# C3RB3R (Cerber-variant) Ransomware Campaign Against Internet-Exposed Synology NAS Devices (Unpatched / End-of-Life DSM; Disputed Entry Vector: CVE-2024-10441 vs CVE-2026-13639 / CVE-2026-13684)

> Since roughly early October 2026, ransomware identified by 360 as C3RB3R (a Cerber variant) has been encrypting Synology NAS devices, appending the .L0CK3D extension and dropping read-me3.txt ransom notes. Synology states threat actors are exploiting CVE-2024-10441 (patched December 2024, SA-24:20) against end-of-life DSM, while 360 attributes it to CVE-2026-13639 and CVE-2026-13684 (patched 2026-09-18); the separate PHP2Shell PHP flaws are not confirmed as involved.

- **Published:** 2026-11-02T10:15:46Z
- **Last reviewed:** 2026-11-03T17:59:15.095Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5044
- **ID:** TL-2026-5044
- **Severity:** HIGH (CVSS 9.8)
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 20 (3 shown free below)
- **CVEs:** CVE-2024-10441, CVE-2026-13639, CVE-2026-13684, CVE-2024-50629, CVE-2024-10445

## Description

HKCERT (alert dated 2026-11-02, risk level High) warns of a wave of ransomware attacks on Synology Network-Attached Storage devices that encrypt stored data and demand a ransom. The HKCERT alert names no ransomware family, no CVE IDs and no attribution; it cites Synology's statement that threat actors are exploiting a vulnerability originally patched in December 2024 on end-of-life DiskStation Manager (DSM) versions. Separately, Synology released PHP security updates for PHP2Shell (CVE-2026-109618 / CVE-2026-109619, Synology-SA-26:14) affecting PHP-dependent packages (Calendar, IDrive, Joomla, KodExplorer, MailStation, MediaWiki, phpMyAdmin, vtigerCRM, Web Station, WordPress); the vendor has not confirmed that PHP2Shell is involved in these attacks, and secondary reporting says Synology explicitly rules it out.

Secondary reporting (360's anti-ransomware team, public warning 2026-10-29) identifies the ransomware as C3RB3R, a variant of the Cerber family. 360 says the campaign began about 2026-10-01 and abuses two unauthenticated remote DSM flaws, CVE-2026-13639 (insufficient entropy in login logic, CWE-331) and CVE-2026-13684 (improper output encoding in SCGI, CWE-116), both rated CVSS 9.8 and patched by Synology on 2026-09-18, describing it as a '1day' campaign against internet-exposed devices, with many victims in China. Synology's own warning instead points to CVE-2024-10441 (CVSS 9.8, unauthenticated RCE in the DSM system plugin daemon, found by DEVCORE at Pwn2Own 2024, patched in SA-24:20 on 2024-12-05) on end-of-life DSM. One secondary source reports a public PoC on GitHub on 2026-10-25. The entry-vector dispute is unresolved in the available sources; defenders should treat all three CVEs as relevant and patch/retire exposed DSM.

Malware behavior per secondary sources: files are encrypted with ChaCha8 using a per-file 256-bit key and 64-bit nonce, with keys wrapped by an embedded RSA-2048 public key; encrypted files are renamed with the .L0CK3D extension; 27 system directories are skipped to keep the device functional, files matching a built-in extension list (187 types per one source) are fully encrypted and other files partially encrypted for speed; on-device backups are encrypted as well. A read-me3.txt note ('C3RB3R INSTRUCTIONS') with a six-digit device ID is left in each folder, directing victims to a Tor payment page that offers one free test decryption up to 1024 KB and claims data was exfiltrated (the exfiltration claim is not independently verified). One source reports an initial demand of 0.036960 BTC (~USD 2,952) doubling after five days. No public decryptor exists; one source says memory dumping while encryption is still running recovered keys for a victim. Windows-side artifacts (svcPrvinit.exe, mutex, wmic shadow copy deletion) and the three IPs listed are from a 2023 C3RB3R wave documented by a recovery-service site, not the 2026 Synology wave; they are included for hunting context only. Several secondary details (ransom amount, 187 extensions, PoC date, exfiltration claim) come from single sources and were not corroborated by Synology or HKCERT.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1135 Network Share Discovery
- T1070.004 Indicator Removal: File Deletion
- T1490 Inhibit System Recovery
- T1657 Financial Theft
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1083 File and Directory Discovery
- T1486 Data Encrypted for Impact
- T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**C3RB3R .L0CK3D Encryption and read-me3.txt Ransom Note on Synology NAS Shares — Post-Exploitation Impact** (`TL-2026-5044-SPL-002`)

