ransom notes, logs, encrypted samples) and contact incident response
• Hunt for *.L0CK3D / *.LOCK3D files and read-me3.txt notes and for unusual DSM login activity or mass file modification in system logs

Workarounds

• SA-24:20 lists no mitigation other than patching
• If a device is mid-encryption, secondary reporting suggests capturing memory before shutdown to try to recover keys

Longer-term hardening

• Maintain offline/immutable backups and regularly test restoration; on-device backups can be encrypted
• Replace NAS hardware/software that is end-of-life and no longer receives DSM security updates
• Do not pay the ransom; restore only from verified clean backups

Affected and fixed versions

• Synology — DiskStation Manager (DSM)
  Vulnerable versions: End-of-life DSM versions; DSM 7.2.2 before 72806-1 (CVE-2024-10441); DSM 7.2.1 before 69057-6; DSM 7.1 before 42962-7; DSM 6.2 before 25556-8; DSM 7.4 before 90075 / 7.3.2 before 86009-4 / 7.2.2 before 72806-9 / 7.2.1 before 69057-12 (360-cited CVEs, per secondary sources)
  Fixed in: Latest supported DSM build; DSM 7.2.2 72806-1+; DSM 7.2.1 69057-6+; DSM 7.1 42962-7+; DSM 6.2 25556-8+
• Synology — PHP-dependent packages (Calendar, IDrive, Joomla, KodExplorer, MailStation, MediaWiki, phpMyAdmin, vtigerCRM, Web Station, WordPress) - PHP2Shell CVE-2026-109618 / CVE-2026-109619; not confirmed as exploited in the ransomware attacks
  Vulnerable versions: DSM 7.4, 7.3, 7.2, 7.1, 7.0, 6.2 with unpatched PHP
  Fixed in: PHP security update via Package Center

Timeline of C3RB3R Synology NAS ransomware

Last updated 2026-11-03 · 2 updates · revalidated 2× · latest source

• 2024-11-05 Synology publishes Synology-SA-24:20 covering CVE-2024-10441, CVE-2024-50629 and CVE-2024-10445 (Pwn2Own 2024).
• 2024-12-05 Synology publishes SA-24:20 patching CVE-2024-10441 (CVSS 9.8, unauthenticated RCE in the DSM system plugin daemon, found at Pwn2Own 2024); fixes rolled out between November 2024 and March 2025.
• 2025-03-19 NVD publishes CVE-2024-10441, CVE-2024-50629 and CVE-2024-10445.
• 2026-09-18 Synology patches CVE-2026-13639 and CVE-2026-13684 (both CVSS 9.8) in DSM; 360 later identifies these as the entry vector of the locked-ioc-20 campaign.
• 2026-10-01 locked-ioc-20 ransomware attacks on internet-exposed Synology NAS devices begin (campaign start per pwn.watch; other sources say 'early October').
• 2026-10-17 First PHP2Shell exploitation attempts observed, four days before patches (separate issue, not confirmed as involved in the ransomware attacks).
• 2026-10-21 PHP2Shell (CVE-2026-109618 / CVE-2026-109619) disclosed; Synology later ships PHP updates for DSM 7.4, 7.3, 7.2, 7.1, 7.0 and 6.2 (SA-26:14).
• 2026-10-25 A public proof-of-concept is reported on GitHub (single secondary source, unverified).
• 2026-10-29 360's anti-ransomware team publicly reports repeated locked-ioc-20 attacks on Synology NAS; Synology warns that threat actors are exploiting a vulnerability patched in December 2024 on end-of-life DSM.
• 2026-10-30 Zero-day speculation emerges after a victim is reportedly running DSM 7.4.1; Korea's KISA reportedly receives victim reports without disclosing damage scale (secondary reporting, unconfirmed).
• 2026-11-02 BleepingComputer reports Synology's warning on ongoing locked-ioc-20 ransomware attacks and lists CVE-2024-10441, CVE-2024-50629 and CVE-2024-10445.
• 2026-11-02 HKCERT issues a High-risk security alert on ransomware attacks targeting Synology NAS devices.
• 2026-11-03 Security Affairs reports Synology's warning about ransomware attacks on outdated DSM versions, citing Synology-SA-24:20.

Update history

• 2026-11-03 — locked-ioc-20 (Cerber-family) Ransomware Attacks Targeting Outdated Synology DSM NAS Devices (CVE-2024-10441, CVE-2024-50629, CVE-2024-10445): What changed No field escalation. Severity, exploitability, status, CVSS and attribution already reflect the evidence in the existing record (ACTIVE, CVSS 9.8, unattributed); the newer report's CRITICAL rating is an assertion, not new evide
• 2026-11-02 — locked-ioc-20 (.L0CK3D) ransomware actively exploiting outdated Synology DSM (CVE-2024-10441, CVE-2024-50629, CVE-2024-10445): What changed No severity, exploitability, status or CVSS change (HIGH / ACTIVE / ACTIVE, 9.8 already recorded). Additive enrichment only. New indicators (3) Indicator values are withheld at this access level. New CVEs (2) CVE-2024-50629 (un

Sources cited for C3RB3R Synology NAS ransomware

• HKCERT Security Alert: Ransomware Attacks Targeting Synology NAS Devices hkcert.org · Advisory · 2026-11-02
• Synology Statement on PHP2Shell Vulnerabilities (incl. ransomware note, Synology-SA-26:14) synology.com · Vendor report
• Synology Security Advisory Synology-SA-24:20 (CVE-2024-10441) synology.com · Vendor report · 2024-12-05
• C3RB3R (Cerber) ransomware hits Synology NAS devices through DSM flaws CVE-2026-13639 and CVE-2026-13684 - pwn.watch pwn.watch · Research
• LOCK3D / L0CK3D Ransomware (C3RB3R) Response & Recovery - noransom.net noransom.net · Research
• Synology C3RB3R ransomware: CVE-2026-13639, CVE-2026-13684 - Adyog Pulse pulse.adyog.com · Blog
• PHP2Shell: Synology, QNAP, and NetApp ONTAP Status - RackTop Systems racktopsystems.com · Blog · 2026-10-21
• Synology LOCK3D / C3RB3R Ransomware Attack - NAS Compares nascompares.com · News · 2026-10-30
• Synology NAS Ransomware Alert: C3RB3R Locks Files W/ .L0CK3D - Techaeris techaeris.com · News · 2026-10-31
• CVE-2026-13639: C3RB3R Ransomware Hits Synology NAS, Update DSM - CyberExperts cyberexperts.com · News · 2026-10-30
• Tech whiz's internet-accessible Synology NAS gets bit by ransomware attack from 18-month-old RCE flaw - Tom's Hardware tomshardware.com · News

More in ransomware

• Falcon Extortion Brand (UNC6671) Claims Buchanan Ingersoll & Rooney PC (US Law Firm) – ~260 GB Data Leak
• Whitearmor (emerging ransomware group) 'Project Trojan Horse' - initial access sales and insider recruitment
• HHS OCR Settles Ransomware Investigation of Lehigh Valley Health Network (ALPHV/BlackCat)
• 3AM (ThreeAM) Ransomware Hybrid Human/AI-Assisted Attack on UK School Estate
• NCSC Warns of AI-Enabled Ransomware Threat to UK Critical National Infrastructure by 2028 (PHP2Shell CVE-2026-109618/109619 cited)