Attackers are encrypting data on Synology network-attached storage devices and demanding ransom, prompting the manufacturer to urge customers to update immediately. BleepingComputer reported on November 2 that Synology had identified attackers exploiting a vulnerability patched in December 2024 to target outdated DiskStation Manager (DSM) installations.
The warning concerns NAS owners running vulnerable DSM versions. Shadowserver tracks more than 380,000 Internet-exposed Synology NAS devices, although that figure does not distinguish patched systems or honeypots and is not a count of vulnerable devices or victims.
An older vulnerability, followed by encryption
Synology’s advisory, issued the previous week, followed a wave of customer reports describing encrypted files and demands for thousands of dollars through a dark web portal. The first reports surfaced more than two weeks before BleepingComputer’s article.
Synology said the attacks exploit a previously patched vulnerability, but had not identified the specific flaw being used. Its warning linked to a November 2024 advisory covering vulnerabilities that permit arbitrary code execution (CVE-2024-10441), file reading (CVE-2024-50629) and file writing (CVE-2024-10445) on unpatched devices. The report does not establish which of those vulnerabilities provides access in the current attacks.
Affected users reported that the ransomware adds the .L0CK3D extension to encrypted files and leaves a ransom note named read-me3.txt. Those filenames provide concrete signs for administrators investigating suspected infections.
The note directs victims to purchase a tool called “C3rb3r Decryptor” through a dark web portal. It also offers to decrypt one file free as a demonstration and claims that attempts to recover files using third-party software will damage them. Those assertions come from the attackers.
C3RB3R’s earlier targets
The ransomware, also called Cerber and CerberImposter, was first spotted in December 2021. It has previously been deployed against Atlassian Confluence and GitLab servers in attack waves exploiting remote code execution vulnerabilities CVE-2021-26084 and CVE-2021-22205, and authentication bypass vulnerability CVE-2023-22518.
C3RB3R borrowed its name from the older Cerber ransomware-as-a-service operation that emerged in 2016 and disappeared at the end of 2019. BleepingComputer described that earlier operation as having accounted for more than 80% of ransomware attacks and a quarter of ransomware infections on enterprise endpoints.
Synology rarely issues warnings about attacks against its customers. Its previous such alert, in August 2019, concerned large-scale brute-force attacks that led to eCh0raix ransomware infections.
Updates and Internet access restrictions
Synology urges users running vulnerable versions to update DSM immediately and enable automatic updates. BleepingComputer also advises owners to block Internet access to the management web interface.
The report lists these fixed releases for the respective DSM trains:
| DSM release train | Fixed release |
|---|---|
| DSM 7.2.2 | 7.2.2-72806-1 or later |
| DSM 7.2.1 | 7.2.1-69057-6 or later |
| DSM 7.2 | 7.2-64570-4 or later |
| DSM 7.1 | 7.1.1-42962-7 or later |
| DSM 6.2 | 6.2.4-25556-8 or later |
The linked advisory rates the issues critical for the listed DSM 7.x trains and moderate for DSM 6.2. Owners should install the latest DSM version available for their devices and enable automatic updates, as Synology recommends.
