C3RB3R hit your Synology NAS? Don't reboot it yet.
c3rb3r-rescue does evidence-first recovery: preserve the box, pull keys from RAM, copy-decrypt so originals stay untouched.
The order matters more than the tool. Reboot first and the keys are gone.
soimy/c3rb3r-rescue
4 views
Synology NAS users are being targeted with the C3RB3R ransomware again
synology.com
soimy/c3rb3r-rescue
reddit.com
reddit.com
reddit.com
6 likes · 5 reposts
Free CLI that checks a DSM 7 NAS against the C3RB3R (.L0CK3D) advisories, shows a plan, then applies the fixes
I wrote a small tool during the C3RB3R wave this week, mostly so I'd stop clicking through Control Panel on every box. It's free, MIT licensed, and not affiliated with Synology.
What it does:
1. nas incident only reads. It checks the DSM build against SA-26:13, packages named in SA-26:14, the firewall, QuickConnect, router port forwarding, AutoBlock, SMB minimum protocol, the built in admin account, snapshot schedules, and whether the immutable snapshot lock is on for a model that doesn't support it. It also looks for CVE-2024-10441 markers in the connection log.
2. nas incident fix --dry-run prints the plan. nas incident fix asks before it changes anything and reads every setting back afterwards. Before a firewall change it checks that you won't lock yourself out.
3. nas incident contain lists processes that look like the encryptor. With --yes it freezes them (SIGSTOP, not kill) so the keys stay in memory.
4. nas alert-deploy installs a small check on the NAS that runs every 10 minutes and posts to a webhook.
What it does NOT do: it does not decrypt files that are already encrypted. As far as I know there is no universal public decryptor for .L0CK3D, and the Kaspersky, Emsisoft and Dr.Web decryptors don't work on it. The only recovery path in the tool is nas incident rescue, which wraps soimy/c3rb3r-rescue. It can only find key candidates in the memory of an encryptor that is still running, on a NAS that has not been rebooted. If you already rebooted, it can't help.
One known gap: Synology added separate fixed builds for DSM 6.2, 7.0 and 7.1 to SA-26:14 on Oct 29 and Oct 31. The tool only knows the DSM 7.2 and newer builds so far, so on those older versions a patched Calendar, Mail Station or PHP package can show as FAIL. Check the advisory by hand there until I update it.
Python 3.8 or newer, no dependencies, runs from macOS, Linux or Windows, or on the NAS itself. The demo GIF uses a simulated NAS, so please start with the read only audit and the dry run.
Code: synology-nas-cli on GitHub
Incident notes with sources: INCIDENT-C3RB3R.md
If a check is wrong for your model or DSM version, tell me and I'll fix it.
65 points · 34 comments
@fuyunocafe soimy/c3rb3r-rescue
복호화 툴 공개중입니다 랜섬 감염 후 전원을 끄거나 DSM을 재설치하지 않았다면 사용해보세요
89 views
Топ-10 GitHub за 3 дня: print-my-profile-pic
Обзор: топ-10 новых репозиториев GitHub за 27–30 октября 2026 — open-source проекты, которые быстрее всех набрали звёзды.
В выпуске: печать аватара на чековом принтере; агент DeepSeek на Android без root; центр управления Wayland.
1. aschmelyun/print-my-profile-pic — Звезда на репозитории печатает ваш аватар на чековом принтере. (+1044 ★)
2. jackwener/DeepseekHarness-Android — Запускает DeepSeek Harness на Android в одном APK, без root. (Kotlin, +319 ★)
3. anomalyco/hokum — Центр управления для Wayland: уведомления, звук и Bluetooth. (Rust, +203 ★)
4. rudderlabs/devbox — Агент берёт тикет, пишет код, гоняет тесты и открывает черновой PR. (TypeScript, +191 ★)
5. 10291124jcjc-dotcom/ai-anime-series — Навык Claude: мини-сериал с постоянными героями по одной теме. (Python, +190 ★)
6. wangzan101/Mika — ИИ-помощник для Android: сам работает в приложениях и в сети. (Kotlin, +183 ★)
7. jmanico/grim-prompter — Модель угроз для проекта: навык для Claude Code и Codex. (+179 ★)
8. lexifina/global-law — Законы стран мира как история git: каждый коммит — один закон. (HTML, +163 ★)
9. soimy/c3rb3r-rescue — Что делать, если шифровальщик закодировал файлы NAS в .L0CK3D. (Python, +155 ★)
10. jianxinss/iching-64-motion — Трёхминутная анимация о 64 гексаграммах «Ицзин», целиком из кода. (TypeScript, +153 ★)
Источник: GitHub Search API, репозитории созданы с 2026-10-27, отсортированы по звёздам.
