{"id":22234,"date":"2026-10-30T10:09:40","date_gmt":"2026-10-30T02:09:40","guid":{"rendered":"https:\/\/synopower.club\/?p=22234"},"modified":"2026-11-02T03:20:41","modified_gmt":"2026-11-01T19:20:41","slug":"synology-c3rb3r-ransomware","status":"publish","type":"post","link":"https:\/\/synopower.club\/cs\/synology-c3rb3r-ransomware\/","title":{"rendered":"Ransomware C3RB3R na Synology: P\u016fvod, obnova a jak z\u016fstat v bezpe\u010d\u00ed"},"content":{"rendered":"<p class=\"wp-block-paragraph\"><strong>Ransomware C3RB3R<\/strong> se za\u010dal objevovat na jednotk\u00e1ch Synology NAS kolem 28. \u0159\u00edjna 2026 a b\u011bhem jednoho dne to bylo jedin\u00e9 t\u00e9ma na r\/synology. Soubory se vrac\u00ed p\u0159ejmenovan\u00e9 s <code>L0CK3D<\/code> p\u0159\u00edponou (nula, nikoli p\u00edsmeno O), v ka\u017ed\u00e9 slo\u017ece se objev\u00ed <code>read-me3.txt<\/code> v\u00fdkupn\u00e9 ozn\u00e1men\u00ed a port\u00e1l Tor po\u017eaduje Bitcoin. Nejrychlej\u0161\u00ed a neju\u017eite\u010dn\u011bj\u0161\u00ed informace nepoch\u00e1zely z anglick\u00fdch zpravodajsk\u00fdch web\u016f. Poch\u00e1zely z \u010d\u00ednsky mluv\u00edc\u00edch f\u00f3r, kde m\u00e1 Synology obrovskou u\u017eivatelskou z\u00e1kladnu, a ze t\u0159\u00ed repozit\u00e1\u0159\u016f GitHub napsan\u00fdch ob\u011b\u0165mi, kter\u00e9 sv\u00e9 \u00fadaje skute\u010dn\u011b z\u00edskaly zp\u011bt, nebo dok\u00e1zaly, \u017ee to nejde. Tento pr\u016fvodce shroma\u017e\u010fuje, co je o ransomware C3RB3R dosud potvrzeno: odkud se vzal, jak se dostane dovnit\u0159, jedinou cestu k obnov\u011b, kter\u00e1 fungovala, a architekturu z\u00e1lohov\u00e1n\u00ed, kterou provozujeme, aby n\u00e1s takov\u00fd \u00fatok st\u00e1l jen obnoven\u00ed m\u00edsto v\u00fdkupn\u00e9ho.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Aktualizace, 31. \u0159\u00edjna 2026:<\/strong> Spole\u010dnost Synology nyn\u00ed vyjasnila vstupn\u00ed bod. V e-mailu z\u00e1kazn\u00edk\u016fm z 30. \u0159\u00edjna potvrdila, \u017ee ransomware C3RB3R zneu\u017e\u00edv\u00e1 pouze zranitelnost opravenou v Synology-SA-24:20, zap\u00e1tkovanou v prosinci 2024, a \u017ee tato kampa\u0148 nesouvis\u00ed se zranitelnost\u00ed PHP2Shell opravenou ve stejn\u00e9m m\u011bs\u00edci. P\u0159idali jsme vlastn\u00ed \u010dty\u0159krokov\u00fd kontroln\u00ed seznam Synology, n\u00e1\u0161 pohled na to, pro\u010d k \u00fatok\u016fm do\u0161lo pr\u00e1v\u011b v danou chv\u00edli, a jednu dal\u0161\u00ed vrstvu, kterou provozujeme a za kterou v\u011bt\u0161ina majitel\u016f ji\u017e plat\u00ed: ochranu p\u0159ed ransomwarem v Active Insight.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Bod SynoPower Club\uff1a<\/strong>Jedna z ob\u011bt\u00ed v \u010d\u00ednsk\u00e9 skupin\u011b NAS m\u011bla na jedin\u00e9m za\u0159\u00edzen\u00ed v\u00edce ne\u017e 50 TB a \u017e\u00e1dn\u00e9 sn\u00edmky. \u0160ifrovac\u00ed program byl dostate\u010dn\u011b pomal\u00fd, tak\u017ee byly zasa\u017eeny pouze jeho fotografie z roku 2024, a ty m\u011bly shodou okolnost\u00ed chladnou z\u00e1lohu na cloudov\u00e9m disku. Dal\u0161\u00ed p\u0159i\u0161el o p\u011bt let priv\u00e1tn\u00edch repozit\u00e1\u0159\u016f GitLab, proto\u017ee RAID 6 i t\u0159i z\u00e1lohy byly na stejn\u00e9m stroji. Ransomware C3RB3R neporazil jejich \u00falo\u017ei\u0161t\u011b, porazil jejich koncepci z\u00e1lohov\u00e1n\u00ed. Na\u0161e ve\u0159ejn\u00e9 weby provozujeme jako Docker uvnit\u0159 Virtual DSM, d\u011bl\u00e1me sn\u00edmek cel\u00e9ho hosta z hostitelsk\u00e9ho syst\u00e9mu, replikujeme jej na druh\u00fd NAS a podle harmonogramu jej exportujeme na USB a do cloudu. Pokud bude hostuj\u00edc\u00ed syst\u00e9m dnes ve\u010der za\u0161ifrov\u00e1n, vr\u00e1t\u00edme jej k posledn\u00edmu sn\u00edmku a \u00fato\u010dn\u00edk nedostane nic.<\/p>\n<\/blockquote>\n\n\n\n<h2 id=\"what-is-c3rb3r-ransomware\" class=\"wp-block-heading\">Co je ransomware C3RB3R?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Ransomware C3RB3R je verze rodiny Cerber pro Linux, co\u017e je \u0159ada ransomware, kter\u00e1 existuje od roku 2016 a ji\u017e l\u00e9ta se st\u0159\u00eddav\u011b zam\u011b\u0159uje na za\u0159\u00edzen\u00ed NAS. Spole\u010dnost 360 j\u00ed p\u0159isuzuje vlnu na Synology z \u0159\u00edjna 2026. Na infikovan\u00e9m za\u0159\u00edzen\u00ed DSM b\u011b\u017e\u00ed \u0161ifrovac\u00ed program ransomware C3RB3R jako staticky propojen\u00fd, UPX-zabalen\u00fd x86-64 bin\u00e1rn\u00ed soubor s n\u00e1zvem <code>libgld<\/code>Po spu\u0161t\u011bn\u00ed vyma\u017ee sv\u016fj vlastn\u00ed soubor, tak\u017ee b\u011b\u017e\u00edc\u00ed proces zobrazuje <code>(smaz\u00e1no)<\/code> vedle cesty k provediteln\u00e9mu souboru.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To, co vid\u00edte jako vlastn\u00edk za\u0159\u00edzen\u00ed zasa\u017een\u00e9ho ransomwarem C3RB3R, je ve v\u0161ech hl\u00e1\u0161en\u00edch stejn\u00e9:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Soubory p\u0159ejmenovan\u00e9 na <code>name.ext.L0CK3D<\/code>N\u011bkter\u00e9 zpr\u00e1vy uv\u00e1d\u011bj\u00ed <code>LOCK3D<\/code>, ale anal\u00fdzy na GitHubu uv\u00e1d\u011bj\u00ed nulu.<\/li>\n\n\n\n<li>V\u00fdkupn\u00e9 ozn\u00e1men\u00ed s n\u00e1zvem <code>read-me3.txt<\/code> v ka\u017ed\u00e9 za\u0161ifrovan\u00e9 slo\u017ece s nadpisem C3RB3R INSTRUCTIONS.<\/li>\n\n\n\n<li>Str\u00e1nka na Toru s n\u00e1zvem C3rb3r Decryptor. Jeden sn\u00edmek obrazovky ob\u011bti ukazoval 0,03696 BTC (asi 2 952 USD) p\u0159i zaplacen\u00ed do p\u011bti dn\u016f, p\u0159i\u010dem\u017e pot\u00e9 se \u010d\u00e1stka zdvojn\u00e1sobila na 0,07392 BTC (asi 5 904 USD) s odpo\u010d\u00edt\u00e1vac\u00edm \u010dasova\u010dem.<\/li>\n\n\n\n<li>Trvalost zaji\u0161t\u011bn\u00e1 z\u00e1znamy cronu odpov\u00eddaj\u00edc\u00edmi <code>\/etc\/cron.d\/synot*<\/code>, kter\u00e9 se samy znovu vytv\u00e1\u0159ej\u00ed a v nejm\u00e9n\u011b jednom p\u0159\u00edpad\u011b p\u0159e\u017eily i aktualizaci DSM.<\/li>\n\n\n\n<li>Z\u00e1lo\u017en\u00ed soubory na stejn\u00e9m svazku byly za\u0161ifrov\u00e1ny spolu se v\u0161\u00edm ostatn\u00edm, v\u010detn\u011b c\u00edl\u016f Hyper Backup a datab\u00e1zov\u00fdch v\u00fdpis\u016f.<\/li>\n<\/ul>\n\n\n\n<h2 id=\"where-it-started\" class=\"wp-block-heading\">Kde to za\u010dalo: r\/synology a \u010d\u00ednsk\u00e1 f\u00f3ra<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Ransomware C3RB3R se poprv\u00e9 objevil v angli\u010dtin\u011b na r\/synology, kde ob\u011bti p\u0159isp\u00edvaly b\u011bhem jednoho dne kolem 28. a 29. \u0159\u00edjna 2026. B\u011bhem n\u011bkolika hodin \u010dten\u00e1\u0159i \u0159\u00edkali, \u017ee p\u0159i ka\u017ed\u00e9m obnoven\u00ed subredditu se objevilo nov\u00e9 vl\u00e1kno. T\u0159i z t\u011bchto vl\u00e1ken stoj\u00ed za p\u0159e\u010dten\u00ed v pln\u00e9m zn\u011bn\u00ed, proto\u017ee ka\u017ed\u00e9 p\u0159id\u00e1v\u00e1 jinou \u010d\u00e1st mozaiky:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Forenzn\u00ed rozbor.<\/strong> Vlastn\u00edk DS918+ na DSM 7.2.1-69057 Update 5 s webov\u00fdm rozhran\u00edm p\u0159\u00edstupn\u00fdm z internetu vypnul za\u0159\u00edzen\u00ed a zkontroloval disky v re\u017eimu pouze pro \u010dten\u00ed na hostiteli Proxmox. Protokol ov\u011b\u0159ov\u00e1n\u00ed DSM obsahoval po\u017eadavek na p\u0159ihl\u00e1\u0161en\u00ed, jeho\u017e pole \u00fa\u010dtu neslo vlo\u017een\u00e9 <code>LD_PRELOAD<\/code> a <code>LD_DEBUG_OUTPUT<\/code> \u0159\u00e1dky plus k\u00f3dovan\u00fd p\u0159\u00edkaz shellu a soubor v <code>\/etc\/cron.d<\/code>To odpov\u00edd\u00e1 publikovan\u00e9 technice CVE-2024-10441. Z\u00e1loha 3-2-1 znamenala, \u017ee \u00fatok st\u00e1l jen obnoven\u00ed, nikoli v\u00fdkupn\u00e9. P\u0159e\u010dt\u011bte si to zde: <a href=\"https:\/\/www.reddit.com\/r\/synology\/comments\/1xhqgov\/well_it_finally_happened_my_first_real_ransomware\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Tak u\u017e k tomu kone\u010dn\u011b do\u0161lo. M\u016fj prvn\u00ed skute\u010dn\u00fd incident s ransomwarem.<\/a>.<\/li>\n\n\n\n<li><strong>U\u017eivatel pouze pro aplikaci Photos.<\/strong> Tento vlastn\u00edk v\u011b\u0159il, \u017ee DSM je aktu\u00e1ln\u00ed, a pou\u017e\u00edval pouze Synology Photos, ale na sm\u011brova\u010di byl zapnut\u00fd UPnP. Po resetu v re\u017eimu 2 se slo\u017eky pokryt\u00e9 funkc\u00ed Snapshot Replication vr\u00e1tily. Slo\u017eky bez sn\u00edmk\u016f nikoli a lok\u00e1ln\u00ed USB disk s Hyper Backup byl za\u0161ifrov\u00e1n spole\u010dn\u011b s NAS. P\u0159e\u010dt\u011bte si to zde: <a href=\"https:\/\/www.reddit.com\/r\/synology\/comments\/1xhyt6w\/hit_with_c3rb3r_ransomware_this_am\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Dnes r\u00e1no zas\u00e1hl ransomware c3rb3r<\/a>.