Taiwanese network-attached storage (NAS) maker Synology has issued a rare security advisory warning customers of a surge in C3RB3R ransomware attacks targeting devices running outdated versions of its DiskStation Manager (DSM) software. The company said threat actors are exploiting a vulnerability patched in December 2024 to encrypt data and demand ransom.
The advisory, published on Thursday, urged users to enable automatic updates and upgrade DSM to the latest version. "Synology has identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM," the company said. "These attacks aim to encrypt data and extort ransom." Synology also recommended blocking access to the management web interface from the internet to block attackers' attempts to hack and encrypt their devices.
While Synology has not disclosed which specific vulnerability is being exploited, it linked to a November 2024 security advisory detailing three vulnerabilities that could allow attackers to execute arbitrary code (CVE-2024-10441), read files (CVE-2024-50629), and write files (CVE-2024-10445).
The ransomware, known as C3RB3R or CerberImposter, was reported by affected users to encrypt files and append the .L0CK3D extension. Affected users reported receiving a ransom note demanding payment for a "C3rb3r Decryptor" tool for thousands of dollars. The note warns victims not to attempt third-party recovery. "Any attempts to restore your files with third-party software will be fatal for your files," it states.
The C3RB3R ransomware borrows its name from the Cerber ransomware operation, which was a dominant ransomware-as-a-service operation from 2016 until its disappearance in 2019. Starting in December 2021, C3RB3R was also deployed in attacks targeting Atlassian Confluence and GitLab servers.
Synology rarely issues such warnings; its last advisory about an attack wave was in August 2019, following large-scale brute-force attacks that led to eCh0raix ransomware infections. Internet watchdog Shadowserver is tracking over 380,000 internet-exposed Synology NAS devices, though it does not indicate how many are secured or are honeypots.
The front page in your inbox each weekday morning: the lead, the picks, and why each one earned its place.
§
Analysis
Why This Matters
The attack targets network-attached storage devices, often used by businesses and individuals to store critical data, making the potential impact severe.
With hundreds of thousands of devices exposed online, the window for attackers remains large, and users who delay updates risk permanent data loss.
The resurgence of a ransomware name from the 2010s shows that older malware strains can be repurposed for new attacks, highlighting the importance of proactive patching.
Background
Synology is a leading manufacturer of NAS appliances, commonly used for file storage, backup, and media serving. Cerber ransomware was a prolific Ransomware-as-a-Service operation that emerged in 2016 and accounted for a majority of ransomware attacks by the end of the decade before disappearing in 2019. The current C3RB3R variant appears to be a separate operation carrying the same name, first observed in 2021 targeting Atlassian Confluence and GitLab servers.
What to Watch
Synology may release a more detailed advisory naming the specific vulnerability under attack.
The number of reported infections could increase as more users become aware and update their devices.
Law enforcement or cybersecurity agencies may issue broader warnings about the ransomware strain.
12 claims in this story checked against 1 source: 12 supported.
Show each claim
SupportedSynology warned customers about C3RB3R ransomware attacks targeting NAS devices and urged immediate DSM updates.BleepingComputer: “Synology warned customers to update their devices immediately due to a surge in C3RB3r ransomware attacks. The company urged users to enable automatic updates and upgrade the DiskStation Manager (DSM) software”
SupportedThe advisory pointed to a surge in attacks exploiting a vulnerability patched in December 2024.BleepingComputer: “Synology warned customers to update their devices immediately due to a surge in C3RB3r ransomware attacks. “Synology has identified threat actors exploiting a vulnerability patched in December 2024”
SupportedMore than 380,000 internet-exposed Synology NAS devices are being tracked.BleepingComputer: “Internet threat watchdog Shadowserver now tracks over 380,000 Internet-exposed Synology NAS devices”
SupportedSynology issued a rare security advisory about a surge in ransomware attacks targeting outdated DSM devices.BleepingComputer: “Synology rarely issues security advisories warning of attacks targeting its customers' devices”
SupportedSynology said threat actors were exploiting a vulnerability patched in December 2024 to target outdated DSM devices.BleepingComputer: ““Synology has identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM. These attacks aim to encrypt data and extort ransom,” it said”
SupportedSynology said the attacks aimed to encrypt data and extort ransom.BleepingComputer: ““These attacks aim to encrypt data and extort ransom,” it said”
SupportedThe advisory was published on Thursday and urged users to enable automatic updates and upgrade DSM to the latest version.BleepingComputer: “The company urged users to enable automatic updates and upgrade the DiskStation Manager (DSM) software running on their NAS devices to the latest version”
SupportedSynology recommended blocking internet access to the management web interface to hinder attempts to hack and encrypt devices.BleepingComputer: “Synology users are advised to immediately block access to the management web interface from the Internet and update their DSM software to block attackers' attempts to hack and encrypt their devices.”
SupportedSynology had not disclosed which specific vulnerability was being exploited, and linked to a November 2024 advisory listing three vulnerabilities and their effects.BleepingComputer: “While Synology has yet to share which vulnerability is being exploited in these ongoing attacks, it linked to a November 2024 security advisory with information about patches released for vulnerabilities allowing attackers to execute arbitrary code (CVE-2024-10441), read files (CVE-2024-50629), and write files (CVE-2024-10445)”
SupportedAffected users reported that the ransomware encrypted files and appended the .L0CK3D extension.BleepingComputer: “affected users saying the ransomware dropped a ransom note (read-me3.txt) and added a .L0CK3D extension to encrypted files.”
SupportedAffected users reported a ransom demand for a “C3rb3r Decryptor” tool costing thousands of dollars.BleepingComputer: “Last week's advisory follows a massive wave of reports from Synology customers whose data was encrypted and who were prompted to buy “C3rb3r Decryptor” tool from a dark web portal for thousands of dollars.”
SupportedThe ransom note says attempts to restore files with third-party software would be fatal for the files.BleepingComputer: ““All your important files have been encrypted. Any attempts to restore your files with thrid-party software will be fatal for your files! The only way to decrypt your files safely is to buy the special decryption software 'C3rb3r Decryptor',” the ransom note warns.”