Parses Synology Log Center file-service syslog (WinFileService Event) for files renamed or created with the .L0CK3D/.LOCK3D extension and the read-me3.txt ransom note ('C3RB3R INSTRUCTIONS') dropped by C3RB3R in every folder, grouped by NAS, user and client IP. Flags activity on backup-looking paths because C3RB3R also encrypts on-device backups (inhibiting recovery). This is the highest-fidelity indicator of active C3RB3R encryption (ChaCha8 per-file keys wrapped with RSA-2048) on DSM.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1486, T1083, T1490
- **Data sources:** Synology Log Center syslog (file service transfer log), linux file events
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

````spl
index=nas sourcetype=syslog "WinFileService Event" earliest=-4h
| eval file_path=replace(_raw, "^.*Path:\s*(.+?),\s*File/Folder:.*$", "\1"), fs_user=replace(_raw, "^.*User:\s*([^,]+),.*$", "\1"), client_ip=replace(_raw, "^.*IP:\s*(\S+).*$", "\1")
| where match(file_path, "(?i)\.l[o0]ck3d$") OR match(file_path, "(?i)/read-me3\.txt$")
```TL-2026-5044 C3RB3R renames files to .L0CK3D (digit zero) or .LOCK3D and drops read-me3.txt in every folder```
| eval backup_path=if(match(file_path, "(?i)(hyper ?backup|\.hbk|/backup|snapshot|\.sparsebundle)"), 1, 0)
| bin _time span=10m
| stats count AS events, dc(file_path) AS distinct_paths, count(eval(match(file_path, "(?i)read-me3\.txt$"))) AS ransom_notes, sum(backup_path) AS backup_hits, earliest(file_path) AS sample_path BY _time, host, fs_user, client_ip
| eval note="TL-2026-5044 C3RB3R ransomware artifacts (.L0CK3D / read-me3.txt) on Synology NAS share; backup_hits>0 means on-device backups touched (T1490)"
| table _time, host, fs_user, client_ip, events, distinct_paths, ransom_notes, backup_hits, sample_path, note
````

### Microsoft KQL

```kql
Syslog
| where TimeGenerated > ago(4h)
| where SyslogMessage has "WinFileService Event"
| extend FilePath = extract(@"Path:\s*(.+?),\s*File/Folder", 1, SyslogMessage), FsUser = extract(@"User:\s*([^,]+),", 1, SyslogMessage), ClientIP = extract(@"IP:\s*(\S+)", 1, SyslogMessage)
| where FilePath matches regex @"(?i)\.l[o0]ck3d$" or FilePath matches regex @"(?i)/read-me3\.txt$"
| extend BackupPath = iff(FilePath matches regex @"(?i)(hyper ?backup|\.hbk|/backup|snapshot|\.sparsebundle)", 1, 0)
| summarize Events = count(), DistinctPaths = dcount(FilePath), RansomNotes = countif(FilePath matches regex @"(?i)read-me3\.txt$"), BackupHits = sum(BackupPath), SamplePath = take_any(FilePath) by Computer, FsUser, ClientIP, bin(TimeGenerated, 10m)
| project TimeGenerated, Computer, FsUser, ClientIP, Events, DistinctPaths, RansomNotes, BackupHits, SamplePath
```

### Sigma

