Synology Warns of Active C3RB3R Ransomware Attacks Exploiting Previously Patched NAS Vulnerabilities
Synology has issued an urgent security warning after identifying an ongoing wave of C3RB3R ransomware attacks targeting network-attached storage (NAS) devices running outdated versions of its DiskStation Manager (DSM) operating system. The attacks exploit a security weakness patched nearly two years ago, demonstrating how unpatched infrastructure continues to provide opportunities for ransomware operators long after fixes become available.
The Taiwanese storage manufacturer urged customers to update their NAS devices immediately and enable automatic software updates. According to the company's advisory, attackers are exploiting a vulnerability addressed in December 2024 to encrypt stored data and demand ransom payments.
The warning follows a growing number of reports from Synology customers who discovered that their files had been encrypted and renamed with the .L0CK3D extension. Victims were instructed to purchase a tool called C3rb3r Decryptor through a dark web payment portal, with reported demands reaching thousands of dollars.
The campaign is particularly concerning because NAS devices are frequently used to centralize important business documents, personal files, multimedia libraries, and backup data. When attackers compromise these systems, they may be able to encrypt large collections of information through a single vulnerable device.
Synology has confirmed that outdated DSM installations are being targeted but has not publicly identified the specific vulnerability responsible for the current attacks.
Attackers Target Security Flaws Patched in 2024
Synology's warning focuses on vulnerabilities that were already addressed through security updates released in late 2024.
The company linked its advisory to an earlier security bulletin covering several weaknesses that could allow attackers to execute arbitrary code or perform unauthorized file operations on affected devices.
The referenced vulnerabilities include:
CVE-2024-10441: A vulnerability that could permit arbitrary code execution.
CVE-2024-50629: A flaw that could allow unauthorized file reading.
CVE-2024-10445: A vulnerability associated with unauthorized file writing.
Although these flaws are documented in the referenced advisory, Synology has not confirmed which one is being exploited in the ongoing C3RB3R campaign.
That distinction matters because identifying a vulnerable software version does not necessarily establish the precise technique used by attackers.
BleepingComputer requested clarification from Synology, but a company spokesperson referred the publication back to the existing 2024 security advisory without identifying the exploited CVE.
The confirmed issue is therefore broader than a single publicly attributed exploit: attackers are successfully compromising outdated DSM installations using a previously patched security weakness.
The campaign illustrates a recurring challenge in vulnerability management. Once technical details of a vulnerability become available, attackers can continue scanning for devices that remain unpatched.
Unlike newly discovered zero-day vulnerabilities, these attacks do not necessarily require sophisticated undisclosed techniques. They may instead depend on finding systems whose owners have delayed maintenance, disabled automatic updates, or exposed administrative services directly to the internet.
Synology Identifies Minimum Patched DSM Versions
Synology recommends upgrading to the latest available DSM release rather than stopping at the earliest version containing the relevant corrections.
The security bulletin identifies the following minimum patched versions for affected release branches:
DSM 7.2.2: Version 7.2.2-72806-1 or later.
DSM 7.2.1: Version 7.2.1-69057-6 or later.
DSM 7.2: Version 7.2-64570-4 or later.
DSM 7.1: Version 7.1.1-42962-7 or later.
DSM 6.2: Version 6.2.4-25556-8 or later.
The vulnerabilities were rated critical for the DSM 7.x branches listed in the advisory, while the DSM 6.2 branch received a moderate severity classification.
These versions represent minimum remediation thresholds for the referenced security bulletin, not necessarily the most recent software available for each device.
Administrators should check Synology's official update channel and install the newest supported release appropriate for their NAS model.
Organizations operating older hardware should also verify whether their devices continue to receive security maintenance.
A NAS that cannot run a supported DSM version may require additional network isolation or eventual replacement, particularly if it stores sensitive information or remains accessible from external networks.
Synology also recommends enabling automatic updates to reduce the likelihood of similar exposure in future campaigns.
C3RB3R Encrypts Files and Demands Payment for Recovery
Reports from affected Synology customers began appearing more than two weeks before the company's public warning.
Victims described discovering encrypted files accompanied by a ransom note named read-me3.txt.
The malware appended the .L0CK3D extension to affected files, making the encryption immediately visible to users attempting to access their stored information.
The ransom note claimed that victims could recover their data only by purchasing the attackers' proprietary decryption software.
It also warned against using third-party recovery tools and offered to decrypt one file as proof that the attackers possessed a working recovery mechanism.
This approach is common in ransomware operations.
Criminal groups frequently offer limited decryption demonstrations to persuade victims that payment will restore their files. Such demonstrations do not guarantee that the full recovery process will work or that the attackers will provide reliable assistance after receiving payment.
The reported ransom demands reached thousands of dollars, although the available information does not establish a single standardized amount across all victims.
The campaign primarily concerns the availability of stored information. Public reporting has not established that every affected Synology device also suffered data theft.
That distinction is important because encryption and exfiltration are separate attacker activities.
A ransomware infection can cause substantial damage even when attackers do not steal information, particularly if the affected device contains the only accessible copies of important files.
For organizations that use NAS appliances as backup destinations, the consequences may be especially severe if attackers encrypt both production data and locally accessible backup copies.
C3RB3R Has a History of Targeting Vulnerable Enterprise Software
C3RB3R, also known as Cerber or CerberImposter, is associated with ransomware campaigns that have previously targeted vulnerable enterprise applications.
The malware borrows its name from the original Cerber ransomware operation, which emerged in 2016 and became a prominent ransomware-as-a-service threat.
