CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

C3RB3R ransomware

malware · malware:c3rb3r-ransomware contradicted

Ransomware named after the 2016 Cerber operation (360 calls it a Cerber variant) encrypting Synology DiskStation NAS on outdated DSM since October 2026, renaming files to .L0CK3D and leaving a read-me3.txt note in every encrypted directory (360 anti-ransomware service, 2026-10-29); Synology confirmed on 2026-10-29 that threat actors exploit a flaw patched in December 2024 to encrypt and extort, naming no CVE, while 360 names CVE-2026-13639 and CVE-2026-13684.

Aliases: CerberImposter

Coverage
1
first 2026-09-22 → last 2026-11-03
Latest activity
2026-11-03
C3RB3R ransomware encrypts Synology NAS; Synology confirms exploitation, 360 names the September 9.8 pair
Peak priority
high
1 high
Targets
public-sector
sectors: public-sector
Sources cited
8
6 hosts

Action items (2)

Do-now tasks recorded on the entries about C3RB3R ransomware, newest first. Check the date before acting on an older one.

  • Update every Synology DSM to the fixed build of its branch now (7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 or 7.2.1-69057-12, and 7.2-64570-4, 7.1.1-42962-7 or 6.2.4-25556-8 on the branches for which SA-26:13 names no fix), taking the management interface of any NAS that is reachable from the internet offline first, because Synology confirms ransomware is exploiting outdated DSM and lists no mitigation for the September flaws.
    2026-09-22CVE-2026-13684 +4
  • On every NAS that was reachable from the internet on an older build, look in its shares for files renamed to .L0CK3D and for read-me3.txt notes, and isolate any hit.
    2026-09-22CVE-2026-13684 +4

Defender insights

What each entry about C3RB3R ransomware tells a defender to do, newest first.

2026-09-22HIGHexploitedC3RB3R ransomware encrypts Synology NAS; Synology confirms exploitation, 360 names the September 9.8 pair

Exposure · detection

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

affects

Story timeline

  1. 2026-09-22CVE-2026-13684 / CVE-2026-13639, Synology DSM: two unauthenticated CVSS 9.8 flaws (SCGI output-encoding bug, login-logic entropy weakness) allow remote arbitrary file read/write and denial-of-service with no credentials; C3RB3R ransomware is now encrypting NAS on outdated DSM
    trending-vulnerabilitiesC3RB3R ransomware encrypts Synology NAS; Synology confirms exploitation, 360 names the September 9.8 pair

Hunting pivots

CVEs
CVE-2024-10441CVE-2026-13639CVE-2026-13673CVE-2026-13684CVE-2026-6205
Affected products
Synology DiskStation Manager (DSM)
Tags
actively-exploitedpatch-availablepath-traversalpre-authransomwarevulnerabilities
ATT&CK techniques (4 across 4 tactics)

4 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • DiscoveryFile and Directory Discovery
  • CollectionData from Local System
  • ImpactData Encrypted for Impact

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-09-22/cve-2026-13684-synology-dsm-unauth-file-read-write · ATT&CK page ↗

Discovery TA0007

T1083File and Directory Discovery×1

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Evidence: 2026-09-22/cve-2026-13684-synology-dsm-unauth-file-read-write · ATT&CK page ↗

Collection TA0009

T1005Data from Local System×1

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

Evidence: 2026-09-22/cve-2026-13684-synology-dsm-unauth-file-read-write · ATT&CK page ↗

Impact TA0040

T1486Data Encrypted for Impact×1

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.

