Overview
Synology has warned customers to update their NAS devices immediately after a surge in C3RB3R (Cerber) ransomware attacks against units running outdated DSM (DiskStation Manager) versions. It is only the second Synology alert about attacks on customer devices; the first was in August 2019 during the eCh0raix campaign.
C3RB3R was first seen in December 2021, when it targeted Atlassian Confluence and GitLab servers.
Attack Vector
Synology says attackers are exploiting a flaw it patched in December 2024 but has not named it. It points to advisory Synology_SA_24_20, which covers:
| CVE | Impact |
|---|---|
| CVE-2024-10441 | Arbitrary code execution |
| CVE-2024-50629 | Arbitrary file read |
| CVE-2024-10445 | Arbitrary file write |
Fixed Versions
| DSM Branch | Fixed In |
|---|---|
| 7.2.2 | 7.2.2-72806-1 or later |
| 7.2.1 | 7.2.1-69057-6 or later |
| 7.2 | 7.2-64570-4 or later |
| 7.1 | 7.1.1-42962-7 or later |
| 6.2 | 6.2.4-25556-8 or later |
Ransomware Indicators
- Encrypted files get the
.L0CK3Dextension - The ransom note is
read-me3.txt - The note demands payment, in the thousands of dollars, for a "C3rb3r Decryptor" sold via a dark web portal
- It warns that third-party recovery software will destroy files and offers one file decrypted for free as proof
Exposure
Shadowserver tracks more than 380,000 internet-exposed Synology NAS devices. It is unclear how many are unpatched or are honeypots.
Recommended Actions
- Update DSM to a fixed version and enable automatic updates
- Block internet access to the management web interface; use a VPN for remote administration
- Keep offline or immutable backups of NAS data
- Check devices for the indicators above