How can I tell if my NAS is actually encrypted or if it's just a scam email?

Check the files on the device itself: if documents are inaccessible, renamed, or accompanied by a ransom note, it's likely a real encryption event. If everything opens normally, an email alone is probably an empty threat.

What should I do if my Synology NAS has been encrypted?

Disconnect the NAS from the network to stop further damage and cut off any remote access the attackers may still have. Do not rely on the criminals' promises, since paying does not guarantee your files will be recovered.

If my NAS was encrypted, could my data also have been stolen?

Yes, Kaspersky is clear that if your NAS has actually been encrypted, you cannot rule out data theft. A real encryption incident should be treated as a potential data exposure as well, not only an availability problem.

C3RB3R Synology NAS Ransomware Protection: Patch DSM Now

Q: What is the C3RB3R ransomware and which devices does it target?

C3RB3R is a ransomware campaign that targets Synology NAS devices running outdated operating systems and encrypts the files stored on them. Some write-ups also refer to the same activity as LOCK3D or L0CK3D.

Q: Why are NAS devices attractive targets for ransomware attackers?

A NAS concentrates documents, photos, shared project folders, and often backups in one place, and the device is frequently reachable from the internet for remote access. When its software falls behind on updates, attackers have more room to work.

A ransomware campaign called C3RB3R is targeting Synology network-attached storage (NAS) devices, and the pattern is familiar: devices running outdated operating system software are the ones getting their files encrypted. If you keep family photos, business documents, or backups on a Synology box, C3RB3R Synology NAS ransomware protection comes down to a short list of habits you can start on today.

This post walks through how the attack works, how to tell a genuine incident from a bluff, and what to do about it.

How the C3RB3R attack on Synology NAS works

According to Kaspersky's reporting, C3RB3R ransomware attacks Synology NAS devices that run outdated operating systems and encrypts the files stored on them. Some community and security write-ups refer to the same activity as LOCK3D or L0CK3D, so you may see several spellings while researching.

A NAS is an attractive target for a simple reason: it is where people concentrate their data. Documents, photos, shared project folders, and often backups all sit in one place, and the device is frequently reachable from the internet for remote access. When the software on that device falls behind on updates, attackers have more room to work.

The pressure does not stop at encryption. If the victim refuses to pay, the criminals threaten to make the stolen data public. They may contact victims by email or through social media with these demands.

Real encryption or extortion scam: how to tell

Not every threatening message means you have been hacked. Kaspersky notes that such threats are often nothing more than a scam, a pattern it has covered separately in its post on how scammers use email for blackmail and extortion. Mass-mailed demands claiming to hold your data are common, and many are bluffs sent to thousands of people with no actual access.

The NAS itself is the best evidence. A few practical checks:

Look at your files. If documents are inaccessible, renamed, or accompanied by a ransom note on the device, you are likely dealing with a real encryption event. If everything opens normally, an email alone is probably an empty threat.
Check the device, not the message. Log in to the DSM interface directly (not through a link in an email) and review what is happening on the system.
Be honest about the risk. Kaspersky is clear that if your NAS has actually been encrypted, you cannot rule out data theft. Treat a real encryption incident as a potential data exposure as well, not only an availability problem.

The distinction matters because the right response differs. A bluff calls for ignoring and reporting the message. A genuine infection calls for containment and recovery.

What to do if your NAS is encrypted

If the files on your device are really locked, act calmly and in order.

Disconnect the NAS from the network. This helps stop further damage and cuts off any remote access the attackers may still have.
Do not rely on the criminals' promises. Paying does not guarantee your files come back, and it does not undo any theft that already happened.
Assume the data may have been copied. Think about what was stored there: personal documents, customer information, credentials. Change passwords for accounts whose details may have been kept on the device, and consider who may need to be notified if the data belongs to clients or colleagues.
Restore from a clean backup. This is where offline or separate backups prove their worth. Before reconnecting anything, update the NAS software so you are not restoring onto the same weakness.
Seek professional help if the data is business-critical. An incident responder can help determine what was accessed.

NAS hardening checklist: updates, exposed services, backups, access controls

Synology's own guidance, as reflected in the sources reviewing this campaign, points to a consistent set of fixes. None require special expertise.

Update everything. Update DSM, the operating system of the NAS, and your installed packages. Synology has urged users running vulnerable versions to update immediately. Enable automatic updates where you can, and check the device occasionally even then.

Close what you do not need. Only open services you actually use. Every exposed port or remote-access feature is a door someone can try. If you do not need to reach the NAS from outside your home or office, turn off direct internet access to it.

Lock down logins. Make sure Auto Block, Account Protection, and multi-factor authentication are enabled. Use unique, long passwords for admin accounts, and avoid leaving default or shared credentials in place.

Run the built-in checks. Synology Security Advisor can routinely scan the device for vulnerabilities and weak settings. It takes minutes and catches the kind of drift that builds up over time.

Keep backups that ransomware cannot reach. A backup that sits on the same NAS, or on a share the NAS can always write to, can be encrypted along with everything else. Keep at least one copy offline or otherwise separated, and test that you can restore from it.

What This Means For You

If you own a Synology NAS, the key question is whether it is current and how exposed it is. Outdated software plus internet-facing access is the combination this campaign is built around. If you do not use a NAS but get an email claiming someone has your files, remember that such messages are frequently scams and the first step is to verify whether anything has actually happened.

For small offices, a NAS often holds data about other people, which raises the stakes if theft is possible. Updating and limiting access is cheaper than any recovery.

Actionable takeaways

Update DSM and all installed packages today, and turn on automatic updates.
Close remote-access ports and services you do not use.
Enable Auto Block, Account Protection, and multi-factor authentication.
Run Synology Security Advisor and fix what it flags.
Keep an offline backup and test a restore.
If a blackmail message arrives, check your files first before reacting.

Auditing your setup now is the most effective C3RB3R Synology NAS ransomware protection you can put in place, and it takes far less time than recovering from an attack.