Лидер: aschmelyun/print-my-profile-pic
Остальные: jackwener/DeepseekHarness-Android, anomalyco/hokum, rudderlabs/devbox, 10291124jcjc-dotcom/ai-anime-series, wangzan101/Mika, jmanico/grim-prompter, lexifina/global-law, soimy/c3rb3r-rescue, jianxinss/iching-64-motion
#GitHub #opensource #программирование
Каждые 3 дня — 10 новых open-source проектов GitHub, быстрее всех набравших звёзды. Подписывайся, чтобы не пропустить следующий выпуск.
1 like · 7 views
@leon7hao 群晖 NAS 近期出现大规模勒索加密（C3RB3R / .L0CK3D）
github.com/soimy/c3rb3r-rescue/blob/main/README_C…
1 like · 247 views
@weisenzcharles c3rb3r-rescue#12 这个方法帮我恢复了部分数据，供参考
129 views
今天群晖中招的用这个仓库，超级好用，文件已全部恢复。soimy/c3rb3r-rescue
34 views
Help needed recovering data after C3RB3R ransomware attack on Synology/Xpenology NAS — `.L0CK3D` files**
Hi everyone,
Unfortunately, my NAS has been hit by ransomware, and I'm trying to recover as much of my data as possible.
**What happened**
- System: Xpenology running DSM 7.2.2-72806, configured as a DS3622xs+.
- Encrypted files have been renamed with the `.L0CK3D` extension.
- The ransom note is called `read-me3.txt` and refers to “C3RB3R INSTRUCTIONS”, with instructions to use the attackers' decryptor.
- Some Container Manager binaries were also renamed with `.L0CK3D`.
- I haven't confirmed the initial entry point, and my priority right now is recovering my data rather than investigating how the attackers got in.
**What I've done so far**
- Isolated the NAS from internet access.
- Checked for obvious ransomware-related processes, but haven't found one by name.
- Confirmed I don't have usable snapshots to restore from.
- Found no confirmed backup containing the affected data.
- Captured a memory image using Microsoft's AVML 0.21.0, writing it to a separate NTFS USB drive.
The memory capture is approximately 5.6 GB as reported on the NAS. I ran `sync` and calculated its SHA-256 checksum. I've transferred it to a separate CachyOS Linux PC and verified that the checksum matches. I'm preserving the original capture and intend to analyse a working copy.
I'm also looking at the `c3rb3r-rescue` project:
soimy/c3rb3r-rescue
**I'm hoping someone with relevant experience can advise on the following:**
1. Has anyone successfully recovered files encrypted by this particular C3RB3R variant, especially files renamed `.L0CK3D`?
2. Is the `c3rb3r-rescue` project applicable to this variant, or does it only work with particular samples and recovered keys?
3. Has anyone analysed an AVML memory capture from a physical Synology/Xpenology DSM system to recover ransomware key material?
4. What's the safest way to analyse this compressed AVML capture and search for useful key material without modifying the original evidence?
5. Are there any known decryptors or recovery techniques for this specific file format?
I'm not assuming the memory capture contains a key, and I understand recovery may not be possible. I just want to make the best possible attempt before giving up on the data.
Please share any relevant experience, technical guidance or verified recovery tools. I'd particularly appreciate advice from anyone who has worked with this specific ransomware or memory-based key recovery.
Thanks.
4 points · 11 comments
For victims of C3RB3R ransomware
If you didn't panic and pulled the plugs, there is a way to decrypt your files while ransomeware libgld is still running.
