Changed since version 1

• Sources renumbered: The Hacker News is now S1 and BleepingComputer is now S2; all prior [S1] citations now read [S2].
• Added that customers report C3RB3R infections [S1].
• Added that read-me3.txt is dropped in each encrypted directory; Verify, the hunt's hit_means and Enumerate updated to match [S1].
• Added Qihoo 360's link to CVE-2026-13684 and CVE-2026-13639, with open questions and a re-entry trigger [S1].
• Fixed_in and not_affected_if now note that fixes for the 2026 CVEs are not given [S1][S2].
• Title changed to reflect the Qihoo 360 attribution [S1].
• Debrief gap widened to cover the 2026 CVE identifier inconsistency [S1].

What happened

• Synology warned that threat actors are exploiting a DSM vulnerability patched in December 2024 against devices running outdated DSM versions, aiming to encrypt data and extort ransom [S1][S2].
• Synology has not named the exploited flaw. Reporting links its November 2024 advisory covering CVE-2024-10441, CVE-2024-50629 and CVE-2024-10445 [S2].
• Customers report infections by C3RB3R ransomware [S1].
• Encrypted files get a .L0CK3D extension, and a ransom note named read-me3.txt is dropped in each encrypted directory [S1].
• Qihoo 360 links C3RB3R to exploitation of two DSM flaws, CVE-2026-13684 and CVE-2026-13639 [S1].
• Neither source gives a confirmed count of compromised devices [S1][S2].

Timeline

Detect

C3RB3R ransom note or encrypted file extension · NAS file system / DSM file activity

index=* (file_path="*read-me3.txt" OR file_path="*.L0CK3D") | stats count min(_time) as first_seen max(_time) as last_seen dc(file_path) as distinct_files values(user) as user by host | sort - count

A hit means: A file matching the reported C3RB3R ransom note or encrypted-file extension was written. A note is dropped in each encrypted directory [S1], so many read-me3.txt files alongside many .L0CK3D files on one host means encryption is in progress or complete.

Verify

• Open a read-me3.txt hit and confirm it is a ransom demand, not an unrelated file with the same name.
• Check that read-me3.txt sits in a directory with .L0CK3D files, as the note is dropped in each encrypted directory [S1].
• Check that .L0CK3D files cannot be opened and that the originals are missing or renamed.
• Correlate the host with a Synology DSM device and check its DSM version against the fixed builds.
• Benign look-alikes: a user file that happens to be named read-me3.txt, or backup and archive tools using a similar extension. Neither produces bulk renames across directories.

Scope

Affected

• Synology DSM running outdated versions; the exploited flaw was patched in December 2024 [S1][S2]
• Versions in the November 2024 advisory: DSM 7.2.2 before 7.2.2-72806-1, 7.2.1 before 7.2.1-69057-6, 7.2 before 7.2-64570-4, 7.1 before 7.1.1-42962-7, 6.2 before 6.2.4-25556-8 [S2]

Only if

• Management web interface reachable from the internet [S2]

Not affected if

• Running the fixed DSM builds listed by Synology, if the exploited flaw is among those the November 2024 advisory fixed [S2]

Fixed in: DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7, 6.2.4-25556-8 [S2]. Fixed builds for CVE-2026-13684 and CVE-2026-13639 are not given in the sources.

Enumerate

• Every Synology NAS, including shadow IT, branch and lab units, with DSM version and build.
• Which DSM management interfaces are reachable from the internet, including via port forwarding, QuickConnect or reverse proxies.
• Local and domain accounts with DSM admin rights on each device.
• Shares and systems that back up to or mount affected NAS volumes.
• Directories containing read-me3.txt, to map which data was encrypted [S1].

Contain

• Remove internet exposure of DSM management interfaces now. This is reversible.
• Capture DSM logs, connection logs and a copy of the ransom note before making changes.
• Isolate any NAS with .L0CK3D files or read-me3.txt from the network, and keep it powered on to preserve evidence.
• Disconnect affected NAS from hosts that mount its shares so encryption cannot reach mapped volumes.
• Do not wipe, reset or reinitialise a device before evidence is captured. A reset cannot be undone and destroys forensic data.