<\/li>\n\n\n\n<li><strong>Diskuze o slu\u017eb\u011b QuickConnect.<\/strong> P\u016fvodn\u00ed p\u0159isp\u011bvatel si toho v\u0161iml a\u017e pot\u00e9, co do\u0161lo k degradaci DSM a reinstalace odhalila za\u0161ifrovan\u00e9 soubory. V odpov\u011bd\u00edch dal\u0161\u00ed \u010dten\u00e1\u0159 se siln\u00fdm heslem, 2FA a zapnutou slu\u017ebou QuickConnect uvedl, \u017ee byl tak\u00e9 zasa\u017een, a ostatn\u00ed upozornili, \u017ee u\u017eivatel\u00e9 vyu\u017e\u00edvaj\u00edc\u00ed pouze aplikace mohou p\u0159\u00edstup k DSM v rozhran\u00ed QuickConnect zcela vypnout. P\u0159e\u010dt\u011bte si to zde: <a href=\"https:\/\/www.reddit.com\/r\/synology\/comments\/1xi9mhf\/hit_with_c3rb3r_ransomware\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Zasa\u017een ransomwarem C3RB3R<\/a>.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">P\u0159i spole\u010dn\u00e9m \u010dten\u00ed je vzorec jasn\u00fd. Ransomware C3RB3R pot\u0159eboval pouze p\u0159ihla\u0161ovac\u00ed str\u00e1nku DSM, ke kter\u00e9 se mohl dostat, nic v\u00edc. Hesla ani 2FA nepomohly, proto\u017ee k zneu\u017eit\u00ed doch\u00e1z\u00ed je\u0161t\u011b p\u0159ed ov\u011b\u0159en\u00edm. Forenzn\u00ed rozbor to \u0159ekl jasn\u011b: po\u017eadavek se dostal k zraniteln\u00e9 aplikaci a dal\u0161\u00ed v\u00fdzva k zad\u00e1n\u00ed hesla by to nespravila.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Hlub\u0161\u00ed technick\u00e1 pr\u00e1ce prob\u00edhala v \u010d\u00edn\u0161tin\u011b. Ob\u011bti ve skupin\u00e1ch na WeChatu a Xiaohongshu zve\u0159ej\u0148ovaly \u017e\u00e1dosti o v\u00fdkupn\u00e9, porovn\u00e1valy \u010dasov\u00e9 osy a navz\u00e1jem se odkazovaly na repozit\u00e1\u0159e na GitHubu popsan\u00e9 n\u00ed\u017ee. Tchajwansk\u00e1 komunita Synology na Facebooku <a href=\"https:\/\/www.facebook.com\/share\/p\/19bP2vavLb\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">shrom\u00e1\u017edila stejn\u00e9 odkazy pro obnovu<\/a> pro m\u00edstn\u00ed u\u017eivatele. To d\u00e1v\u00e1 smysl: Synology je tchajwansk\u00e1 spole\u010dnost a jej\u00ed nejv\u011bt\u0161\u00ed u\u017eivatelsk\u00e9 komunity jsou \u010d\u00ednsky mluv\u00edc\u00ed, tak\u017ee pr\u00e1v\u011b odtud poch\u00e1zela v\u011bt\u0161ina p\u0159\u00edpad\u016f ransomwaru C3RB3R, a t\u00edm p\u00e1dem i nejrychlej\u0161\u00ed rozpozn\u00e1n\u00ed vzorc\u016f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Sama spole\u010dnost Synology zve\u0159ejnila <a href=\"https:\/\/www.synology.com\/en-global\/company\/news\/article\/C3RB3R\" target=\"_blank\" rel=\"noreferrer noopener\">bezpe\u010dnostn\u00ed ozn\u00e1men\u00ed<\/a> \u0159\u00edjna 2026 s t\u00edm, \u017ee identifikovala \u00fato\u010dn\u00edky zneu\u017e\u00edvaj\u00edc\u00ed zranitelnost opravenou v prosinci 2024 proti zastaral\u00fdm verz\u00edm DSM, a vyzvala v\u0161echny k okam\u017eit\u00e9 aktualizaci.<\/p>\n\n\n\n<h2 id=\"how-c3rb3r-ransomware-gets-in\" class=\"wp-block-heading\">Jak se ransomware C3RB3R dostane dovnit\u0159<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">B\u011bhem prvn\u00edch dvou dn\u016f existovaly dva mo\u017en\u00e9 vstupn\u00ed body. Synology od t\u00e9 doby potvrdila ten star\u0161\u00ed. Jej\u00ed e-mail z 30. \u0159\u00edjna uv\u00e1d\u00ed, \u017ee \u00fatoky zneu\u017e\u00edvaj\u00ed pouze zranitelnost \u0159e\u0161enou v Synology-SA-24:20 a \u017ee ransomware C3RB3R nem\u00e1 nic spole\u010dn\u00e9ho s PHP2Shell. N\u00ed\u017ee uveden\u00e1 tabulka zobrazuje oba kandid\u00e1ty v podob\u011b, v jak\u00e9 byly diskutov\u00e1ny, proto\u017ee dvojici 360 se st\u00e1le vyplat\u00ed z\u00e1platovat.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th><\/th><th>Synology uv\u00e1d\u00ed<\/th><th>360 uv\u00e1d\u00ed<\/th><\/tr><\/thead><tbody><tr><td>Poradn\u00ed<\/td><td><a href=\"https:\/\/www.synology.com\/en-global\/security\/advisory\/Synology_SA_24_20\" target=\"_blank\" rel=\"noreferrer noopener\">Synology-SA-24:20<\/a> (Pwn2Own 2024)<\/td><td><a href=\"https:\/\/www.synology.com\/en-global\/security\/advisory\/Synology_SA_26_13\" target=\"_blank\" rel=\"noreferrer noopener\">Synology-SA-26:13<\/a><\/td><\/tr><tr><td>CVE<\/td><td>CVE-2024-10441, CVSS 9.8, neautentizovan\u00e9 vzd\u00e1len\u00e9 spu\u0161t\u011bn\u00ed k\u00f3du v d\u00e9monu syst\u00e9mov\u00e9ho Z\u00e1suvn\u00e9ho modulu<\/td><td>CVE-2026-13639 (p\u0159ihla\u0161ovac\u00ed logika) a CVE-2026-13684 (SCGI), ob\u011b CVSS 9.8<\/td><\/tr><tr><td>Opraveno<\/td><td>Listopad a\u017e prosinec 2024<\/td><td>z\u00e1\u0159\u00ed 2026<\/td><\/tr><tr><td>Opraven\u00e1 sestaven\u00ed<\/td><td>DSM 7.2.2-72806 Aktualizace 1, 7.2.1-69057 Aktualizace 6, 7.2-64570 Aktualizace 4, 7.1.1-42962 Aktualizace 7<\/td><td>DSM 7.4-90075, 7.3.2-86009 Aktualizace 4, 7.2.2-72806 Aktualizace 9, 7.2.1-69057 Aktualizace 12<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Forenzn\u00ed d\u016fkazy u alespo\u0148 \u010d\u00e1sti ob\u011bt\u00ed ukazuj\u00ed na star\u0161\u00ed chybu. Nejpodrobn\u011bj\u0161\u00ed rozbor na Redditu shodoval sv\u00e9 vlastn\u00ed dochovan\u00e9 protokoly s publikovan\u00fdm exploitem CVE-2024-10441, p\u0159i\u010dem\u017e poznamenal, \u017ee Synology to nepotvrdilo a \u017ee stejn\u00e9 za\u0159\u00edzen\u00ed bylo rovn\u011b\u017e pod \u00farovn\u00ed opravy SA-26:13. Rozbor u\u017eivatele soimy uv\u00e1d\u00ed, \u017ee pam\u011b\u0165ov\u00e9 protokoly z infikovan\u00e9ho hosta ukazuj\u00ed na injekt\u00e1\u017e prom\u011bnn\u00fdch prost\u0159ed\u00ed p\u0159es p\u0159ihla\u0161ovac\u00ed modul DSM, co\u017e odpov\u00edd\u00e1 CVE-2024-10441, a ve\u0159ejn\u00fd proof of concept zneu\u017e\u00edvaj\u00edc\u00ed pole pro p\u0159ihla\u0161ovac\u00ed jm\u00e9no se objevil na GitHubu n\u011bkolik dn\u00ed p\u0159ed propuknut\u00edm n\u00e1kazy. Dva ze t\u0159\u00ed zdokumentovan\u00fdch p\u0159\u00edpad\u016f z\u00e1chrany b\u011b\u017eely na neorigin\u00e1ln\u00edm hardwaru se zav\u00e1d\u011b\u010dem DS918+, z nich\u017e jeden pou\u017e\u00edval DSM 7.2-64570 Update 3, co\u017e je p\u0159esn\u011b o jednu aktualizaci m\u00e9n\u011b, ne\u017e je oprava CVE-2024-10441. Klonovan\u00fd hardware nem\u016f\u017ee snadno p\u0159ij\u00edmat ofici\u00e1ln\u00ed aktualizace, co\u017e z n\u011bj d\u011bl\u00e1 nejsnadn\u011bj\u0161\u00ed c\u00edl.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Praktick\u00fd z\u00e1v\u011br se nezm\u011bnil: aktualizujte na sestaven\u00ed, kter\u00e9 pokr\u00fdv\u00e1 ob\u011b varov\u00e1n\u00ed, a p\u0159esta\u0148te vystavovat DSM do internetu. Jedna ot\u00e1zka v\u0161ak z\u016fstala. Pokud byla trhlina opravena v prosinci 2024, pro\u010d tolik za\u0159\u00edzen\u00ed zas\u00e1hl ransomware C3RB3R b\u011bhem stejn\u00fdch dvou dn\u016f v \u0159\u00edjnu 2026, a to v\u010detn\u011b n\u011bkter\u00fdch, jejich\u017e majitel\u00e9 se domn\u00edvali, \u017ee jsou aktu\u00e1ln\u00ed?<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Nasazeno s p\u0159edstihem, odp\u00e1leno na povel<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">N\u00e1\u0161 v\u00fdklad \u2013 p\u0159i\u010dem\u017e jde o na\u0161i interpretaci, nikoli o ofici\u00e1ln\u00ed vyj\u00e1d\u0159en\u00ed Synology \u2013 spo\u010d\u00edv\u00e1 v tom, \u017ee napaden\u00ed ransomwarem C3RB3R a samotn\u00e9 \u0161ifrov\u00e1n\u00ed jsou dv\u011b samostatn\u00e9 ud\u00e1losti. D\u016fkazy tomu nasv\u011bd\u010duj\u00ed:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Zadn\u00ed vr\u00e1tka (backdoor) p\u0159i\u0161la jako prvn\u00ed.<\/strong> V n\u00ed\u017ee uveden\u00e9m p\u0159\u00edpad\u011b z Xiaohongshu b\u011b\u017eela zadn\u00ed vr\u00e1tka (backdoor shell) na NAS po dobu 37 dn\u00ed a zapnula telnet s pr\u00e1vy roota d\u0159\u00edve, ne\u017e byl za\u0161ifrov\u00e1n jedin\u00fd soubor.<\/li>\n\n\n\n<li><strong>P\u0159e\u017eije aktualizace.<\/strong> Z\u00e1znamy v cronu pod <code>\/etc\/cron.d\/synot*<\/code> se znovu vytvo\u0159\u00ed a nejm\u00e9n\u011b jedna ob\u011b\u0165 zjistila, \u017ee jsou st\u00e1le p\u0159\u00edtomny i po p\u0159echodu na nejnov\u011bj\u0161\u00ed DSM. Aktualizace sice uzav\u0159ela bezpe\u010dnostn\u00ed d\u00edru, ale \u00fato\u010dn\u00edka ponechala uvnit\u0159.<\/li>\n\n\n\n<li><strong>Odp\u00e1len\u00ed byla synchronizov\u00e1na.