Synology warns of C3RB3R ransomware hitting exposed NAS

Synology is warning that threat actors are encrypting internet-exposed NAS devices running DiskStation Manager with the C3RB3R ransomware, a Cerber variant. Victims report files renamed with a .L0CK3D extension and a ransom note named read-me3.txt pointing to a dark-web decryptor for sale. If you run a Synology NAS reachable from the internet on an out-of-date DSM, update it now.

Synology published its statement on October 29; BleepingComputer reported the attacks and the affected-version table.

What Synology says is being exploited

Synology attributes the intrusions to a vulnerability it patched in 2024, pointing owners to its advisory Synology-SA-24:20. Synology has not named a single CVE in its public statement. Worth flagging for readers tracking root cause: reporting around the campaign has surfaced competing accounts of the exact entry point, with at least one security vendor pointing to more recent DSM flaws rather than the 2024 fix. Synology has not confirmed that alternative, so we're attributing the entry point as Synology states it and flagging the disagreement rather than picking a winner.

Either way, the remediation is the same: patch and stop exposing the management interface.

Affected and fixed versions

Per Synology's advisory, as reported by BleepingComputer, update to at least:

• DSM 7.2.2 → 7.2.2-72806-1
• DSM 7.2.1 → 7.2.1-69057-6
• DSM 7.2 → 7.2-64570-4
• DSM 7.1 → 7.1.1-42962-7
• DSM 6.2 → 6.2.4-25556-8

Exploitation status

Confirmed in the wild, per Synology's own advisory and victim reports collected by BleepingComputer forum and Reddit threads. Shadowserver tracks more than 380,000 internet-exposed Synology NAS devices — the population at risk if the exposed management interface meets an unpatched build.

Action checklist

1. Update DSM to the fixed build for your branch (above), and turn on automatic updates.
2. Take the NAS management interface off the internet. No DSM admin UI should be directly reachable; put it behind a VPN or reverse proxy with authentication.
3. Verify your backups are offline or immutable. C3RB3R targets the device that often is the backup; a NAS-resident backup is no backup against this.
4. If already hit, do not pay first. Preserve the read-me3.txt note and a sample of .L0CK3D files, isolate the device, and check whether a free decryptor exists for your Cerber variant before anything else.

Context

NAS appliances remain a favourite ransomware target for the same reason edge VPNs are: they sit on the internet, hold the data that matters, and often run firmware their owners forgot to patch. The recurring lesson — don't expose the admin plane — is boring precisely because it keeps working. A box patched in 2024 and kept off the public internet is not in this story.