Synology warns of C3RB3R ransomware attacks on NAS devices

Synology published an advisory on Thursday warning that C3RB3R ransomware is being used against its NAS devices, and told customers to update DiskStation Manager immediately. BleepingComputer reported the warning on November 2.

"Synology has identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM," the advisory says. The company didn't name the flaw. It linked to a November 2024 advisory covering patches for arbitrary code execution, file read and file write bugs, but the article doesn't say which of those is in play.

The advisory gives fixed DSM builds per branch, from 7.2.2-72806-1 upward for DSM 7.2.2 down to 6.2.4-25556-8 for DSM 6.2, and recommends turning on automatic updates.

Customer reports came first. Victims said the ransomware left a note named read-me3.txt and appended .L0CK3D to encrypted files, with a portal selling a "C3rb3r Decryptor" for thousands of dollars. The name borrows from the old Cerber operation, which shut down at the end of 2019; this C3RB3R was first spotted in December 2021, previously deployed against Atlassian Confluence and GitLab servers.

Shadowserver tracks over 380,000 internet-exposed Synology NAS devices, though it doesn't say how many are patched or are honeypots.

Synology's own advice is the place to start: get the management interface off the internet, then update. We'd check that second part before trusting a box that's been reachable from outside.