<\/strong> Za\u0159\u00edzen\u00ed napaden\u00e1 ransomwarem C3RB3R v r\u016fzn\u00fdch \u010dasech a na r\u016fzn\u00fdch sestaven\u00edch za\u010dala \u0161ifrovat v rozmez\u00ed p\u0159ibli\u017en\u011b 48 hodin od sebe.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Tento vzorec odpov\u00edd\u00e1 \u00fato\u010dn\u00edkovi, kter\u00fd po cel\u00e9 m\u011bs\u00edce instaloval \u0161ifrovac\u00ed \u0161kodliv\u00fd k\u00f3d C3RB3R na neaktualizovan\u00e1 za\u0159\u00edzen\u00ed a pot\u00e9 se rozhodl, kdy vzd\u00e1len\u011b stiskne spou\u0161\u0165. Vybral si t\u00fdden s PHP2Shell, kdy byli v\u0161ichni spr\u00e1vci Synology zanepr\u00e1zdn\u011bni instalac\u00ed z\u00e1plat, mnoh\u00e1 za\u0159\u00edzen\u00ed byla pr\u00e1v\u011b aktualizov\u00e1na a majitel\u00e9 se c\u00edtili bezpe\u010dn\u011b. Synology jasn\u011b uv\u00e1d\u00ed, \u017ee PHP2Shell nebyla cesta dovnit\u0159. Slou\u017eila jen jako kryt\u00ed. Pou\u010den\u00ed zn\u00ed: za\u0159\u00edzen\u00ed, kter\u00e9 bylo v minulosti neaktualizovan\u00e9 a vystaven\u00e9 internetu, by m\u011blo b\u00fdt pova\u017eov\u00e1no za kompromitovan\u00e9, dokud nebude zkontrolov\u00e1no \u2013 co\u017e je p\u0159esn\u011b to, k \u010demu v\u00e1s nab\u00e1d\u00e1 prvn\u00ed krok kontroln\u00edho seznamu Synology&#8217;s.<\/p>\n\n\n\n<h2 id=\"first-response-in-4-steps\" class=\"wp-block-heading\">Prvn\u00ed reakce na ransomware C3RB3R ve 4 kroc\u00edch<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Pokud pr\u00e1v\u011b te\u010f najdete <code>L0CK3D<\/code> soubory, po\u0159ad\u00ed n\u00e1sleduj\u00edc\u00edch deseti minut rozhodne o tom, zda je obnova v\u016fbec mo\u017en\u00e1. Kl\u00ed\u010d, kter\u00fd odemkne va\u0161e soubory, existuje pouze uvnit\u0159 b\u011b\u017e\u00edc\u00edho procesu ransomwaru C3RB3R. Restart, <code>kill -9<\/code> nebo op\u011btovn\u00e1 instalace DSM jej zni\u010d\u00ed.<\/p>\n\n\n<div id=\"rank-math-howto\" class=\"rank-math-block\" >\n<div class=\"rank-math-howto-description\">\n\n<\/div>\n\n<div class=\"rank-math-steps\">\n<div id=\"step-1\" class=\"rank-math-step\">\n<h3 class=\"rank-math-step-title\">Odpojte s\u00ed\u0165, ne nap\u00e1jen\u00ed<\/h3>\n<div class=\"rank-math-step-content\"><p>Odpojte stranu WAN nebo odeberte p\u0159esm\u011brov\u00e1n\u00ed port\u016f a mapov\u00e1n\u00ed UPnP na sm\u011brova\u010di. NAS nevyp\u00ednejte ani nerestartujte. Zav\u0159ete ve\u0161ker\u00fd p\u0159\u00edstup p\u0159es SSH nebo telnet, kter\u00fd jste sami neotev\u0159eli.<\/p>\n<\/div>\n<\/div>\n<div id=\"step-2\" class=\"rank-math-step\">\n<h3 class=\"rank-math-step-title\">Najd\u011bte a zmrazte \u0161ifrovac\u00ed proces<\/h3>\n<div class=\"rank-math-step-content\"><p>P\u0159es SSH jako root vypi\u0161te procesy, jejich\u017e spustiteln\u00fd soubor byl smaz\u00e1n, a pot\u00e9 po\u0161lete SIGSTOP pomoc\u00ed kill -STOP a PID. Zmrazen\u00fd proces si zachov\u00e1 svou pam\u011b\u0165 a jeho pam\u011b\u0165 obsahuje kl\u00ed\u010d relace.<\/p>\n<\/div>\n<\/div>\n<div id=\"step-3\" class=\"rank-math-step\">\n<h3 class=\"rank-math-step-title\">Prove\u010fte v\u00fdpis pam\u011bti zmrazen\u00e9ho procesu<\/h3>\n<div class=\"rank-math-step-content\"><p>Postupujte podle repozit\u00e1\u0159e Benjamin-zlt a p\u0159e\u010dt\u011bte zapisovatelnou pam\u011b\u0165 dan\u00e9ho PID ze souborov\u00e9ho syst\u00e9mu proc na samostatn\u00fd disk. Na virtu\u00e1ln\u00edm po\u010d\u00edta\u010di funguje tak\u00e9 \u00fapln\u00fd sn\u00edmek pam\u011bti hosta z hypervizoru.<\/p>\n<\/div>\n<\/div>\n<div id=\"step-4\" class=\"rank-math-step\">\n<h3 class=\"rank-math-step-title\">Uchovejte d\u016fkazy a pot\u00e9 prove\u010fte \u00faklid<\/h3>\n<div class=\"rank-math-step-content\"><p>Ponechte ka\u017ed\u00fd soubor L0CK3D a pozn\u00e1mku o v\u00fdkupn\u00e9m nedot\u010den\u00e9. Zkop\u00edrujte data, kter\u00e1 jsou st\u00e1le \u010diteln\u00e1. Teprve po zabezpe\u010den\u00ed pam\u011bti odstra\u0148te z\u00e1znamy cronu synot, zm\u011b\u0148te v\u0161echna hesla a aktualizujte DSM.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n\n\n\n<p class=\"wp-block-paragraph\">P\u0159\u00edkazy pro kroky 2 a 3 vypadaj\u00ed takto. P\u0159ed spu\u0161t\u011bn\u00edm \u010dehokoli si p\u0159e\u010dt\u011bte repozit\u00e1\u0159e, proto\u017ee podrobnosti z\u00e1vis\u00ed na tom, jak\u00fd bin\u00e1rn\u00ed soubor m\u00e1te.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Krok 2: najd\u011bte \u0161ifrovac\u00ed proces (jeho spustiteln\u00fd soubor se zobrazuje jako smazan\u00fd)<\/code><\/pre>\n\n\n\n<h2 id=\"three-github-rescue-cases\" class=\"wp-block-heading\">ls -l \/proc\/*\/exe 2&gt;\/dev\/null | grep deleted<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"># Zmrazte jej. Zde nikdy nepou\u017e\u00edvejte kill -9.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>kill -STOP &lt;PID&gt;<\/th><th>grep State \/proc\/&lt;PID&gt;\/status     # m\u011blo by zobrazovat T (stopped)<\/th><th># Hledejte persistenci, kter\u00e1 jej vrac\u00ed zp\u011bt<\/th><th>ls -l \/etc\/cron.d\/ | grep synot<\/th><\/tr><\/thead><tbody><tr><td><a href=\"https:\/\/github.com\/soimy\/c3rb3r-rescue\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Lze to de\u0161ifrovat? T\u0159i p\u0159\u00edpady z\u00e1chrany z GitHubu<\/a><\/td><td>Neexistuje \u017e\u00e1dn\u00fd univerz\u00e1ln\u00ed de\u0161ifrova\u010d pro ransomware C3RB3R a ka\u017ed\u00fd, kdo jej prod\u00e1v\u00e1, pouze h\u00e1d\u00e1. Existuj\u00ed t\u0159i pe\u010dliv\u00e9 p\u0159\u00edpadov\u00e9 studie, kter\u00e9 v\u00e1m p\u0159esn\u011b \u0159eknou, kdy obnova funguje.<\/td><td>Repozit\u00e1\u0159<\/td><td>Za\u0159\u00edzen\u00ed<\/td><\/tr><tr><td><a href=\"https:\/\/github.com\/Benjamin-zlt\/c3rb3r-baremetal-rescue\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">V\u00fdsledek<\/a><\/td><td>D\u016fvod<\/td><td>Repozit\u00e1\u0159<\/td><td>soimy\/c3rb3r-rescue<\/td><\/tr><tr><td><a href=\"https:\/\/github.com\/lllong1377\/c3rb3r-never-rebooted-still-no-key\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">DSM ve virtu\u00e1ln\u00edm po\u010d\u00edta\u010di Proxmox VE spou\u0161t\u011bj\u00edc\u00ed GitLab<\/a><\/td><td>Obnoveno<\/td><td>Kopie 16 GiB RAM hosta obsahovala 48bajtov\u00fd kl\u00ed\u010d relace. GitLab byl obnoven s 80 projekty a 9 253 objekty LFS.<\/td><td>\u0160ifrovac\u00ed program se ukon\u010dil ji\u017e p\u0159ibli\u017en\u011b p\u0159ed 30 hodinami. \u00dapln\u00e9 skeny RAM a odkl\u00e1dac\u00edho prostoru (swap) \u017e\u00e1dn\u00fd kl\u00ed\u010d nena\u0161ly.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">T\u0159et\u00ed repozit\u00e1\u0159 je nejd\u016fle\u017eit\u011bj\u0161\u00ed k p\u0159e\u010dten\u00ed, proto\u017ee jeho n\u00e1zev je z\u00e1rove\u0148 jeho pou\u010den\u00edm: to, \u017ee syst\u00e9m nebyl restartov\u00e1n, neznamen\u00e1, \u017ee je obnoviteln\u00fd. D\u016fle\u017eit\u00e9 je, zda proces ransomware C3RB3R st\u00e1le b\u011b\u017e\u00ed. Jakmile se ukon\u010d\u00ed, vynuluje sv\u016fj vyrovn\u00e1vac\u00ed pam\u011b\u0165ov\u00fd prostor pro kl\u00ed\u010d a kl\u00ed\u010d je pry\u010d. Kl\u00ed\u010d obnoven\u00fd u jedn\u00e9 ob\u011bti je tak\u00e9 nepou\u017eiteln\u00fd u jin\u00e9, proto\u017ee ka\u017ed\u00e9 spu\u0161t\u011bn\u00ed generuje nov\u00fd rela\u010dn\u00ed kl\u00ed\u010d.<\/p>\n\n\n\n<h2 id=\"why-the-key-lives-in-memory\" class=\"wp-block-heading\">Pro\u010d je kl\u00ed\u010d ulo\u017een pouze v pam\u011bti<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Anal\u00fdza od Benjamin-zlt podrobn\u011b popisuje form\u00e1t soubor\u016f ransomware C3RB3R a vysv\u011btluje, pro\u010d to funguje a pro\u010d to obvykle nefunguje.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Ka\u017ed\u00fd soubor z\u00edsk\u00e1 sv\u016fj vlastn\u00ed n\u00e1hodn\u00fd kl\u00ed\u010d ChaCha8.<\/strong> Tento kl\u00ed\u010d je zabalen pomoc\u00ed hlavn\u00edho rela\u010dn\u00edho kl\u00ed\u010de (session master key) za pou\u017eit\u00ed AES-256-CBC a ulo\u017een v 588bajtov\u00e9 patce na konci souboru.<\/li>\n\n\n\n<li><strong>Hlavn\u00ed rela\u010dn\u00ed kl\u00ed\u010d m\u00e1 48 bajt\u016f:<\/strong> 16bajtov\u00fd IV plus 32bajtov\u00fd kl\u00ed\u010d AES. Nikdy se nezapisuje na disk. Ukazuje na n\u011bj glob\u00e1ln\u00ed ukazatel uvnit\u0159 b\u011b\u017e\u00edc\u00edho procesu.<\/li>\n\n\n\n<li><strong>Patka tak\u00e9 obsahuje blob zabalen\u00fd ve\u0159ejn\u00fdm kl\u00ed\u010dem \u00fato\u010dn\u00edka<\/strong> (RSA-2048), tak\u017ee bez b\u011b\u017e\u00edc\u00edho procesu m\u016f\u017ee rela\u010dn\u00ed kl\u00ed\u010d obnovit pouze \u00fato\u010dn\u00edk.