Follow the instructions ( AI can handle this ) of my repo:
soimy/c3rb3r-rescue
128 points · 36 comments
Mentions
C3RB3R hit your Synology NAS? Don't reboot it yet. c3rb3r-rescue does evidence-first recovery: preserve the box, pull keys from RAM, copy-decrypt so originals stay untouched. The order matters more than the tool. Reboot first and the keys are gone. soimy/c3rb3r-rescue
Synology NAS users are being targeted with the C3RB3R ransomware again synology.com soimy/c3rb3r-rescue reddit.com reddit.com reddit.com
Free CLI that checks a DSM 7 NAS against the C3RB3R (.L0CK3D) advisories, shows a plan, then applies the fixes I wrote a small tool during the C3RB3R wave this week, mostly so I'd stop clicking through Control Panel on every box. It's free, MIT licensed, and not affiliated with Synology. What it does: 1. nas incident only reads. It checks the DSM build against SA-26:13, packages named in SA-26:14, the firewall, QuickConnect, router port forwarding, AutoBlock, SMB minimum protocol, the built in admin account, snapshot schedules, and whether the immutable snapshot lock is on for a model that doesn't support it. It also looks for CVE-2024-10441 markers in the connection log. 2. nas incident fix --dry-run prints the plan. nas incident fix asks before it changes anything and reads every setting back afterwards. Before a firewall change it checks that you won't lock yourself out. 3. nas incident contain lists processes that look like the encryptor. With --yes it freezes them (SIGSTOP, not kill) so the keys stay in memory. 4. nas alert-deploy installs a small check on the NAS that runs every 10 minutes and posts to a webhook. What it does NOT do: it does not decrypt files that are already encrypted. As far as I know there is no universal public decryptor for .L0CK3D, and the Kaspersky, Emsisoft and Dr.Web decryptors don't work on it. The only recovery path in the tool is nas incident rescue, which wraps soimy/c3rb3r-rescue. It can only find key candidates in the memory of an encryptor that is still running, on a NAS that has not been rebooted. If you already rebooted, it can't help. One known gap: Synology added separate fixed builds for DSM 6.2, 7.0 and 7.1 to SA-26:14 on Oct 29 and Oct 31. The tool only knows the DSM 7.2 and newer builds so far, so on those older versions a patched Calendar, Mail Station or PHP package can show as FAIL. Check the advisory by hand there until I update it. Python 3.8 or newer, no dependencies, runs from macOS, Linux or Windows, or on the NAS itself. The demo GIF uses a simulated NAS, so please start with the read only audit and the dry run. Code: synology-nas-cli on GitHub Incident notes with sources: INCIDENT-C3RB3R.md If a check is wrong for your model or DSM version, tell me and I'll fix it.
@fuyunocafe soimy/c3rb3r-rescue 복호화 툴 공개중입니다 랜섬 감염 후 전원을 끄거나 DSM을 재설치하지 않았다면 사용해보세요
Топ-10 GitHub за 3 дня: print-my-profile-pic Обзор: топ-10 новых репозиториев GitHub за 27–30 октября 2026 — open-source проекты, которые быстрее всех набрали звёзды. В выпуске: печать аватара на чековом принтере; агент DeepSeek на Android без root; центр управления Wayland. 1. aschmelyun/print-my-profile-pic — Звезда на репозитории печатает ваш аватар на чековом принтере. (+1044 ★) 2. jackwener/DeepseekHarness-Android — Запускает DeepSeek Harness на Android в одном APK, без root. (Kotlin, +319 ★) 3. anomalyco/hokum — Центр управления для Wayland: уведомления, звук и Bluetooth. (Rust, +203 ★) 4. rudderlabs/devbox — Агент берёт тикет, пишет код, гоняет тесты и открывает черновой PR. (TypeScript, +191 ★) 5. 10291124jcjc-dotcom/ai-anime-series — Навык Claude: мини-сериал с постоянными героями по одной теме. (Python, +190 ★) 6. wangzan101/Mika — ИИ-помощник для Android: сам работает в приложениях и в сети. (Kotlin, +183 ★) 7. jmanico/grim-prompter — Модель угроз для проекта: навык для Claude Code и Codex. (+179 ★) 8. lexifina/global-law — Законы стран мира как история git: каждый коммит — один закон. (HTML, +163 ★) 9. soimy/c3rb3r-rescue — Что делать, если шифровальщик закодировал файлы NAS в .L0CK3D. (Python, +155 ★) 10. jianxinss/iching-64-motion — Трёхминутная анимация о 64 гексаграммах «Ицзин», целиком из кода. (TypeScript, +153 ★) Источник: GitHub Search API, репозитории созданы с 2026-10-27, отсортированы по звёздам. Лидер: aschmelyun/print-my-profile-pic Остальные: jackwener/DeepseekHarness-Android, anomalyco/hokum, rudderlabs/devbox, 10291124jcjc-dotcom/ai-anime-series, wangzan101/Mika, jmanico/grim-prompter, lexifina/global-law, soimy/c3rb3r-rescue, jianxinss/iching-64-motion #GitHub #opensource #программирование Каждые 3 дня — 10 новых open-source проектов GitHub, быстрее всех набравших звёзды. Подписывайся, чтобы не пропустить следующий выпуск.
