Synology NAS Under Siege: C3RB3R Ransomware Strikes Unpatched Devices
Synology has warned customers about an ongoing wave of ransomware attacks targeting network-attached storage (NAS) devices running outdated versions of DiskStation Manager (DSM). The attacks have been associated with C3RB3R ransomware, a threat capable of encrypting stored files and demanding payment for their recovery.
Summary
Synology has warned customers about an ongoing wave of ransomware attacks targeting network-attached storage (NAS) devices running outdated versions of DiskStation Manager (DSM). The attacks have been associated with C3RB3R ransomware, a threat capable of encrypting stored files and demanding payment for their recovery.
According to reports published in November 2026, affected Synology NAS owners discovered their files encrypted with the .L0CK3D extension and ransom notes named read-me3.txt. The attackers demand payment for a decryption utility advertised as the C3rb3r Decryptor.
Synology confirmed that threat actors are exploiting a vulnerability patched in December 2024 to compromise devices running outdated DSM versions. However, the company has not publicly identified the exact vulnerability responsible for these attacks.
What Is C3RB3R Ransomware?
C3RB3R, also referred to as CerberImposter, is a ransomware threat associated with attacks against vulnerable enterprise infrastructure. It uses the Cerber name, which was previously associated with a prominent ransomware-as-a-service operation active during the 2010s. The shared name does not establish that the current operators are the same individuals behind the original Cerber operation.
C3RB3R activity has previously been reported against vulnerable Atlassian Confluence and GitLab servers. Earlier campaigns were associated with exploitation of vulnerabilities including CVE-2021-26084, CVE-2021-22205, and CVE-2023-22518.
The latest campaign demonstrates how attackers can extend ransomware operations to NAS infrastructure. Such systems frequently store centralized business documents, application data, shared files, and backup copies, making them attractive targets for financially motivated threat actors.
How Does the C3RB3R Ransomware Attack Work?
The reported attacks begin with vulnerable Synology NAS devices running outdated DSM software. Synology has confirmed exploitation of a patched vulnerability, but the exact initial-access mechanism and complete execution sequence have not been publicly established.
Based on confirmed outcomes and reported victim observations, the following diagram illustrates the high-level attack sequence. Intermediate stages are presented conceptually rather than as a fully verified forensic reconstruction.
C3RB3R Ransomware Attack Flow
Attackers identify reachable NAS infrastructure running outdated DSM software.
Attackers exploit a DSM vulnerability. The exact CVE used in the vendor-confirmed campaign remains undisclosed.
The compromised device provides an opportunity for malicious activity and ransomware execution.
The ransomware encrypts accessible files and appends the .L0CK3D extension.
The attackers leave read-me3.txt instructions directing victims toward a paid decryption service.
Victims lose access to affected files and face ransom demands for recovery.
Vulnerabilities Associated with the Attacks
| CVE ID | CVSS | EPSS | Vulnerability Type | Affected Versions |
|---|---|---|---|---|
| CVE-2024-10441 | 9.8 | 1.25% | Improper Encoding or Escaping of Output (Remote Code Execution) | Synology DSM before 7.2-64570-4, 7.2.1-69057-6, and 7.2.2-72806-1. |
| CVE-2024-50629 | 5.3 | 34.81% | Improper Encoding or Escaping of Output (Information Disclosure) | Synology DSM before 7.1.1-42962-7, 7.2-64570-4, 7.2.1-69057-6, and 7.2.2-72806-1. |
| CVE-2024-10445 | 4.3 | 0.38% | Improper Certificate Validation (Unauthorized File Write) | Synology DSM before 6.2.4-25556-8, 7.1.1-42962-7, 7.2-64570-4, 7.2.1-69057-6, and 7.2.2-72806-1. |
Separate reporting has associated the broader Synology ransomware activity with CVE-2026-13639 and CVE-2026-13684, vulnerabilities addressed in Synology-SA-26:13. However, this attribution has not been reconciled with Synology's statement concerning a vulnerability patched in December 2024.
Administrators should review both relevant advisories when assessing potentially exposed systems, but should not assume that all reported infections share the same initial-access vulnerability.