Eradicate

• Update DSM to a fixed build [S2].
• The sources describe no persistence mechanism. Treat a compromised device as untrusted and review admin accounts and scheduled tasks before reuse.

Recover

• Restore from backups that are verified to predate encryption and are stored off the affected device.
• Before reconnecting, confirm the DSM build is fixed and the management interface is not reachable from the internet.
• After restore, monitor for new .L0CK3D files or read-me3.txt notes.

Re-enter the loop when

• Synology names the exploited flaw or publishes fixed builds that differ from the November 2024 list.
• Synology or a CERT confirms CVE-2026-13684 or CVE-2026-13639, or publishes IoCs.
• Any CVE in this story is added to CISA KEV.
• A new ransom note name, file extension or affected product is reported.
• A public PoC or exploit details emerge that change the access conditions.

Debrief

• Record the DSM inventory, versions and exposure at the time of the warning, and the time taken to patch each device.
• Record how any exposed interface became reachable from the internet.
• Gap: Synology has not named the exploited flaw.
• Gap: no initial-access IoCs, network indicators or compromise counts in the sources.
• Gap: a December 2024 patch date sits against a November 2024 advisory and against 2026-numbered CVEs from Qihoo 360.

Detection coverage — checked automatically

Checked automatically 2026-11-10 15:11Z from public sources: 11 published, 34 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

Where each CVE comes from: CVE-2024-10441 — C3RB3R ransomware attacks target Synology DSM devices running outdated versions; vendor warns, no confirmed success coun; CVE-2024-10445 — C3RB3R ransomware attacks target Synology DSM devices running outdated versions; vendor warns, no confirmed success coun; CVE-2024-50629 — C3RB3R ransomware attacks target Synology DSM devices running outdated versions; vendor warns, no confirmed success coun. A product row answers "is the software from that story reachable from the internet", not "is this card about that software".

vuln:CVE-2024-10441

vuln:CVE-2024-50629

vuln:CVE-2024-10445

host.services: (software.product = "Synology DSM")

http.component:"Synology DiskStation"

http.title:"Synology DiskStation"

http.title:"DiskStation Manager"

http.html:"Synology DiskStation"

ssl:"Synology Inc."

Internet-wide count, trend

Shodan's count of matching services on the whole internet, one point a day; the scope (your ranges) is never part of it. A count moves with Shodan's crawl as much as with patching, so read the direction, not the digit.

NVD has not published CPE configurations for these CVEs yet, so only the CVE query is exact; the product queries use the name the campaign gives (Synology DSM) and are replaced by NVD's spelling at the daily re-check once it names the software.

Also tried under the name the card uses, nothing matched on Shodan: product:"Synology DSM", http.component:"Synology DSM".

Banner spellings: a model read 5 from the NVD names and this card's text (former and marketing names, console titles); 4 matched something on Shodan and are shown above, the rest was dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-10 15:11Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• Which flaw did Synology say is exploited, and is it among the November 2024 advisory CVEs?
• Are CVE-2026-13684 and CVE-2026-13639 real DSM CVEs? How do 2026 identifiers fit a flaw patched in December 2024? Qihoo 360's primary report is not among the sources.
• Which DSM builds fix CVE-2026-13684 and CVE-2026-13639?
• Does the attack require internet exposure of the management interface, or does it also work via QuickConnect?
• Where is Synology's own advisory or customer notice for this campaign?

Sources

• [S1] https://thehackernews.com/2026/11/synology-nas-devices-targeted-in.html · The Hacker News
• [S2] https://www.bleepingcomputer.com/news/security/synology-warns-customers-of-ongoing-c3rb3r-ransomware-attacks/ · BleepingComputer

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically; a dismissed draft unpublishes it.