Synology warns of C3RB3R ransomware attacks targeting NAS devices

Taiwanese network-attached storage (NAS) appliance maker Synology has issued an urgent security warning to its customers. The advisory urges users to update their devices immediately following a noticeable surge in targeted C3RB3r ransomware attacks.

• Synology identified threat actors exploiting vulnerabilities patched back in December 2024 on outdated DSM versions.
• Attackers are encrypting victim data and extorting ransom payments through a dark web portal.
• Users are strongly urged to enable automatic updates and block management web interface access from the public internet.

Attack details and exploited vulnerabilities

Synology rarely issues security advisories targeting customer devices, with the last alert published back in August 2019 following eCh0raix ransomware infections. According to the latest advisory, threat actors are exploiting flaws allowing remote code execution (CVE-2024-10441), file reading (CVE-2024-50629), and file writing (CVE-2024-10445) on unpatched systems.

Victims report that the ransomware appends a .L0CK3D extension to encrypted files and drops a ransom note named read-me3.txt. The note warns that attempting third-party recovery will permanently destroy files and demands thousands of dollars for the special "C3rb3r Decryptor" tool via a dark web portal.

Background of C3RB3R and overall exposure scale

The ransomware variant targeting Synology NAS devices borrows its name from a notorious Ransomware-as-a-Service operation active between 2016 and 2019. The newer C3RB3R variant has also previously targeted Atlassian Confluence and GitLab servers by exploiting remote execution and authentication bypass flaws.

Internet threat monitoring organization Shadowserver currently tracks over 380,000 internet-exposed Synology NAS devices worldwide. While the exact number of already compromised appliances remains unclear, the potential attack surface is exceptionally large.

Essential security steps for NAS owners

To protect valuable data from being locked or permanently lost, Synology advises administrators to implement security patches instantly. The primary mitigation step is upgrading DiskStation Manager (DSM) to the latest version and enabling automatic updates for continuous protection.

Additionally, users should immediately restrict access to the management web interface from the open internet. Securing network access points helps block unauthorized intrusion attempts and thwarts ongoing ransomware encryption campaigns.