<\/li>\n\n\n\n<li><strong>Ne ka\u017ed\u00fd soubor je pln\u011b za\u0161ifrov\u00e1n.<\/strong> Ve vzorku 400 soubor\u016f pou\u017e\u00edvalo p\u0159ibli\u017en\u011b 56 % segmentovan\u00fd re\u017eim, 31 % m\u011blo za\u0161ifrovan\u00fd pouze prvn\u00ed 1 MiB a 13 % bylo za\u0161ifrov\u00e1no kompletn\u011b. \u010c\u00e1ste\u010dn\u011b za\u0161ifrovan\u00e9 soubory st\u00e1le nelze p\u0159e\u010d\u00edst, ale anal\u00fdza z\u00e1pat\u00ed v\u00e1m \u0159ekne, co zbylo.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Slabina ransomware C3RB3R je tedy \u00fazk\u00e1 a \u010dasov\u011b omezen\u00e1: \u0161ifrovac\u00ed program uchov\u00e1v\u00e1 hlavn\u00ed kl\u00ed\u010d v pam\u011bti po celou dobu relace. Pokud jej zmraz\u00edte b\u011bhem b\u011bhu, m\u016f\u017eete kl\u00ed\u010d z\u00edskat. Pokud toto okno prome\u0161k\u00e1te, z\u016fstane v\u00e1m pouze blob s ve\u0159ejn\u00fdm kl\u00ed\u010dem, kter\u00fd je navr\u017een jako neprolomiteln\u00fd.<\/p>\n\n\n\n<h2 id=\"victim-story-50-tb-no-snapshots\" class=\"wp-block-heading\">P\u0159\u00edb\u011bh ob\u011bti: 50 TB a \u017e\u00e1dn\u00e9 sn\u00edmky<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Podrobn\u00fd popis zve\u0159ejn\u011bn\u00fd na Xiaohongshu dne 29. \u0159\u00edjna 2026 u\u017eivatelem \u67ef\u57fa\u7231\u597d\u8005 sleduje jednoho \u010dlena jejich skupiny NAS b\u011bhem noci. V\u0161iml si vzkazu ransomware C3RB3R, potvrdil hlavi\u010dku C3RB3R INSTRUCTIONS a byl bl\u00edzko n\u00e1kupu Bitcoin\u016f, ne\u017e ho skupina nasm\u011brovala na p\u0159\u00edpady na GitHubu.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Pot\u00e9 pou\u017eil AI asistenta pro k\u00f3dov\u00e1n\u00ed p\u0159es SSH k vy\u0161et\u0159en\u00ed. Ten na\u0161el a zmrazil \u0161ifrovac\u00ed program, tak\u017ee od toho momentu nebylo za\u0161ifrov\u00e1no nic nov\u00e9ho. Tak\u00e9 zjistil, \u017ee na NAS byl pravd\u011bpodobn\u011b 37 dn\u00ed aktivn\u00ed zadn\u00ed vr\u00e1tka (backdoor shell), kter\u00fd povolil telnet jako root, co\u017e znamen\u00e1, \u017ee po\u010d\u00e1te\u010dn\u00ed pr\u016fnik a samotn\u00e9 \u0161ifrov\u00e1n\u00ed d\u011blil v\u00edce ne\u017e m\u011bs\u00edc. Napsal skript pro sb\u011br d\u016fkaz\u016f a spr\u00e1vn\u011b po\u010dkal na jeho potvrzen\u00ed, ne\u017e cokoli spustil jako root.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Jeho \u0161t\u011bst\u00edm bylo, \u017ee ransomware C3RB3R je pomal\u00fd. S v\u00edce ne\u017e 50 TB dat ke zpracov\u00e1n\u00ed dos\u00e1hl \u0161ifrovac\u00ed program pouze k jeho fotk\u00e1m z roku 2024, kter\u00e9 m\u011bly chladnou z\u00e1lohu na cloudov\u00e9m disku. P\u0159esunul pracovn\u00ed data na men\u0161\u00ed NAS a za\u0161ifrovan\u00fd svazek odlo\u017eil na pozd\u011bji. Jeho vlastn\u00ed shrnut\u00ed bylo nekompromisn\u00ed: nem\u011bl \u017e\u00e1dn\u00e9 sn\u00edmky (snapshots) a se sn\u00edmky by to bylo snadn\u00e9 opravit. Druh\u00e1 ob\u011b\u0165 na X shrnula stejn\u00e9 pou\u010den\u00ed z druh\u00e9 strany: RAID 6 plus t\u0159i sady z\u00e1loh, v\u0161e na stejn\u00e9m za\u0159\u00edzen\u00ed, v\u0161e za\u0161ifrov\u00e1no spole\u010dn\u011b.<\/p>\n\n\n\n<h2 id=\"how-we-keep-backups-safe\" class=\"wp-block-heading\">Jak chr\u00e1nit na\u0161e z\u00e1lohy p\u0159ed ransomwarem C3RB3R<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Ka\u017ed\u00fd z v\u00fd\u0161e uveden\u00fdch p\u0159\u00edb\u011bh\u016f o ztr\u00e1t\u011b dat m\u00e1 stejn\u00fd sc\u00e9n\u00e1\u0159: z\u00e1lohy byly dostupn\u00e9 ze stroje, kter\u00fd byl napaden. Ransomware C3RB3R za\u0161ifruje cokoli, kam m\u016f\u017ee kompromitovan\u00fd syst\u00e9m DSM zapisovat, tak\u017ee \u0159e\u0161en\u00edm je uchov\u00e1vat alespo\u0148 jednu kopii n\u011bkde, kam DSM nem\u016f\u017ee zapisovat v\u016fbec. Takto to d\u011bl\u00e1me pro weby, kter\u00e9 hostujeme, a odpov\u00edd\u00e1 to pravidlu 3-2-1-1-0.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Pravidlo<\/th><th>V\u00fdznam<\/th><th>Jak to d\u011bl\u00e1me<\/th><\/tr><\/thead><tbody><tr><td>3<\/td><td>T\u0159i kopie dat<\/td><td>\u017div\u00e1 VM, replika na druh\u00e9m NAS a pl\u00e1novan\u00fd export<\/td><\/tr><tr><td>2<\/td><td>Dva druhy m\u00e9di\u00ed<\/td><td>Svazky NAS plus USB disk a cloudov\u00fd disk<\/td><\/tr><tr><td>1<\/td><td>Jedna kopie mimo pracovi\u0161t\u011b<\/td><td>Exporty synchronizovan\u00e9 do Google Drive pomoc\u00ed Cloud Sync<\/td><\/tr><tr><td>1<\/td><td>Jedna kopie offline nebo nem\u011bnn\u00e1<\/td><td>Sn\u00edmky VM na stran\u011b hostitele, na kter\u00e9 hostuj\u00edc\u00ed syst\u00e9m nem\u016f\u017ee dos\u00e1hnout, plus odpojen\u00fd USB export<\/td><\/tr><tr><td>0<\/td><td>Nulov\u00fd po\u010det chyb p\u0159i obnoven\u00ed<\/td><td>P\u0159i p\u0159esunu VM mezi hostiteli skute\u010dn\u011b prov\u00e1d\u00edme obnovu a spou\u0161t\u00edme syst\u00e9m z replik<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Spou\u0161t\u011bjte Docker uvnit\u0159 Virtual DSM, nikoli na hostiteli<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Na\u0161e kontejnery WordPress neb\u011b\u017e\u00ed na fyzick\u00e9m NAS. B\u011b\u017e\u00ed uvnit\u0159 hostovan\u00e9ho syst\u00e9mu Virtual DSM a tento hostovan\u00fd syst\u00e9m je chr\u00e1n\u011bn aplikac\u00ed Virtual Machine Manager na hostiteli. Pokud ransomware C3RB3R z\u00edsk\u00e1 opr\u00e1vn\u011bn\u00ed root uvnit\u0159 hosta, ovl\u00e1dne pouze tohoto hosta a nic jin\u00e9ho. Sn\u00edmky hosta jsou ulo\u017eeny na \u00falo\u017ei\u0161ti hostitele mimo souborov\u00fd syst\u00e9m hosta, tak\u017ee ransomware uvnit\u0159 VM je nem\u016f\u017ee vid\u011bt, nato\u017e za\u0161ifrovat nebo smazat. Obnova p\u0159edstavuje n\u00e1vrat k sn\u00edmku v \u0159\u00e1du minut.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">VMM Pro p\u0159id\u00e1v\u00e1 funkce, kter\u00e9 z toho d\u011blaj\u00ed skute\u010dn\u00e9 z\u00e1lohov\u00e1n\u00ed: pl\u00e1n ochrany, kter\u00fd vytv\u00e1\u0159\u00ed sn\u00edmky VM a replikuje je na druh\u00fd NAS v clusteru, tak\u017ee je pokryt i v\u00fdpadek hostitele. N\u00e1\u0161 cluster se skl\u00e1d\u00e1 z DS1621xs+ a DS1525+, kter\u00e9 se navz\u00e1jem replikuj\u00ed. Samostatn\u011b jsme popsali \u010d\u00e1st o <a href=\"https:\/\/synopower.club\/cs\/docs\/vmm-backup-google-drive-cloud-sync\/\">pl\u00e1novan\u00e9m exportu a Cloud Sync do Google Drive<\/a> a srovn\u00e1n\u00ed <a href=\"https:\/\/synopower.club\/cs\/docs\/synology-virtual-machine-manager-vs-vmm-pro\/\">bezplatn\u00e9ho VMM vs VMM Pro<\/a> vysv\u011btluje, kter\u00e9 \u010d\u00e1sti vy\u017eaduj\u00ed licenci.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"eager\" decoding=\"async\" width=\"1410\" height=\"243\" sizes=\"auto, (max-width: 1410px) 100vw, 1410px\" src=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/vmm-protection-plan-c3rb3r-ransomware.webp\" alt=\"Pl\u00e1n ochrany VMM Pro replikuj\u00edc\u00ed hosta Virtual DSM na druh\u00fd NAS jako obrana proti ransomwaru C3RB3R\" class=\"wp-image-22237\" srcset=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/vmm-protection-plan-c3rb3r-ransomware.webp 1410w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/vmm-protection-plan-c3rb3r-ransomware-300x52.webp 300w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/vmm-protection-plan-c3rb3r-ransomware-1024x176.webp 1024w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/vmm-protection-plan-c3rb3r-ransomware-768x132.webp 768w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/vmm-protection-plan-c3rb3r-ransomware-18x3.webp 18w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/vmm-protection-plan-c3rb3r-ransomware-600x103.webp 600w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/vmm-protection-plan-c3rb3r-ransomware-400x69.webp 400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/vmm-protection-plan-c3rb3r-ransomware-1000x172.webp 1000w\"  fetchpriority=\"high\"\/><figcaption class=\"wp-element-caption\">N\u00e1\u0161 hostovan\u00fd Virtual DSM spc_4C8G: sn\u00edmky ka\u017ed\u00fdch 12 hodin, replikovan\u00e9 z DS1621xs+ na DS1525+.