```yaml
title: C3RB3R Ransomware File Artifacts on Linux/NAS Host (.L0CK3D, read-me3.txt)
id: 3b8e1a52-7c64-4f0d-9a1e-5044a0000003
status: experimental
description: Creation of files with the .L0CK3D or .LOCK3D extension or the read-me3.txt ransom note, the on-disk artifacts of the C3RB3R (Cerber variant) ransomware on Synology NAS.
references:
    - https://www.hkcert.org/security-bulletin/security-alert-ransomware-attacks-targeting-synology-nas-devices_20261102
    - https://www.synology.com/en-global/security/advisory/Synology_SA_24_20
    - https://noransom.net/en/ransomware/c3rb3r/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-02
tags:
    - attack.impact
    - attack.t1486
    - attack.t1490
    - attack.discovery
    - attack.t1083
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|endswith:
            - '.L0CK3D'
            - '.LOCK3D'
            - '/read-me3.txt'
    condition: selection
falsepositives:
    - Files legitimately named read-me3.txt by unrelated software
level: critical

```

**Known false positives:**

- Backup or archive tools legitimately creating a file called read-me3.txt
- Users naming personal files with a .lock3d suffix

**Tuning notes:** Enable Log Center file-transfer logging on every share and forward it to the SIEM; adjust the replace/extract expressions if your syslog template differs and the backup_path regex to your Hyper Backup/snapshot layout. Alert on any single read-me3.txt hit, then isolate the NAS and capture memory before shutdown (keys may be recoverable mid-encryption).

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Internet-Exposed Synology DSM Management Port Access — C3RB3R Exposure (locked: unlock with TL Creds)
- C3RB3R Ransomware Artifacts Written From Windows Endpoints to NAS Shares (locked: unlock with TL Creds)
- C3RB3R Ransom Payment Portal (Tor/.onion) Access from Corporate Hosts (locked: unlock with TL Creds)
- Synology DSM Web/SCGI Process Spawning Shell or Downloader — Exploitation (locked: unlock with TL Creds)
- C3RB3R Windows Payload svcPrvinit.exe and Shadow Copy Deletion — Inhibit System Recovery (locked: unlock with TL Creds)
- Network Share Discovery Before NAS Encryption — Lateral Movement Reconnaissance (locked: unlock with TL Creds)
- C3RB3R Synology DSM WebAPI Login/Token Burst from External Source — Exploitation (locked: unlock with TL Creds)
- C3RB3R-Linked and Community-Observed IP Communication — C2/Staging (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 20)

Defanged, TLP:CLEAR.

- IP address: `193.176.179[.]41`
- Domain: `j3qxmk6g5sk3zw62i2yhjnwmhm55rfz47fdyfkhaithlpelfjdokdxad[.]onion`
- URL: `hxxps://github[.]com/Ntn10/cve-2024-10441-synology-rce`

Full set of 20 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [HKCERT Security Alert: Ransomware Attacks Targeting Synology NAS Devices](https://www.hkcert.org/security-bulletin/security-alert-ransomware-attacks-targeting-synology-nas-devices_20261102)
- [Synology Statement on PHP2Shell Vulnerabilities (incl. ransomware note, Synology-SA-26:14)](https://www.synology.com/en-global/company/news/article/php2shell)
- [Synology Security Advisory Synology-SA-24:20 (CVE-2024-10441)](https://www.synology.com/en-global/security/advisory/Synology_SA_24_20)
- [Synology LOCK3D / C3RB3R Ransomware Attack - NAS Compares](https://nascompares.com/2026/10/30/synology-lock3d-c3rb3r-ransomware-attack-everything-you-need-to-know/)
- [Synology NAS Ransomware Alert: C3RB3R Locks Files W/ .L0CK3D - Techaeris](https://techaeris.com/2026/10/31/synology-nas-ransomware-alert-c3rb3r/)
- [C3RB3R (Cerber) ransomware hits Synology NAS devices through DSM flaws CVE-2026-13639 and CVE-2026-13684 - pwn.watch](https://pwn.watch/i/synology-dsm-cerber-c3rb3r-ransomware-cve-2026-13639-13684)
- [CVE-2026-13639: C3RB3R Ransomware Hits Synology NAS, Update DSM - CyberExperts](https://cyberexperts.com/2026-10-30-synology-dsm-c3rb3r-ransomware/)
- [LOCK3D / L0CK3D Ransomware (C3RB3R) Response & Recovery - noransom.net](https://noransom.net/en/ransomware/c3rb3r/)
- [Synology C3RB3R ransomware: CVE-2026-13639, CVE-2026-13684 - Adyog Pulse](https://pulse.adyog.com/insights/synology-c3rb3r-ransomware-unpatched-dsm)
- [PHP2Shell: Synology, QNAP, and NetApp ONTAP Status - RackTop Systems](https://www.racktopsystems.com/data-defense-center/php2shell-php-vulnerability-synology-qnap-nas)
- [Tech whiz's internet-accessible Synology NAS gets bit by ransomware attack from 18-month-old RCE flaw - Tom's Hardware](https://www.tomshardware.com/tech-industry/cyber-security/tech-whizzs-internet-accessible-synology-nas-gets-bit-by-ransomware-attack-from-18-month-old-remote-code-execution-flaw-security-updates-neglected-in-a-series-of-catastrophic-errors)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5044