CVE-2026-13684

Cerber Ransomware Variant C3RB3R Targets Synology NAS Devices via Two Recently Disclosed Vulnerabilities

Since October this year, 360 Anti-Ransomware teams have responded to multiple incidents involving encryption attacks on Synology NAS appliances. Analysis by 360 AI security experts identified the threat as C3RB3R, a variant of the long-standing Cerber ransomware family that has historically focused on NAS targets. Attackers leveraged two high-risk remote vulnerabilities disclosed only one month earlier, CVE-2026-13639 and CVE-2026-13684, in classic 1-day exploitation scenarios. After gaining access, the malware follows traditional ransomware behavior: it scans file systems while skipping 27 system directories and specific extensions, then encrypts files using ChaCha8 combined with RSA-2048 before appending the .L0CK3D extension and dropping ransom notes. Synology released patches for eight vulnerabilities, including the two exploited ones, across multiple DSM versions starting 18 September 2026. The report includes detailed encryption logic, a full list of 187 priority extensions, and a set of practical hardening recommendations for NAS administrators.