Affected Products and Versions
The reported campaign targets Synology NAS devices running vulnerable DSM releases. The following table lists the minimum fixed versions identified in the Synology-SA-24:20 advisory.
| Product | Minimum Fixed Release | Severity in Advisory |
|---|---|---|
| Synology DSM 7.2.2 | 7.2.2-72806-1 or later | Critical |
| Synology DSM 7.2.1 | 7.2.1-69057-6 or later | Critical |
| Synology DSM 7.2 | 7.2-64570-4 or later | Critical |
| Synology DSM 7.1 | 7.1.1-42962-7 or later | Critical |
| Synology DSM 6.2 | 6.2.4-25556-8 or later | Moderate |
These versions address the vulnerabilities documented in the 2024 advisory. They should not be interpreted as the latest available DSM releases or as sufficient protection against every subsequently disclosed vulnerability. Organizations should deploy the newest supported and applicable security updates for their devices.
Indicators of Compromise (IOCs)
The following indicators have been reported in connection with the C3RB3R ransomware activity affecting Synology NAS devices.
| Indicator | Classification |
|---|---|
.L0CK3D |
Encrypted-file extension |
read-me3.txt |
Ransom-note filename |
C3rb3r Decryptor |
Ransomware-related artifact |
a1375e0f82ae86df528876c049b5a23c |
Reported MD5 sample hash |
c3rb3rpwdyq7bzofesaet7g3vrvnu7g26qfz3skqwseykudiodkwoqid[.]onion |
Reported Tor payment portal |
Detection Opportunities
- • Search NAS storage volumes for files ending in
.L0CK3D. - • Identify newly created
read-me3.txtfiles in shared directories. - • Investigate unexpected bulk file renaming or encryption-like modification activity.
- • Review DSM authentication and access logs for suspicious connections and unauthorized activity.
- • Investigate unexpected administrative account creation, permission changes, or remote-access configuration changes.
- • Correlate unusual file activity with management-interface exposure and known vulnerable DSM versions.
MITRE ATT&CK Mapping
The following MITRE ATT&CK techniques describe plausible behaviors associated with the observed ransomware outcomes and potential intrusion stages. Only data encryption for impact is directly supported by the reported file-encryption activity; other mappings are investigative hypotheses rather than confirmed forensic observations of this specific campaign.
| Technique ID | MITRE ATT&CK Technique | Relevance | Evidence Status |
|---|---|---|---|
| T1190 | Exploit Public-Facing Application | Exploitation of a reachable, vulnerable DSM service may provide initial access. | Consistent with vendor-confirmed vulnerability exploitation; exact entry point undisclosed |
| T1486 | Data Encrypted for Impact | Files are encrypted and made inaccessible to their owners. | Supported by reported victim observations |
| T1490 | Inhibit System Recovery | Attackers may attempt to prevent restoration through backups or recovery mechanisms. | Not independently confirmed for this campaign |
Why Are Synology NAS Devices Attractive Ransomware Targets?
Network-attached storage devices often hold information essential to business continuity. They may function as centralized file repositories, collaboration storage, backup destinations, and archives for important operational data.
A successful ransomware attack against a NAS device can therefore affect multiple users and services simultaneously, even when the attackers have not compromised each individual workstation.
The risks become greater when administrators expose DSM management interfaces directly to the public internet, delay security updates, reuse administrative credentials, or maintain backups on the same storage infrastructure without additional protection.
RAID redundancy does not provide complete ransomware protection. Although RAID can improve resilience against certain hardware failures, it does not prevent malicious encryption of accessible files.
Mitigation and Recommended Security Measures
• Update Synology DSM to the latest supported security release and review relevant advisories.
• Restrict DSM management access to trusted networks or a secure VPN; remove unnecessary public exposure.
• Enable multifactor authentication, use unique credentials, and apply least-privilege access.
• Maintain isolated, offline or immutable backups and regularly test restoration.
• Monitor for .L0CK3D, read-me3.txt, suspicious logins, and unexpected file modifications.
• Isolate suspected compromised NAS devices, preserve evidence, and rotate exposed credentials.
Instantly Fix Risks in Endpoints & Cloud with Saner
Saner is a continuous and integrated vulnerability & exposure management platform that instantly fixes risks in endpoints and cloud.