@leon7hao 群晖 NAS 近期出现大规模勒索加密（C3RB3R / .L0CK3D） github.com/soimy/c3rb3r-rescue/blob/main/README_C…
@weisenzcharles c3rb3r-rescue#12 这个方法帮我恢复了部分数据，供参考
今天群晖中招的用这个仓库，超级好用，文件已全部恢复。soimy/c3rb3r-rescue
Help needed recovering data after C3RB3R ransomware attack on Synology/Xpenology NAS — `.L0CK3D` files** Hi everyone, Unfortunately, my NAS has been hit by ransomware, and I'm trying to recover as much of my data as possible. **What happened** - System: Xpenology running DSM 7.2.2-72806, configured as a DS3622xs+. - Encrypted files have been renamed with the `.L0CK3D` extension. - The ransom note is called `read-me3.txt` and refers to “C3RB3R INSTRUCTIONS”, with instructions to use the attackers' decryptor. - Some Container Manager binaries were also renamed with `.L0CK3D`. - I haven't confirmed the initial entry point, and my priority right now is recovering my data rather than investigating how the attackers got in. **What I've done so far** - Isolated the NAS from internet access. - Checked for obvious ransomware-related processes, but haven't found one by name. - Confirmed I don't have usable snapshots to restore from. - Found no confirmed backup containing the affected data. - Captured a memory image using Microsoft's AVML 0.21.0, writing it to a separate NTFS USB drive. The memory capture is approximately 5.6 GB as reported on the NAS. I ran `sync` and calculated its SHA-256 checksum. I've transferred it to a separate CachyOS Linux PC and verified that the checksum matches. I'm preserving the original capture and intend to analyse a working copy. I'm also looking at the `c3rb3r-rescue` project: soimy/c3rb3r-rescue **I'm hoping someone with relevant experience can advise on the following:** 1. Has anyone successfully recovered files encrypted by this particular C3RB3R variant, especially files renamed `.L0CK3D`? 2. Is the `c3rb3r-rescue` project applicable to this variant, or does it only work with particular samples and recovered keys? 3. Has anyone analysed an AVML memory capture from a physical Synology/Xpenology DSM system to recover ransomware key material? 4. What's the safest way to analyse this compressed AVML capture and search for useful key material without modifying the original evidence? 5. Are there any known decryptors or recovery techniques for this specific file format? I'm not assuming the memory capture contains a key, and I understand recovery may not be possible. I just want to make the best possible attempt before giving up on the data. Please share any relevant experience, technical guidance or verified recovery tools. I'd particularly appreciate advice from anyone who has worked with this specific ransomware or memory-based key recovery. Thanks.
For victims of C3RB3R ransomware If you didn't panic and pulled the plugs, there is a way to decrypt your files while ransomeware libgld is still running. Follow the instructions ( AI can handle this ) of my repo: soimy/c3rb3r-rescue