<\/figcaption><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Pokud spou\u0161t\u00edte Docker p\u0159\u00edmo v DSM, pou\u017e\u00edvejte nem\u011bnn\u00e9 sn\u00edmky<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Ne ka\u017ed\u00fd chce vrstvu VM. Pokud va\u0161e kontejnery b\u011b\u017e\u00ed na hostiteli, obranou proti ransomwaru C3RB3R jsou nem\u011bnn\u00e9 sn\u00edmky. Zapn\u011bte je v Snapshot Replication pro sd\u00edlenou slo\u017eku, kter\u00e1 obsahuje data va\u0161ich kontejner\u016f. Vy\u017eaduj\u00ed DSM 7.2 nebo nov\u011bj\u0161\u00ed a svazek Btrfs a b\u011bhem obdob\u00ed uzam\u010den\u00ed je nem\u016f\u017ee nikdo smazat, a to ani \u00fa\u010det spr\u00e1vce, kter\u00e9ho se \u00fato\u010dn\u00edk zmocnil. Dva detaily rozhoduj\u00ed o \u00fasp\u011bchu \u010di ne\u00fasp\u011bchu:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Pou\u017e\u00edvejte namontov\u00e1n\u00ed typu bind do sd\u00edlen\u00e9 slo\u017eky<\/strong> jako nap\u0159\u00edklad <code>\/volume1\/docker\/app<\/code>. Pojmenovan\u00e9 svazky Dockeru se nach\u00e1zej\u00ed pod <code>\/volume1\/@docker<\/code>, co\u017e nen\u00ed sd\u00edlen\u00e1 slo\u017eka a nelze z n\u00ed v\u016fbec vytv\u00e1\u0159et sn\u00edmky.<\/li>\n\n\n\n<li><strong>P\u0159ed sn\u00edmkem vyexportujte datab\u00e1ze do souboru.<\/strong> Sn\u00edmek b\u011b\u017e\u00edc\u00ed MariaDB je kopi\u00ed jako po v\u00fdpadku proudu. Pl\u00e1novan\u00fd <code>mysqldump<\/code> do stejn\u00e9 sd\u00edlen\u00e9 slo\u017eky v\u00e1m poskytne \u010dist\u00fd bod obnoven\u00ed, kter\u00fd sn\u00edmek n\u00e1sledn\u011b uzamkne.<\/li>\n\n\n\n<li><strong>Zvolte dobu uzam\u010den\u00ed del\u0161\u00ed, ne\u017e jakou dok\u00e1\u017ee \u00fato\u010dn\u00edk potichu \u010dekat.<\/strong> V\u00fd\u0161e uveden\u00e1 ob\u011b\u0165 m\u011bla v syst\u00e9mu zadn\u00ed vr\u00e1tka 37 dn\u00ed p\u0159ed zah\u00e1jen\u00edm \u0161ifrov\u00e1n\u00ed. Sedm dn\u00ed nem\u011bnn\u00fdch sn\u00edmk\u016f by k dosa\u017een\u00ed \u010dist\u00e9ho stavu nesta\u010dilo.<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"526\" height=\"318\" sizes=\"auto, (max-width: 526px) 100vw, 526px\" src=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/immutable-snapshot-c3rb3r-ransomware.webp\" alt=\"Nastaven\u00ed Snapshot Replication se zapnut\u00fdmi nezm\u011bniteln\u00fdmi sn\u00edmky pro ochranu sd\u00edlen\u00e9 slo\u017eky p\u0159ed ransomwarem C3RB3R\" class=\"wp-image-22239\" srcset=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/immutable-snapshot-c3rb3r-ransomware.webp 526w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/immutable-snapshot-c3rb3r-ransomware-300x181.webp 300w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/immutable-snapshot-c3rb3r-ransomware-18x12.webp 18w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/immutable-snapshot-c3rb3r-ransomware-400x242.webp 400w\" \/><figcaption class=\"wp-element-caption\">Snapshot Replication, Nastaven\u00ed sd\u00edlen\u00e9 slo\u017eky: denn\u00ed pl\u00e1n s nem\u011bnn\u00fdmi sn\u00edmky uzam\u010den\u00fdmi na 30 dn\u00ed.<\/figcaption><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Na\u0161e dal\u0161\u00ed vrstva: Active Insight vytvo\u0159\u00ed sn\u00edmek (snapshot), jakmile za\u010dne \u0161ifrov\u00e1n\u00ed<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Zde je vrstva, kterou v\u011bt\u0161ina n\u00e1vod\u016f opom\u00edj\u00ed. Active Insight, cloudov\u00e1 monitorovac\u00ed slu\u017eba spole\u010dnosti Synology, dok\u00e1\u017ee sledovat souborovou aktivitu na va\u0161ich sd\u00edlen\u00fdch slo\u017ek\u00e1ch, a jakmile vyhodnot\u00ed, \u017ee jde o ransomware, zareaguje sama. Synology to dokumentuje ve sv\u00e9m <a href=\"https:\/\/kb.synology.com\/en-global\/DSM\/tutorial\/How_to_add_extra_security_to_your_Synology_NAS\" target=\"_blank\" rel=\"noreferrer noopener\">pr\u016fvodci zabezpe\u010den\u00edm NAS<\/a>: p\u0159i zji\u0161t\u011bn\u00ed ransomwarov\u00e9 ud\u00e1losti po\u0161le Active Insight upozorn\u011bn\u00ed na ud\u00e1lost a automaticky vytvo\u0159\u00ed sn\u00edmek sd\u00edlen\u00e9 slo\u017eky; u model\u016f, kter\u00e9 to podporuj\u00ed, je tento sn\u00edmek nem\u011bnn\u00fd (immutable).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Pro\u010d na tom u ransomwaru C3RB3R obzvl\u00e1\u0161\u0165 z\u00e1le\u017e\u00ed: \u0161ifrovac\u00ed k\u00f3d ransomwaru C3RB3R je pomal\u00fd. Ob\u011b\u0165 s v\u00edce ne\u017e 50 TB byla teprve u fotek z roku 2024, kdy\u017e si toho v\u0161imla. Sn\u00edmek po\u0159\u00edzen\u00fd v moment\u011b, kdy se poprv\u00e9 objev\u00ed vzorec \u0161ifrov\u00e1n\u00ed, zmraz\u00ed v\u0161e, co je\u0161t\u011b nebylo zasa\u017eeno, co\u017e m\u016f\u017ee b\u00fdt v\u011bt\u0161ina svazku. Z\u00e1rove\u0148 nez\u00e1le\u017e\u00ed na tom, jak se ransomware C3RB3R dovnit\u0159 dostal, proto\u017ee sledov\u00e1na je aktivita se soubory, nikoli p\u0159ihla\u0161ovac\u00ed str\u00e1nka. Na na\u0161em DS1621xs+ zobrazuje str\u00e1nka Aktivity se soubory stav ochrany p\u0159ed ransomwarem jako Chr\u00e1n\u011bno.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"644\" height=\"596\" sizes=\"auto, (max-width: 644px) 100vw, 644px\" src=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/active-insight-ransomware-protection-c3rb3r-ransomware.webp\" alt=\"Str\u00e1nka Aktivita soubor\u016f v Active Insight zobrazuj\u00edc\u00ed ochranu p\u0159ed ransomwarem jako Chr\u00e1n\u011bno na DS1621xs+, bezpe\u010dnostn\u00ed s\u00ed\u0165 proti ransomwaru C3RB3R\" class=\"wp-image-22272\" srcset=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/active-insight-ransomware-protection-c3rb3r-ransomware.webp 644w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/active-insight-ransomware-protection-c3rb3r-ransomware-300x278.webp 300w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/active-insight-ransomware-protection-c3rb3r-ransomware-13x12.webp 13w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/active-insight-ransomware-protection-c3rb3r-ransomware-600x555.webp 600w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/active-insight-ransomware-protection-c3rb3r-ransomware-400x370.webp 400w\" \/><figcaption class=\"wp-element-caption\">Aktivita se soubory v Active Insight na na\u0161em DS1621xs+: ochrana p\u0159ed ransomwarem je zapnut\u00e1, tak\u017ee zji\u0161t\u011bn\u00e1 ud\u00e1lost ransomwaru C3RB3R spust\u00ed automatick\u00fd sn\u00edmek.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Ne\u017e se na to spolehnete, p\u0159e\u010dt\u011bte si omezen\u00ed. Poch\u00e1zej\u00ed z dokumentace Synology&#8217;s <a href=\"https:\/\/kb.synology.com\/en-global\/DSM\/tutorial\/Active_Insight_File_Activity\" target=\"_blank\" rel=\"noreferrer noopener\">Dokumentace k aktivit\u011b se soubory<\/a>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Monitorov\u00e1n\u00ed aktivity se soubory je ve v\u00fdchoz\u00edm nastaven\u00ed vypnut\u00e9.<\/strong> Zaregistrujte NAS do slu\u017eby Active Insight v Ovl\u00e1dac\u00edm panelu a pot\u00e9 povolte monitorov\u00e1n\u00ed pro jednotliv\u00e9 hostitele na port\u00e1lu Active Insight.<\/li>\n\n\n\n<li><strong>Vy\u017eaduje Snapshot Replication,<\/strong> DSM 7.2 nebo nov\u011bj\u0161\u00ed, Active Insight 3.0.2 nebo nov\u011bj\u0161\u00ed, alespo\u0148 1 GB pam\u011bti a licenci Active Insight p\u0159i\u0159azenou k dan\u00e9mu NAS.<\/li>\n\n\n\n<li><strong>Maxim\u00e1ln\u011b jeden automatick\u00fd sn\u00edmek na sd\u00edlenou slo\u017eku za den.<\/strong> Jde o z\u00e1chrannou s\u00ed\u0165 po\u0159\u00edzenou po detekci, nikoli o n\u00e1hradu pl\u00e1novan\u00fdch nem\u011bnn\u00fdch sn\u00edmk\u016f (immutable snapshots).<\/li>\n\n\n\n<li><strong>Nekryto:<\/strong> Slo\u017eky nahr\u00e1vek Surveillance Station a sd\u00edlen\u00e9 slo\u017eky na extern\u00edch jednotk\u00e1ch USB.<\/li>\n\n\n\n<li><strong>Nem\u011bnnost (immutability) z\u00e1vis\u00ed na modelu.<\/strong> U modelu bez nem\u011bnn\u00fdch sn\u00edmk\u016f m\u016f\u017ee \u00fato\u010dn\u00edk s pr\u00e1vy roota automatick\u00fd sn\u00edmek st\u00e1le smazat, proto jej zkombinujte s v\u00fd\u0161e uveden\u00fdm pl\u00e1nem nem\u011bnn\u00fdch sn\u00edmk\u016f.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Chcete stejn\u00e9 nastaven\u00ed?<\/strong> SynoPower Club prod\u00e1v\u00e1 origin\u00e1ln\u00ed licence pro oba stavebn\u00ed kameny: <a href=\"https:\/\/synopower.club\/cs\/virtual-dsm-vdsm-license-pack\/\">licence pro Virtual DSM (VDSM)<\/a> pro spu\u0161t\u011bn\u00ed va\u0161ich slu\u017eeb Docker v izolovan\u00e9m hostovan\u00e9m syst\u00e9mu a <a href=\"https:\/\/synopower.club\/cs\/synology-vmm-pro-license\/\">Licence VMM Pro<\/a> pro pl\u00e1ny ochrany, replikaci mezi NAS a \u017eivou migraci. Kl\u00ed\u010de jsou doru\u010dov\u00e1ny e-mailem.