Synology warns of C3RB3R ransomware attacks on NAS devices

Synology says attackers are exploiting a vulnerability patched in December 2024 to target NAS devices running outdated versions of its DiskStation Manager (DSM) software. The company says the attacks aim to encrypt data and demand ransom.

In a Thursday advisory, Synology urged users of vulnerable DSM versions to update immediately and enable automatic updates. The company has not identified which vulnerability is being exploited. It linked to a November 2024 advisory covering patches for flaws that could let attackers execute code, read files or write files on unpatched devices.

BleepingComputer reports that Synology customers have recently said their data was encrypted and they were prompted to buy a “C3rb3r Decryptor” from a dark web portal. Affected users reported a ransom note named read-me3.txt and the .L0CK3D extension on encrypted files. Synology has not confirmed the connection between those reports and the attacks in its advisory.

The Cerber ransomware used in the attacks is also known as C3RB3R and CerberImposter. It is distinct from a namesake ransomware operation that emerged in 2016 and disappeared at the end of 2019. Shadowserver tracks more than 380,000 internet-exposed Synology NAS devices, but says it cannot determine how many are secured against these attacks or are honeypots.