- What: Synology warned that threat actors are exploiting a DSM vulnerability patched in December 2024 to deploy C3RB3R ransomware on outdated NAS devices.
- Impact: Encrypted files get a .L0CK3D extension and a read-me3.txt ransom note pointing to a paid 'C3rb3r Decryptor', and Shadowserver tracks more than 380,000 Synology NAS devices exposed to the internet.
- Fix / mitigation: Synology says to update DSM immediately (for example 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4 or 7.1.1-42962-7 and later), turn on automatic updates and block internet access to the management web interface; the linked advisory covers CVE-2024-10441, CVE-2024-50629 and CVE-2024-10445.
- Who's at risk: Any organization or individual running DSM 7.2.2, 7.2.1, 7.2, 7.1 or 6.2 below the fixed builds, especially with the management interface reachable from the internet.
Synology has issued a security advisory warning customers that C3RB3R ransomware is being used against network-attached storage devices running outdated versions of DiskStation Manager (DSM). The company says the attackers are exploiting a vulnerability it patched in December 2024, which means every device hit in this wave had a fix available for close to two years. Shadowserver currently tracks more than 380,000 Synology NAS devices exposed to the internet. It does not say how many are patched and how many are honeypots, but the possible target pool is large.
Synology rarely puts out advisories like this. The last one came in August 2019, after large-scale brute-force attacks led to eCh0raix ransomware infections. This advisory followed a wave of customer reports that began more than two weeks earlier, from users whose data had already been encrypted.
What Synology Has Disclosed
In its Thursday advisory, Synology said: "Synology has identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM. These attacks aim to encrypt data and extort ransom." The company has not said which vulnerability is being exploited. The advisory links to an earlier Synology security bulletin, published in November 2024, that covers three DSM flaws:
- CVE-2024-10441: arbitrary code execution on unpatched devices
- CVE-2024-50629: arbitrary file read
- CVE-2024-10445: arbitrary file write
Synology has not confirmed which of these, alone or chained, is behind the C3RB3R intrusions. A code execution bug sitting next to file read and file write primitives gives an attacker several ways to get a foothold and stage an encryptor. Until Synology says more, defenders should assume any of the three could be the entry point. The company did not respond to BleepingComputer's request for details before publication.
DSM 7.2.2: 7.2.2-72806-1 or above (Critical). DSM 7.2.1: 7.2.1-69057-6 or above (Critical). DSM 7.2: 7.2-64570-4 or above (Critical). DSM 7.1: 7.1.1-42962-7 or above (Critical). DSM 6.2: 6.2.4-25556-8 or above (Moderate). Any device below these builds is in scope for the current campaign.
What Victims See
Affected users describe the same pattern. Files are encrypted and renamed with a .L0CK3D extension, and a ransom note called read-me3.txt is left on the device. The note tells victims that the only safe way to recover is to buy a tool called "C3rb3r Decryptor" through a dark web portal, and it offers to restore one file for free to prove the decryptor works. Victims report demands in the thousands of dollars.
The note also warns that using third-party recovery tools "will be fatal for your files." That line is standard extortion pressure meant to stop victims from trying other recovery paths before they pay. For organizations that use Synology NAS units as file shares or backup targets, the bigger risk is losing the backup tier entirely, which takes away the recovery option most ransomware response plans depend on.
Who Is Behind C3RB3R
C3RB3R, also tracked as Cerber and CerberImposter, takes its name from the Cerber ransomware-as-a-service operation that appeared in 2016. That original Cerber was one of the most active families of its time. It accounted for more than 80% of ransomware attacks and about a quarter of ransomware infections on enterprise endpoints before it disappeared at the end of 2019. The current strain borrows the name, but nothing in the reporting links it to the original operators.
C3RB3R was first seen in December 2021 and has a history of going after internet-facing server software with known, patched bugs. Earlier waves targeted:
- Atlassian Confluence through CVE-2021-26084 (remote code execution)
- GitLab through CVE-2021-22205 (remote code execution)
- Atlassian Confluence through CVE-2023-22518 (authentication bypass)
The Synology campaign fits that pattern. The operators wait for a public, patched vulnerability in widely deployed edge software and then work through the long tail of systems nobody has updated. They do not need a zero-day. They only need patching to lag.
Why NAS Devices Keep Getting Hit
NAS appliances often get treated as appliances and not as servers. They sit in closets and branch offices, sometimes get set up by a vendor or a single administrator, and then go untouched for years. Remote access features and port forwarding often leave the DSM management interface open to the internet so staff can reach files from outside the office. That combination of an exposed management plane, irregular patching and high-value data is why NAS devices keep showing up in ransomware campaigns, from eCh0raix in 2019 to C3RB3R now.
The 23-month gap between the patch and this exploitation wave is the main takeaway. Organizations that run NAS hardware outside their normal patch management process are carrying vulnerabilities that attackers can easily find with internet scanning.
Synology tells customers to update DSM to the latest version right away and to turn on automatic updates so DSM stays current. Guidance accompanying the advisory also says to block internet access to the DSM management web interface. Synology has not published indicators of compromise or a decryptor.
RedEye Assessment
This is opportunistic, high-volume extortion that relies on patch debt, not new tradecraft. The open questions are which CVE is being exploited, whether attackers took data before encrypting it, and how many of the 380,000 exposed devices are still vulnerable. Synology has answered none of them. Until it does, any organization with Synology storage in its environment should assume an unpatched, internet-facing unit has already been probed. RedEye can assess NAS and edge-device exposure across your environment, confirm patch status against the fixed DSM builds, and review whether your backup architecture would survive the loss of a compromised storage tier.
Questions about your exposure?
RedEye Security provides assessments for organizations that need to understand their real risk.
Talk to us