However, the use of the Cerber name does not establish that the operators behind the current attacks are the same individuals responsible for the original campaign.
The more recent C3RB3R activity was first observed in December 2021.
Since then, attackers have used the ransomware against vulnerable Atlassian Confluence and GitLab installations, exploiting known security flaws to compromise servers and encrypt data.
Previous campaigns involved vulnerabilities including CVE-2021-26084 in Confluence, CVE-2021-22205 in GitLab, and CVE-2023-22518 in Confluence.
These incidents share an important characteristic with the current Synology campaign: attackers target software vulnerabilities that have already been publicly disclosed and patched.
This approach allows ransomware operators to focus on identifying exposed systems rather than developing new exploitation techniques for every target.
NAS appliances represent another attractive category of vulnerable infrastructure because they often contain large quantities of consolidated data.
For smaller businesses and individual users, a single compromised storage device may represent a substantial portion of their available information.
More Than 380,000 Synology Devices Exposed to the Internet
The Shadowserver Foundation, which monitors internet-facing infrastructure and cyber threats, was tracking more than 380,000 exposed Synology NAS devices at the time of the report.
That figure provides an indication of the potential attack surface but should not be interpreted as the number of vulnerable or compromised systems.
Shadowserver's count includes internet-visible devices without establishing whether they are running outdated DSM versions, have already received the relevant security patches, or represent research honeypots.
Nevertheless, the number illustrates why attackers may find automated scanning campaigns worthwhile.
Even if only a small percentage of exposed systems remain vulnerable, the potential target population could still be significant.
Internet exposure is particularly relevant when NAS management interfaces are reachable directly from public networks.
Administrative interfaces can provide attackers with opportunities to exploit software vulnerabilities, attempt credential attacks, or identify information about the underlying device.
Synology users are therefore advised to restrict direct internet access to DSM management services.
Remote access should be implemented through appropriately secured methods, such as a VPN, rather than exposing administrative interfaces unnecessarily.
Additional protections, including multifactor authentication and account restrictions, can reduce other forms of unauthorized access, although they do not substitute for patching a vulnerability that can be exploited without authentication.
How Synology Owners Can Reduce Their Exposure
The immediate priority is to update DSM and ensure that NAS management services are not unnecessarily accessible from the internet.
Administrators should also verify that their backup strategy can withstand an attack against the storage appliance itself.
Recommended measures include:
Install current DSM updates. Use Synology's official update mechanism to deploy the latest supported release.
Enable automatic security updates. Reduce the period between publication of a correction and its deployment.
Restrict internet exposure. Remove unnecessary port forwarding rules and avoid publicly exposing the DSM administration interface.
Review remote access. Prefer secured VPN access for administrative connections and restrict access to trusted users and devices.
Enable multifactor authentication. Protect administrator accounts against credential theft and password-based attacks.
Audit accounts and permissions. Disable unused accounts and avoid granting administrative privileges where they are not required.
Maintain isolated backups. Keep at least one backup copy that ransomware running on the NAS cannot modify or delete.
Monitor unusual activity. Investigate unexpected file renaming, large-scale file modifications, unfamiliar processes, and suspicious administrative logins.
Organizations should also review whether their NAS devices are being used simultaneously as primary storage and as the sole backup destination.
If an attacker can encrypt both the original files and every available backup, recovery may become significantly more difficult.
A resilient backup strategy should include independent copies, regular recovery testing, and appropriate separation between production credentials and backup administration.
For systems already showing signs of compromise, administrators should isolate the affected device from the network, preserve relevant logs, and avoid making unnecessary changes before assessing recovery options.
Installing a security update can close the original vulnerability, but it does not automatically decrypt files or establish that an already compromised system is trustworthy.
Why the Warning Matters
Synology's advisory is notable because the company does not frequently issue public warnings about widespread attacks targeting its customers.
A previous major warning in August 2019 followed large-scale brute-force attacks associated with eCh0raix ransomware infections.
The latest campaign differs in its reported reliance on a previously patched software vulnerability rather than primarily on password guessing.
That difference reinforces the importance of keeping storage infrastructure updated, especially when devices remain connected to the internet for years.
The attacks also demonstrate that ransomware risk is not limited to Windows workstations, corporate servers, or cloud environments.
Dedicated storage appliances can become direct targets when they expose vulnerable services and contain information valuable enough to support extortion demands.
For organizations, the consequences may include operational disruption, loss of access to shared files, expensive recovery efforts, and potentially permanent data loss when reliable backups are unavailable.
The current campaign does not require a newly discovered vulnerability to create those consequences.
Instead, it exploits the continued presence of outdated software in environments where critical data remains accessible.
A Persistent Threat From an Old Vulnerability
The C3RB3R attacks against Synology NAS devices illustrate how long-known vulnerabilities can remain operationally dangerous when security updates are not consistently deployed.
Synology has confirmed active exploitation of a weakness patched in December 2024, while customer reports describe encrypted files, .L0CK3D extensions, and ransom demands delivered through the C3rb3r Decryptor portal.
The manufacturer has not publicly identified the exact CVE exploited in the current campaign, and the number of successfully compromised devices remains unknown.
What is clear is that outdated NAS installations are being targeted and that attackers are attempting to monetize access by denying owners access to their stored information.
For Synology customers, the most effective immediate defense is to update DSM, eliminate unnecessary public exposure, and maintain backup copies that cannot be encrypted through a compromise of the NAS itself.
The broader lesson extends to every organization relying on network-connected storage: a security patch released years earlier offers little protection until it is actually installed.