Synology has warned customers that C3RB3R ransomware attackers are targeting NAS devices running outdated DiskStation Manager software. The company urged users to install updates immediately after identifying attacks that exploit a vulnerability it patched in December 2024.
Attackers Exploit an Older DSM Security Flaw
According to Synology, the attackers aim to encrypt stored data and demand payment for its recovery. The company recommends upgrading DSM and enabling automatic updates to maintain protection. However, it has not identified the specific vulnerability behind the ongoing campaign.
Instead, Synology linked its warning to a November 2024 security advisory covering three vulnerabilities. These include CVE-2024-10441, which allows arbitrary code execution, and CVE-2024-50629, which enables file reading. The advisory also covers CVE-2024-10445, a weakness that permits file writing.
Although the linked advisory provides relevant patch information, it does not establish which flaw the attackers currently exploit. Consequently, the warning leaves part of the technical attack path undisclosed. The confirmed concern involves devices that still lack the necessary DSM security updates.
C3RB3R Ransomware Encrypts Files and Demands Payment
The warning follows numerous customer reports describing encrypted files and demands for thousands of dollars. Affected users said the malware added the .L0CK3D extension to their files. It also left a ransom note named read-me3.txt.
The note directs victims to a dark web portal offering a tool called C3rb3r Decryptor. Additionally, the attackers offer to decrypt one file free of charge as a demonstration. Their message also attempts to discourage victims from using third-party recovery software.
Those statements come from the attackers and do not independently establish that purchasing their software will restore the data. Meanwhile, the customer reports indicate that the campaign had already been active for more than two weeks before the November 2 report. Synology has not provided a confirmed victim count.
Synology Lists Fixed DSM Releases
Users should remove public internet access to the NAS management interface and install the appropriate DSM update. The referenced advisory lists the following minimum fixed releases. However, Synology’s broader recommendation is to run the latest available DSM version for the device.
| DSM branch | Minimum fixed release |
|---|---|
| DSM 7.2.2 | 7.2.2-72806-1 |
| DSM 7.2.1 | 7.2.1-69057-6 |
| DSM 7.2 | 7.2-64570-4 |
| DSM 7.1 | 7.1.1-42962-7 |
| DSM 6.2 | 6.2.4-25556-8 |
The advisory rates the issues as critical for the listed DSM 7 branches and moderate for DSM 6.2. Meanwhile, automatic updates can help prevent devices from remaining on older software. Restricting management access also reduces the exposure of an administrative interface to internet-based attackers.
Hundreds of Thousands of Devices Are Internet-Accessible
Shadowserver tracks more than 380,000 internet-exposed Synology NAS devices. However, that total does not represent a confirmed count of vulnerable systems. The data does not establish how many devices have received patches or how many are honeypots.
C3RB3R ransomware, also called Cerber or CerberImposter, previously targeted Atlassian Confluence and GitLab servers. Researchers first observed this newer operation in December 2021, and subsequent campaigns exploited server vulnerabilities. Although it uses the Cerber name, it is distinct from the older ransomware operation that emerged in 2016.
0 responses to “C3RB3R Ransomware Targets Outdated Synology NAS Devices”