Synology warns of ongoing C3RB3R ransomware attacks on unpatched NAS devices

Synology has issued a rare warning that attackers are actively deploying C3RB3R ransomware against network-attached storage (NAS) devices running outdated versions of DiskStation Manager (DSM), BleepingComputer reports. The company says the attacks are ongoing and urged customers to update immediately.

What happened

According to BleepingComputer, Synology says threat actors are exploiting an unpatched vulnerability to encrypt data on NAS devices and extort victims. Victims find a ransom note named read-me3.txt and files renamed with a .L0CK3D extension. The note warns that trying to restore files with third-party software "will be fatal" and directs victims to buy a "C3rb3r Decryptor" tool; the report says the tool is sold for thousands of dollars through a dark web portal. The first user reports appeared more than two weeks before the advisory, and the article describes a "massive wave" of reports from customers whose data was encrypted.

Technical details

The ransomware, also called Cerber or CerberImposter, borrows its name from a Ransomware-as-a-Service operation that first appeared in 2016. Synology has not said which flaw is being exploited. BleepingComputer notes Synology pointed to its November 2024 advisory Synology_SA_24_20, which covers three flaws: CVE-2024-10441 (arbitrary code execution), CVE-2024-50629 (file read) and CVE-2024-10445 (file write). The report flags a discrepancy: Synology's advisory says the exploited flaw was "patched in December 2024," which does not match the November 2024 advisory it links to, and the article does not resolve it.

Who is affected

The attacks target Synology NAS devices running outdated DSM; the article does not list specific models. Shadowserver tracks more than 380,000 internet-exposed Synology NAS devices, though it does not say how many are secured or are honeypots. BleepingComputer notes Synology rarely issues attack warnings, with its previous one dating to August 2019.

What to do

Synology says "all users running vulnerable versions" should update DSM immediately. Per the vendor's table, affected branches should move to: DSM 7.2.2-72806-1 or later, 7.2.1-69057-6 or later, 7.2-64570-4 or later, 7.1.1-42962-7 or later, and 6.2.4-25556-8 or later. Synology also advises enabling automatic updates and blocking access to the NAS management web interface from the internet. Given that attacks are ongoing, administrators should treat internet-exposed devices as a priority.