Synology is urging owners of its network-attached storage (NAS) devices to update their software right away after a wave of C3RB3R ransomware attacks hit units running old versions of DiskStation Manager (DSM). The attackers are abusing a flaw the company fixed back in 2024, which means the devices being encrypted now are the ones that never got patched.
What happened
In a press release dated October 29, 2026, Synology said it had seen threat actors exploiting a vulnerability that was patched in December 2024 to go after NAS devices still running outdated DSM releases. The goal of the attacks, according to the company, is to encrypt stored data and demand a ransom. Synology told every user on a vulnerable version to update immediately and to switch on automatic updates so DSM stays current.
Public warnings like this are unusual for Synology. BleepingComputer notes that the last comparable alert came in August 2019, when a large brute-force campaign led to eCh0raix ransomware infections on Synology boxes.
The advisory followed more than two weeks of reports from home and small-business users who found their files locked. Victims described a ransom note named read-me3.txt, encrypted files renamed with a .L0CK3D extension, and instructions to buy a "C3rb3r Decryptor" through a dark web portal for thousands of dollars.
Who is affected
Any Synology NAS still running an unpatched release of DSM 7.2.2, 7.2.1, 7.2, 7.1 or 6.2 is at risk, especially if its management web interface can be reached from the internet. The Shadowserver Foundation tracks more than 380,000 Synology NAS devices exposed online, although it is not known how many of those are already patched or are research honeypots.
Technical details
Synology has not said exactly which bug the attackers are using. Its press release points readers to security advisory Synology-SA-24:20, which covers flaws first shown at the Pwn2Own 2024 hacking contest:
- CVE-2024-10441 (critical, CVSS 9.8): an output-encoding flaw in the system plugin daemon that lets remote attackers run arbitrary code without logging in.
- CVE-2024-50629 (moderate, CVSS 5.3): a flaw in the webapi component that lets remote attackers read limited files.
- CVE-2024-10445 (moderate, CVSS 4.3): an improper certificate validation bug in the update feature that lets an attacker on the same network write limited files.
The critical code execution bug is the most obvious fit for remote ransomware attacks, but that link has not been confirmed by Synology.
The C3RB3R name (also seen as Cerber or CerberImposter) borrows from an older ransomware-as-a-service operation that was active from 2016 until 2019. The newer strain has been seen since December 2021 in attacks on Atlassian Confluence and GitLab servers that exploited CVE-2021-26084, CVE-2021-22205 and CVE-2023-22518.
What you should do
Synology lists these minimum fixed versions:
- DSM 7.2.2: 7.2.2-72806-1 or later
- DSM 7.2.1: 7.2.1-69057-6 or later
- DSM 7.2: 7.2-64570-4 or later
- DSM 7.1: 7.1.1-42962-7 or later
- DSM 6.2: 6.2.4-25556-8 or later
Beyond updating, take these steps:
- Turn on automatic DSM updates, as Synology recommends.
- Block access to the DSM management interface from the internet. Use a VPN if you need to reach it remotely.
- Keep an offline or off-site backup that the NAS itself cannot overwrite, and check that snapshots are enabled.
- Look for files ending in
.L0CK3Dor aread-me3.txtnote. If you find them, disconnect the device from the network before doing anything else.
Security experts generally advise against paying ransoms, since payment does not guarantee working decryption and helps fund further attacks.
0 Comments