<\/p>\n\n\n\n<div class=\"wp-block-buttons is-content-justification-center is-layout-flex wp-container-core-buttons-is-layout-a221f4eb wp-block-buttons-is-layout-flex\" style=\"border-style:none;border-width:0px;border-radius:0px;margin-top:var(--wp--preset--spacing--50);margin-bottom:var(--wp--preset--spacing--50);padding-top:var(--wp--preset--spacing--40);padding-right:0;padding-bottom:var(--wp--preset--spacing--40);padding-left:0\">\n<div class=\"wp-block-button is-style-fill\"><a class=\"wp-block-button__link has-palette-color-4-color has-luminous-vivid-amber-background-color has-text-color has-background has-link-color wp-element-button\" href=\"https:\/\/synopower.club\/cs\/virtual-dsm-vdsm-license-pack\/\" style=\"border-radius:15px\" target=\"_blank\" rel=\"noreferrer noopener\">Z\u00edskejte licenci Virtual DSM<\/a><\/div>\n\n\n\n<div class=\"wp-block-button is-style-fill\"><a class=\"wp-block-button__link has-palette-color-4-color has-luminous-vivid-amber-background-color has-text-color has-background has-link-color wp-element-button\" href=\"https:\/\/synopower.club\/cs\/synology-vmm-pro-license\/\" style=\"border-radius:15px\" target=\"_blank\" rel=\"noreferrer noopener\">Z\u00edskejte licenci VMM Pro<\/a><\/div>\n<\/div>\n\n\n\n<h2 id=\"where-to-find-more-official-resources\" class=\"wp-block-heading\">Kde naj\u00edt dal\u0161\u00ed ofici\u00e1ln\u00ed zdroje<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">C3RB3R ransomware na Synology je v dob\u011b psan\u00ed tohoto textu ve\u0159ejn\u011b zn\u00e1m\u00fd teprve dva dny a dosud neexistuje \u017e\u00e1dn\u00e9 ofici\u00e1ln\u00ed video, proto tato sekce uv\u00e1d\u00ed prim\u00e1rn\u00ed zdroje nam\u00edsto n\u00e1vod\u016f.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.synology.com\/en-global\/company\/news\/article\/C3RB3R\" target=\"_blank\" rel=\"noreferrer noopener\">Bezpe\u010dnostn\u00ed upozorn\u011bn\u00ed Synology<\/a> z 29. \u0159\u00edjna 2026, kter\u00e9 vyz\u00fdv\u00e1 u\u017eivatele zastaral\u00fdch verz\u00ed DSM k okam\u017eit\u00e9 aktualizaci a k zapnut\u00ed automatick\u00fdch aktualizac\u00ed, po n\u011bm\u017e 30. \u0159\u00edjna n\u00e1sledoval e-mail z\u00e1kazn\u00edk\u016fm potvrzuj\u00edc\u00ed SA-24:20 jako jedinou dot\u010denou zranitelnost.<\/li>\n\n\n\n<li><a href=\"https:\/\/www.synology.com\/en-global\/security\/advisory\/Synology_SA_24_20\" target=\"_blank\" rel=\"noreferrer noopener\">Synology-SA-24:20<\/a> a <a href=\"https:\/\/www.synology.com\/en-global\/security\/advisory\/Synology_SA_26_13\" target=\"_blank\" rel=\"noreferrer noopener\">Synology-SA-26:13<\/a> jsou tabulky verz\u00ed. Zkontrolujte sv\u00e9 sestaven\u00ed v Ovl\u00e1dac\u00edm panelu v \u010d\u00e1sti Aktualizace a obnoven\u00ed v\u016f\u010di ob\u011bma.<\/li>\n\n\n\n<li><a href=\"https:\/\/github.com\/lllong1377\/c3rb3r-never-rebooted-still-no-key\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">DSM ve virtu\u00e1ln\u00edm po\u010d\u00edta\u010di Proxmox VE spou\u0161t\u011bj\u00edc\u00ed GitLab<\/a> je nejlep\u0161\u00edm p\u0159ehledem v\u0161ech zn\u00e1m\u00fdch p\u0159\u00edpad\u016f, v\u010detn\u011b t\u011bch zde neuveden\u00fdch, a nejjasn\u011bj\u0161\u00edm vysv\u011btlen\u00edm, kdy je anal\u00fdza opera\u010dn\u00ed pam\u011bti zbyte\u010dn\u00e1.<\/li>\n\n\n\n<li>T\u0159i v\u00fd\u0161e odkazovan\u00e1 vl\u00e1kna na r\/synology, zejm\u00e9na forenzn\u00ed zpr\u00e1va, kter\u00e1 krok za krokem obsahuje p\u0159\u00edkazy pro prozkoum\u00e1n\u00ed disku v re\u017eimu pouze pro \u010dten\u00ed: <a href=\"https:\/\/www.reddit.com\/r\/synology\/comments\/1xhqgov\/well_it_finally_happened_my_first_real_ransomware\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">No, kone\u010dn\u011b k tomu do\u0161lo<\/a>.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Vlastn\u00ed kontroln\u00ed seznam Synology&#8217;s (30. \u0159\u00edjna 2026)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">E-mail od spole\u010dnosti Synology z\u00e1kazn\u00edk\u016fm kon\u010d\u00ed \u010dty\u0159mi kroky. Jsou kr\u00e1tk\u00e9 a ka\u017ed\u00fd z nich m\u00e1 v boji proti ransomwaru C3RB3R smysl:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Zkontrolujte p\u0159\u00edtomnost \u00fato\u010dn\u00edk\u016f.<\/strong> Ransomware C3RB3R po sob\u011b zanech\u00e1v\u00e1 napl\u00e1novan\u00e9 zad\u00e1n\u00ed pro zaji\u0161t\u011bn\u00ed trval\u00e9ho p\u0159\u00edstupu, proto spus\u0165te kontrolu v aplikaci Security Advisor, pot\u00e9 v Pl\u00e1nova\u010di \u00faloh zkontrolujte skripty, kter\u00e9 jste nevytvo\u0159ili, a v nab\u00eddce U\u017eivatel a skupina \u00fa\u010dty spr\u00e1vce, kter\u00e9 jste nep\u0159idali. Pokud se v\u00e1m cokoli nezd\u00e1, kontaktujte Synology Support.<\/li>\n\n\n\n<li><strong>V\u0161e aktualizujte.<\/strong> Nainstalujte nejnov\u011bj\u0161\u00ed DSM v Ovl\u00e1dac\u00edm panelu v \u010d\u00e1sti Aktualizace a obnoven\u00ed a pot\u00e9 aktualizujte ka\u017ed\u00fd bal\u00ed\u010dek v Centru bal\u00ed\u010dk\u016f.<\/li>\n\n\n\n<li><strong>Zapn\u011bte automatick\u00e9 aktualizace<\/strong> v \u010d\u00e1sti Aktualizace a obnoven\u00ed, aby se budouc\u00ed bezpe\u010dnostn\u00ed opravy nainstalovaly ihned po vyd\u00e1n\u00ed.<\/li>\n\n\n\n<li><strong>Udr\u017eujte z\u00e1lohu mimo pracovi\u0161t\u011b.<\/strong> Pomoc\u00ed aplikac\u00ed Hyper Backup a Snapshot Replication udr\u017eujte kopii na jin\u00e9m m\u00edst\u011b a pravideln\u011b kontrolujte, zda se z\u00e1lohovac\u00ed \u00falohy skute\u010dn\u011b dokon\u010duj\u00ed.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Prvn\u00ed krok lid\u00e9 \u010dasto vynech\u00e1vaj\u00ed. Pokud bylo va\u0161e za\u0159\u00edzen\u00ed p\u0159\u00edstupn\u00e9 z internetu p\u0159ed opravou z prosince 2024, ransomware C3RB3R ji\u017e mohl z\u00edskat p\u0159\u00edstup a dne\u0161n\u00ed aktualizace v\u00e1m ne\u0159ekne, zda se uvnit\u0159 ji\u017e n\u011bkdo nenach\u00e1z\u00ed.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Bezplatn\u00fd n\u00e1stroj, kter\u00fd provede kontrolu za v\u00e1s<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Pokud v\u00e1m ned\u011bl\u00e1 probl\u00e9my termin\u00e1l, prvn\u00edm krokem m\u016f\u017ee b\u00fdt jedin\u00fd p\u0159\u00edkaz. synology-nas-cli je open-source n\u00e1stroj pro p\u0159\u00edkazovou \u0159\u00e1dku pod licenc\u00ed MIT, vydan\u00fd 30. \u0159\u00edjna 2026 nez\u00e1visl\u00fdm v\u00fdvoj\u00e1\u0159em jm\u00e9nem Akari Sora. P\u0159ihla\u0161uje se do DSM prost\u0159ednictv\u00edm jeho webov\u00e9ho API a kontroluje za\u0159\u00edzen\u00ed v souvislosti s touto kampan\u00ed. Projekt je na GitHubu: <a href=\"https:\/\/github.com\/akari-sora\/synology-nas-cli\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">akari-sora\/synology-nas-cli<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">P\u0159ed odkazov\u00e1n\u00edm jsme si pro\u0161li jeho k\u00f3d. Pou\u017e\u00edv\u00e1 pouze standardn\u00ed knihovnu Pythonu a nekomunikuje s ni\u010d\u00edm krom\u011b va\u0161eho NAS, stahovac\u00edho serveru Synology, PyPI a z\u00e1chrann\u00e9 sady soimy. Neodes\u00edl\u00e1 \u017e\u00e1dnou telemetrii a z\u00e1kladn\u00ed kontrola pouze \u010dte data. Zde je p\u0159ehled toho, co kontroluje:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>\u00darove\u0148 oprav.<\/strong> Va\u0161i sestavu DSM v\u016f\u010di Synology-SA-26:13, kter\u00e1 pokr\u00fdv\u00e1 i star\u0161\u00ed opravu SA-24:20, a nainstalovan\u00e9 bal\u00ed\u010dky v\u016f\u010di SA-26:14.<\/li>\n\n\n\n<li><strong>Vystaven\u00ed do internetu.<\/strong> QuickConnect, p\u0159esm\u011brov\u00e1n\u00ed port\u016f UPnP na routeru, firewall DSM, AutoBlock, SMB1 a vestav\u011bn\u00fd \u00fa\u010det admin.<\/li>\n\n\n\n<li><strong>Stopy po ransomware C3RB3R.<\/strong> Vst\u0159\u00edknut\u00e9 p\u0159ihla\u0161ovac\u00ed \u0159et\u011bzce v protokolu p\u0159ipojen\u00ed, <code>\/etc\/cron.d\/synot*<\/code> z\u00e1znamy, <code>libgld<\/code> a <code>qnetd<\/code> bin\u00e1rn\u00ed soubory, dodate\u010dn\u00e9 \u00fa\u010dty root, kl\u00ed\u010de SSH a vzkazy o v\u00fdkupn\u00e9m ve va\u0161ich sd\u00edlen\u00fdch slo\u017ek\u00e1ch.<\/li>\n\n\n\n<li><strong>Sn\u00edmky.<\/strong> Sd\u00edlen\u00e9 slo\u017eky, kter\u00e9 nemaj\u00ed funk\u010dn\u00ed pl\u00e1n sn\u00edmk\u016f.