Evidence: 2026-09-22/cve-2026-13684-synology-dsm-unauth-file-read-write · ATT&CK page ↗

Entries about C3RB3R ransomware (1)

2026-09-22 · view entry permalink →

HIGHCVE-2026-13684 +4exploitedupdatedNATOA3

CVE-2026-13684 / CVE-2026-13639, Synology DSM: two unauthenticated CVSS 9.8 flaws (SCGI output-encoding bug, login-logic entropy weakness) allow remote arbitrary file read/write and denial-of-service with no credentials; C3RB3R ransomware is now encrypting NAS on outdated DSM

Synology disclosed eight CVEs in DiskStation Manager (DSM) on 2026-09-18 (Synology-SA-26:13). Two are unauthenticated and rated CVSS 9.8, CVE-2026-13684 (improper output encoding in the SCGI component) and CVE-2026-13639 (insufficient entropy in the login logic), and each lets a remote attacker with no credentials read or write arbitrary files and cause denial-of-service. Two more need only a low-privileged session: CVE-2026-13673 (8.8, LDAP API) and CVE-2026-6205 (8.1, Upload API). All four are fixed in DSM 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 and 7.2.1-69057-12, and Synology lists no mitigation for the unauthenticated pair (Synology PSIRT, 2026-09-18).

NCSC Switzerland recorded exploitation status as unknown on 2026-09-21 (NCSC Switzerland, 2026-09-21), and CERT-FR relayed the advisory the same day without commenting on exploitation (CERT-FR, 2026-09-21). heise online expected the terse advisory to draw ransomware authors and other criminals quickly, since Synology describes exploitation as very easy (translated from German) (heise online, 2026-09-18).

Synology said on 2026-10-29 that threat actors are exploiting a vulnerability patched in December 2024 against outdated DSM to encrypt data and extort ransom, naming no CVE and pointing to Synology-SA-24:20 (Synology, 2026-10-29), whose lead flaw, CVE-2024-10441, allows remote code execution without credentials (CVSS 9.8) (Synology PSIRT, 2024-11-05). The same day 360 identified the ransomware as C3RB3R, a Cerber variant, and named CVE-2026-13639 and CVE-2026-13684 as its entry point (translated from Chinese) (360, 2026-10-29). The accounts conflict and no source reconciles them. BleepingComputer says the name is borrowed from the 2016 Cerber ransomware-as-a-service operation and reports Shadowserver tracking over 380,000 internet-exposed Synology NAS (BleepingComputer, 2026-11-02).

An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.

Synology PSIRT 2026-09-18

Successful exploitation allows unauthenticated attackers to read and write arbitrary files, or disrupt NAS services via denial-of-service attacks.

NCSC Switzerland (Cyber Security Hub) 2026-09-21

The terse description of the flaws on Synology's advisory page is likely to quickly draw ransomware authors and other criminals, since exploitation is, according to Synology, very easy.

heise online (translated from German)

Synology has identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM. These attacks aim to encrypt data and extort ransom.

Synology 2026-10-29

The entry point of this round of attacks is two high-risk remote vulnerabilities, with CVE numbers CVE-2026-13639 and CVE-2026-13684 (translated from Chinese)

360 anti-ransomware service 2026-10-29

While Synology has yet to share which vulnerability is being exploited in these ongoing attacks

BleepingComputer 2026-11-02
Updaterun 2026-11-03T0256Z-inteltitleheadlinesummarytagsentitiestechniquescvessourcesevidenceverificationsourcing_noteconfidenceclassificationactionsbody

Synology says threat actors are exploiting a vulnerability patched in December 2024 against devices on outdated DSM, in attacks that encrypt data and extort ransom, and points to Synology-SA-24:20 without naming a CVE (Synology, 2026-10-29). 360 identified the ransomware as C3RB3R, a Cerber variant, and named the two September flaws, CVE-2026-13639 and CVE-2026-13684, as the entry point (translated from Chinese) (360, 2026-10-29); BleepingComputer notes that Synology has not said which vulnerability is exploited (BleepingComputer, 2026-11-02). The exploited flaw is unresolved between the two advisories.

vulnerability22 Sep 04:33ZcontradictedOpen finding →
Sources: Synology PSIRT · NCSC Switzerland (Cyber Security Hub) · CERT-FR (ANSSI) · heise online · Synology · Synology PSIRT (Synology-SA-24:20) · 360 anti-ransomware service · BleepingComputer

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • synology.com3 (38%)
  • 360.cn1 (12%)
  • bleepingcomputer.com1 (12%)
  • cert.ssi.gouv.fr1 (12%)
  • heise.de1 (12%)
  • security-hub.ncsc.admin.ch1 (12%)
All cited sources (8)