Am I Affected? Check Your NAS in 60 Seconds (Ransomware, CVEs, Exposure)

Worried after the news? Work through these three checks — symptom, version, exposure — and you'll know where you stand. Each check ends with "affected / probably affected / likely safe" and the exact next move.

Check 1 — By symptom (2 minutes)

Open your NAS file manager and look at file names and for text files you didn't create:

If you see…	Verdict	Do this
Files ending .L0CK3D, a read-me3.txt note	Affected — C3RB3R (Synology, Oct 2026)	Recovery guide NOW — don't reboot, don't pay
Files ending .deadbolt, login page hijacked by a ransom note	Affected — DeadBolt (QNAP/Asustor/TerraMaster 2022 era)	Recovery guide
Files turned into password-protected .7z archives	Affected — Qlocker (QNAP, 2021)	Recovery guide
README_FOR_DECRYPT.txt (or .txtt) notes, .encrypt extensions	Affected — eCh0raix	2019 variant only: free decryptor exists; newer: recovery guide
DSM suddenly asks to "reinstall", apps vanished, alarm LED + beep	Probably affected — C3RB3R encrypting the system partition	Disconnect network, keep power on, recovery guide
Everything looks normal	Proceed to Check 2	—

Full family-by-family table: NAS ransomware file-extension encyclopedia.

Check 2 — By vendor & firmware version (5 minutes)

The October 2026 C3RB3R campaign doesn't care what year your NAS is — it cares what build it runs and whether the admin page faces the internet. Find your vendor:

Vendor	Where to look	Red flag
Synology	Control Panel → Info Center	DSM below 7.4-90075 / 7.3.2-86009-4 / 7.2.2-72806-9 / 7.2.1-69057-12 — or any DSM 6.x — probably affected class if exposed. Details
QNAP	Control Panel → System → Firmware	QTS 4.5.x/5.x behind current, or EOL 4.3.x/4.4.x — update now, history says you're the most-hit vendor. QNAP guide
Asustor	ADM online update	Anything before the 2022 DeadBolt-era fixes with WAN exposure — Asustor guide
TerraMaster	TOS version in admin	TOS < 4.2.30 — the 2022 unauth-RCE chain applies. TerraMaster guide
UGREEN / UniFi / fnOS / Zspace / TieNiu	OS settings → update	No campaign targets them yet — but unpatched + exposed = same recipe. Checklist

Check 3 — By exposure (5 minutes)

Answer these honestly — every mass campaign needed at least one "yes":

• Is any admin port forwarded to the internet? (Synology 5000/5001, QNAP 8080, Asustor 8000/8001, TM 8181, SSH 22)
• Is the NAS in a router DMZ?
• Is the admin password reused from another site, or the default account still active?
• Is auto-update off — or the box on an EOL branch showing a fake "fully updated"?
• Are there no snapshots and no backup that leaves the box?

0 yes → likely safe; keep it that way with the 12-step checklist. 1–2 yes → exposed class: fix those today (an hour of work). 3+ yes → you are the profile every campaign harvested: updates + exposure + 3-2-1 backup, tonight.

The one-sentence summary

Version current + admin interface not on the internet + one backup that leaves the box = you're fine in every campaign so far. Missing any of the three = that's your to-do list, in that order.

My NAS seems fine but I'm scared — what's the minimum I should do right now?

Three things, 30 minutes: update the OS to the latest build, remove any port-forward to the admin interface, and copy your irreplaceable files somewhere off the NAS. That closes the door every known campaign walked through.

I updated DSM months ago. Am I safe from C3RB3R?

Check the build number against the fixed list (7.4-90075 / 7.3.2-86009-4 / 7.2.2-72806-9 / 7.2.1-69057-12) — 'months ago' can predate the September 2026 fixes, and DSM 6 boxes show 'fully updated' while being unpatchable. The build number is the only truth.

Does my model year matter for ransomware risk?

No — the build and the exposure matter. Old models stuck on EOL branches are structurally riskier because they can't receive fixes; a 2018 box running a patched 7.2.2 build behind a firewall is safer than a 2025 box with forwarded ports.