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Dok\u00e1\u017ee tak\u00e9 v\u011bt\u0161inu zji\u0161t\u011bn\u00fdch probl\u00e9m\u016f opravit. Pokud se soubory pr\u00e1v\u011b \u0161ifruj\u00ed, jeho p\u0159\u00edkaz contain zmraz\u00ed \u0161ifrovac\u00ed proces pomoc\u00ed SIGSTOP, co\u017e je stejn\u00fd krok jako druh\u00fd krok v na\u0161em seznamu prvn\u00ed pomoci. Jeho p\u0159\u00edkaz rescue n\u00e1sledn\u011b spust\u00ed sadu soimy, kter\u00e1 zachyt\u00ed pam\u011b\u0165 a vyhled\u00e1 kl\u00ed\u010d.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>nas incident                 # kontrola pouze pro \u010dten\u00ed<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Ne\u017e n\u00e1stroji dovol\u00edte cokoli zm\u011bnit, p\u0159e\u010dt\u011bte si tyto pozn\u00e1mky:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Je zcela nov\u00fd.<\/strong> Projekt je star\u00fd jen n\u011bkolik dn\u00ed, poch\u00e1z\u00ed od jednoho v\u00fdvoj\u00e1\u0159e, nen\u00ed propojen se spole\u010dnost\u00ed Synology a m\u00e1 jen mal\u00e9 mno\u017estv\u00ed extern\u00edch recenz\u00ed. Za\u010dn\u011bte kontrolou pouze pro \u010dten\u00ed a zku\u0161ebn\u00edm spu\u0161t\u011bn\u00edm (dry run).<\/li>\n\n\n\n<li><strong>Oprava firewallu v\u00e1s m\u016f\u017ee od\u0159\u00edznout od p\u0159\u00edstupu.<\/strong> P\u0159epne firewall DSM do re\u017eimu zam\u00edtnut\u00ed v\u0161eho krom\u011b s\u00edt\u00ed, kter\u00e9 uvedete. Spus\u0165te jej z po\u010d\u00edta\u010de ve stejn\u00e9 s\u00edti LAN a ujist\u011bte se, \u017ee v\u00edte, kde je tla\u010d\u00edtko RESET.<\/li>\n\n\n\n<li><strong>Vypne QuickConnect.<\/strong> To je bezpe\u010dn\u011bj\u0161\u00ed nastaven\u00ed, ale pokud va\u0161e rodina p\u0159istupuje k Synology Photos nebo Surveillance Station p\u0159es QuickConnect, nejprve nastavte VPN nebo Tailscale.<\/li>\n\n\n\n<li><strong>Hloubkov\u00e9 skenov\u00e1n\u00ed (deep), contain a rescue se spou\u0161t\u011bj\u00ed s pr\u00e1vy root.<\/strong> Funguj\u00ed prost\u0159ednictv\u00edm do\u010dasn\u00e9 \u00falohy v Pl\u00e1nova\u010di \u00faloh, proto\u017ee to je jedin\u00fd zp\u016fsob, jak \u010d\u00edst protokoly p\u0159\u00edstupn\u00e9 pouze pro root a zmrazovat procesy.<\/li>\n\n\n\n<li><strong>Soubor README doporu\u010duje p\u0159edat \u00falohu AI agentovi.<\/strong> Pokud tak u\u010din\u00edte, uchov\u00e1vejte heslo ve spr\u00e1vci hesel m\u00edsto v chatu a opravu potvr\u010fte sami.<\/li>\n\n\n\n<li><strong>Z\u00e1chrana pam\u011bti funguje pouze tehdy, kdy\u017e je \u0161ifrovac\u00ed proces st\u00e1le aktivn\u00ed.<\/strong> Plat\u00ed stejn\u00e9 pravidlo jako u t\u0159\u00ed p\u0159\u00edpad\u016f na GitHubu.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Pokud jde o zb\u00fdvaj\u00edc\u00ed \u010d\u00e1st zabezpe\u010den\u00ed, na\u0161e n\u00e1vody na <a href=\"https:\/\/synopower.club\/cs\/docs\/synology-nas-security-public-website\/\">provozov\u00e1n\u00ed ve\u0159ejn\u00e9ho webu na Synology NAS<\/a> a na <a href=\"https:\/\/synopower.club\/cs\/docs\/synology-threat-prevention-blind-spots\/\">co Threat Prevention vid\u00ed a co ne<\/a> pokr\u00fdvaj\u00ed s\u00ed\u0165ovou str\u00e1nku a <a href=\"https:\/\/synopower.club\/cs\/synology-php2shell-emergency-patch\/\">pr\u016fvodce opravou PHP2Shell<\/a> pokr\u00fdv\u00e1 druh\u00fd kritick\u00fd probl\u00e9m, kter\u00fd se objevil ve stejn\u00e9m t\u00fddnu.<\/p>\n\n\n\n<h2 id=\"c3rb3r-ransomware-limits-and-security-notes\" class=\"wp-block-heading\">Omezen\u00ed C3RB3R Ransomware a bezpe\u010dnostn\u00ed pozn\u00e1mky<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Aktualizace neodstran\u00ed st\u00e1vaj\u00edc\u00ed infekci.<\/strong> Nejm\u00e9n\u011b jedna ob\u011b\u0165 zjistila, \u017ee trval\u00e1 p\u0159\u00edtomnost v cronu z\u016fstala i po upgradu na nejnov\u011bj\u0161\u00ed DSM. Pokud jste byli vystaveni riziku bez nainstalovan\u00fdch oprav, zkontrolujte <code>\/etc\/cron.d<\/code>, Pl\u00e1nova\u010d \u00faloh, spou\u0161t\u011bc\u00ed skripty a povolen\u00e9 slu\u017eby jako telnet a pot\u00e9 zm\u011b\u0148te v\u0161echny p\u0159ihla\u0161ovac\u00ed \u00fadaje.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Aktu\u00e1ln\u00ed neznamen\u00e1 \u010dist\u00fd.<\/strong> Jedna ob\u011b\u0165 na Redditu v\u011b\u0159ila, \u017ee DSM je aktu\u00e1ln\u00ed, a dal\u0161\u00ed byla zasa\u017eena i p\u0159es aktivn\u00ed 2FA a siln\u00e9 heslo. Za\u0159\u00edzen\u00ed, kter\u00e9 bylo napadeno p\u0159ed instalac\u00ed opravy, si m\u016f\u017ee \u0161kodliv\u00fd k\u00f3d n\u00e9st skrz v\u0161echny pozd\u011bj\u0161\u00ed aktualizace. P\u0159istupujte ke ka\u017ed\u00e9 p\u0159ihla\u0161ovac\u00ed str\u00e1nce DSM p\u0159\u00edstupn\u00e9 z internetu jako k c\u00edli, v\u010detn\u011b t\u011bch, kter\u00e9 byly publikov\u00e1ny p\u0159es UPnP bez va\u0161eho v\u011bdom\u00ed. Pro vzd\u00e1len\u00fd p\u0159\u00edstup pou\u017e\u00edvejte VPN nebo Tailscale a na routeru vypn\u011bte UPnP.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>RAID a lok\u00e1ln\u00ed z\u00e1lohy nejsou z\u00e1lohy proti C3RB3R ransomware.<\/strong> Cokoli, kam napaden\u00e9 DSM m\u016f\u017ee zapisovat, bude za\u0161ifrov\u00e1no, v\u010detn\u011b c\u00edl\u016f Hyper Backup na stejn\u00e9m za\u0159\u00edzen\u00ed a p\u0159ipojen\u00fdch s\u00ed\u0165ov\u00fdch sd\u00edlen\u00ed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Nepla\u0165te p\u0159ed p\u0159e\u010dten\u00edm t\u011bchto p\u0159\u00edpad\u016f.<\/strong> Placen\u00ed provozovatel\u016fm C3RB3R ransomware financuje dal\u0161\u00ed vlnu a nic nezaru\u010duje. Pokud \u0161ifrovac\u00ed proces st\u00e1le b\u011b\u017e\u00ed, va\u0161\u00ed nejlep\u0161\u00ed \u0161anc\u00ed je cesta p\u0159es anal\u00fdzu voln\u00e9 pam\u011bti. Pokud neb\u011b\u017e\u00ed, re\u00e1lnou cestou jsou va\u0161e vlastn\u00ed z\u00e1lohy mimo dan\u00e9 za\u0159\u00edzen\u00ed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Bu\u010fte opatrn\u00ed, co vkl\u00e1d\u00e1te do AI asistenta.<\/strong> N\u00e1stroje AI zde pomohly n\u011bkolika ob\u011btem, ale nep\u0159ed\u00e1vejte jim hesla, obnoven\u00e9 kl\u00ed\u010de, \u00fapln\u00e9 v\u00fdpisy pam\u011bti ani firemn\u00ed data. Nechte je navrhnout p\u0159\u00edkazy a v\u0161e, co vy\u017eaduje opr\u00e1vn\u011bn\u00ed root, spus\u0165te sami.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Klonovan\u00fd hardware nese dodate\u010dn\u00e9 riziko.<\/strong> N\u011bkolik zdokumentovan\u00fdch ob\u011bt\u00ed provozovalo DSM na neorigin\u00e1ln\u00edm hardwaru, kde je pou\u017eit\u00ed ofici\u00e1ln\u00edch aktualizac\u00ed obt\u00ed\u017en\u00e9 nebo nemo\u017en\u00e9. Pokud je to v\u00e1\u0161 p\u0159\u00edpad, p\u0159edpokl\u00e1dejte, \u017ee nem\u00e1te nainstalovan\u00e9 opravy, a za\u0159\u00edzen\u00ed zcela odpojte od internetu.<\/p>\n\n\n\n<h2 id=\"references\" class=\"wp-block-heading\">Reference<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.synology.com\/en-global\/company\/news\/article\/C3RB3R\" target=\"_blank\" rel=\"noreferrer noopener\">Bezpe\u010dnostn\u00ed upozorn\u011bn\u00ed Synology t\u00fdkaj\u00edc\u00ed se ransomwarov\u00fdch \u00fatok\u016f na DSM<\/a>, 29. \u0159\u00edjna 2026.<\/li>\n\n\n\n<li><a href=\"https:\/\/www.synology.com\/en-global\/security\/advisory\/Synology_SA_24_20\" target=\"_blank\" rel=\"noreferrer noopener\">Synology-SA-24:20 DSM (Pwn2Own 2024)<\/a>, CVE-2024-10441 a opraven\u00e1 sestaven\u00ed DSM.<\/li>\n\n\n\n<li><a href=\"https:\/\/www.synology.com\/en-global\/security\/advisory\/Synology_SA_26_13\" target=\"_blank\" rel=\"noreferrer noopener\">Synology-SA-26:13 DSM<\/a>, CVE-2026-13639 a CVE-2026-13684, zve\u0159ejn\u011bno 18. z\u00e1\u0159\u00ed 2026.<\/li>\n\n\n\n<li><a href=\"https:\/\/github.com\/Benjamin-zlt\/c3rb3r-baremetal-rescue\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Benjamin-zlt C3RB3R ransomware bare-metal z\u00e1chrana<\/a>, form\u00e1t souboru, rozvr\u017een\u00ed kl\u00ed\u010de a postup se SIGSTOP.<\/li>\n\n\n\n<li><a href=\"https:\/\/github.com\/akari-sora\/synology-nas-cli\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">synology-nas-cli od Akari Sora<\/a>, open-source n\u00e1stroj pro kontrolu a reakci na tuto kampa\u0148.<\/li>\n\n\n\n<li><a href=\"https:\/\/www.it-connect.tech\/c3rb3r-ransomware-is-hitting-synology-nas-devices-how-to-protect-yours\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">IT-Connect ke kampani C3RB3R<\/a>, shrnuj\u00edc\u00ed atribuci 360 a \u010dasovou osu.<\/li>\n\n\n\n<li><a href=\"https:\/\/kb.synology.com\/en-global\/DSM\/tutorial\/How_to_add_extra_security_to_your_Synology_NAS\" target=\"_blank\" rel=\"noreferrer noopener\">Synology Knowledge Center: zv\u00fd\u0161en\u00ed zabezpe\u010den\u00ed va\u0161eho Synology NAS<\/a>, v\u010detn\u011b toho, jak Active Insight automaticky vytvo\u0159\u00ed sn\u00edmek sd\u00edlen\u00e9 slo\u017eky, kdy\u017e detekuje ransomware.<\/li>\n<\/ul>\n\n\n\n<h2 id=\"frequently-asked-questions\" class=\"wp-block-heading\">\u010casto kladen\u00e9 ot\u00e1zky<\/h2>\n\n\n<div id=\"rank-math-faq\" class=\"rank-math-block\">\n<div class=\"rank-math-list\">\n<div id=\"faq-1\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Co je C3RB3R ransomware?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>C3RB3R ransomware je linuxov\u00e1 varianta rodiny Cerber, kter\u00e1 od konce \u0159\u00edjna 2026 napad\u00e1 za\u0159\u00edzen\u00ed Synology NAS. P\u0159ejmenov\u00e1v\u00e1 soubory p\u0159\u00edponou L0CK3D, v ka\u017ed\u00e9 slo\u017ece zanech\u00e1v\u00e1 v\u00fdkupn\u00e9 v souboru read-me3.txt a po\u017eaduje Bitcoin prost\u0159ednictv\u00edm str\u00e1nky na s\u00edti Tor.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-2\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Jak se ransomware C3RB3R dostane do Synology NAS?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>Prost\u0159ednictv\u00edm DSM vystaven\u00e9ho do internetu. Dne 30. \u0159\u00edjna 2026 spole\u010dnost Synology potvrdila, \u017ee zneu\u017e\u00edv\u00e1 pouze zranitelnost CVE-2024-10441 z Synology-SA-24:20, opravenou v prosinci 2024, a \u017ee nesouvis\u00ed s PHP2Shell. Aktualizujte DSM, zkontrolujte skripty a \u00fa\u010dty spr\u00e1vce, kter\u00e9 jste nevytvo\u0159ili, a p\u0159esta\u0148te DSM p\u0159\u00edmo vystavovat.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-3\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Lze soubory za\u0161ifrovan\u00e9 ransomwarem C3RB3R de\u0161ifrovat zdarma?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>Pouze pokud proces \u0161ifrov\u00e1n\u00ed st\u00e1le b\u011b\u017e\u00ed. Zmrazte jej pomoc\u00ed SIGSTOP a ulo\u017ete v\u00fdpis jeho pam\u011bti, proto\u017ee rela\u010dn\u00ed kl\u00ed\u010d existuje pouze tam. Jakmile proces skon\u010d\u00ed nebo se NAS restartuje, \u017e\u00e1dn\u00fd ve\u0159ejn\u00fd n\u00e1stroj ji\u017e kl\u00ed\u010d nedok\u00e1\u017ee obnovit.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-4\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">M\u00e1m infikovan\u00fd NAS restartovat nebo vypnout?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>Ne. M\u00edsto toho p\u0159eru\u0161te s\u00ed\u0165ov\u00e9 p\u0159ipojen\u00ed. Restart nebo kill -9 zni\u010d\u00ed jedinou kopii kl\u00ed\u010de. Nejprve proces zmrazte, ulo\u017ete jeho pam\u011b\u0165 na jin\u00fd disk a teprve potom prove\u010fte vy\u010di\u0161t\u011bn\u00ed.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-5\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Odstran\u00ed aktualizace DSM ransomware C3RB3R?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>Ne. Aktualizace uzav\u0159e zranitelnost, ale neodstran\u00ed to, co u\u017e v syst\u00e9mu je. Ob\u011bti zjistily, \u017ee po upgrade p\u0159e\u017e\u00edv\u00e1 perzistence v cronu. Zkontrolujte adres\u00e1\u0159 cron.d, napl\u00e1novan\u00e9 \u00falohy a telnet a zm\u011b\u0148te v\u0161echna hesla.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-6\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Chr\u00e1n\u00ed sn\u00edmky Synology p\u0159ed ransomwarem C3RB3R?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>Nem\u011bnn\u00e9 sn\u00edmky ano, proto\u017ee je b\u011bhem obdob\u00ed uzam\u010den\u00ed nem\u016f\u017ee nikdo smazat, ani ovl\u00e1dnut\u00fd \u00fa\u010det spr\u00e1vce. Active Insight p\u0159id\u00e1v\u00e1 z\u00e1chrannou s\u00ed\u0165 t\u00edm, \u017ee p\u0159i zji\u0161t\u011bn\u00ed ransomwaru automaticky vytvo\u0159\u00ed sn\u00edmek sd\u00edlen\u00e9 slo\u017eky, a to maxim\u00e1ln\u011b jednou denn\u011b pro ka\u017edou slo\u017eku.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-7\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Pro\u010d spou\u0161t\u011bt Docker uvnit\u0159 Virtual DSM?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>Proto\u017ee sn\u00edmky virtu\u00e1ln\u00edho po\u010d\u00edta\u010de \u017eij\u00ed na hostiteli, mimo hosta. Ransomware, kter\u00fd ovl\u00e1dne hosta, je nem\u016f\u017ee vid\u011bt ani smazat, tak\u017ee obnova je ot\u00e1zkou vr\u00e1cen\u00ed zp\u011bt. VMM Pro p\u0159id\u00e1v\u00e1 replikaci na druh\u00fd NAS.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-8\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Je dobr\u00fd n\u00e1pad zaplatit v\u00fdkupn\u00e9?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>Nedoporu\u010dujeme to. Platba nezaru\u010duje fungov\u00e1n\u00ed a financuje dal\u0161\u00ed \u00fatok. Nejprve zkontrolujte p\u0159\u00edpady z\u00e1chrany na GitHubu a pot\u00e9 obnovte data z kopi\u00ed ulo\u017een\u00fdch mimo infikovan\u00fd NAS.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\"><strong>Za\u0159i\u010fte, aby v\u00e1s p\u0159\u00ed\u0161t\u00ed \u00fatok ransomwaru C3RB3R st\u00e1l jen obnovu, a ne v\u00fdkupn\u00e9.<\/strong> Spou\u0161t\u011bjte sv\u00e9 slu\u017eby Docker uvnit\u0159 Virtual DSM a chra\u0148te cel\u00e9ho hosta pomoc\u00ed pl\u00e1n\u016f ochrany VMM Pro replikovan\u00fdch na druh\u00fd NAS. SynoPower Club prod\u00e1v\u00e1 origin\u00e1ln\u00ed licence pro oboj\u00ed, s kl\u00ed\u010di doru\u010dovan\u00fdmi e-mailem.<\/p>\n\n\n\n<div class=\"wp-block-buttons is-content-justification-center is-layout-flex wp-container-core-buttons-is-layout-a221f4eb wp-block-buttons-is-layout-flex\" style=\"border-style:none;border-width:0px;border-radius:0px;margin-top:var(--wp--preset--spacing--50);margin-bottom:var(--wp--preset--spacing--50);padding-top:var(--wp--preset--spacing--40);padding-right:0;padding-bottom:var(--wp--preset--spacing--40);padding-left:0\">\n<div class=\"wp-block-button is-style-fill\"><a class=\"wp-block-button__link has-palette-color-4-color has-luminous-vivid-amber-background-color has-text-color has-background has-link-color wp-element-button\" href=\"https:\/\/synopower.club\/cs\/virtual-dsm-vdsm-license-pack\/\" style=\"border-radius:15px\" target=\"_blank\" rel=\"noreferrer noopener\">Z\u00edskejte licenci Virtual DSM<\/a><\/div>\n\n\n\n<div class=\"wp-block-button is-style-fill\"><a class=\"wp-block-button__link has-palette-color-4-color has-luminous-vivid-amber-background-color has-text-color has-background has-link-color wp-element-button\" href=\"https:\/\/synopower.club\/cs\/synology-vmm-pro-license\/\" style=\"border-radius:15px\" target=\"_blank\" rel=\"noreferrer noopener\">Z\u00edskejte licenci VMM Pro<\/a><\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>C3RB3R ransomware started showing up on Synology NAS units around 28 October 2026, and within a day it was the only topic on r\/synology. Files come back renamed with a .L0CK3D extension (a zero, not the letter O), every folder gets a read-me3.txt ransom note, and a Tor portal asks for Bitcoin. The fastest and [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":22235,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_xspeed_no_cache":false,"_xspeed_expiry_hours":0,"footnotes":""},"categories":[198],"tags":[],"class_list":["post-22234","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security"],"_links":{"self":[{"href":"https:\/\/synopower.club\/cs\/wp-json\/wp\/v2\/posts\/22234","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/synopower.club\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/synopower.club\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/synopower.club\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/synopower.club\/cs\/wp-json\/wp\/v2\/comments?post=22234"}],"version-history":[{"count":4,"href":"https:\/\/synopower.club\/cs\/wp-json\/wp\/v2\/posts\/22234\/revisions"}],"predecessor-version":[{"id":22304,"href":"https:\/\/synopower.club\/cs\/wp-json\/wp\/v2\/posts\/22234\/revisions\/22304"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/synopower.club\/cs\/wp-json\/wp\/v2\/media\/22235"}],"wp:attachment":[{"href":"https:\/\/synopower.club\/cs\/wp-json\/wp\/v2\/media?parent=22234"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/synopower.club\/cs\/wp-json\/wp\/v2\/categories?post=22234"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/synopower.club\/cs\/wp-json\/wp\/v2\/tags?post=22234"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}