Skip to content

Back to the catalog

Synology warns of C3RB3R ransomware attacks targeting NAS devices
bleepingcomputer.comarticle

Synology warns of C3RB3R ransomware attacks targeting NAS devices

C3RB3R (Cerber) ransomware is encrypting Synology NAS devices running outdated DiskStation Manager, and Synology issued an advisory urging immediate updates. The attacks exploit a vulnerability patched in December 2024, likely among CVE-2024-10441, CVE-2024-50629 and CVE-2024-10445 from a November 2024 advisory. Victims get a read-me3.txt note and .L0CK3D extension. Shadowserver tracks over 380,000 exposed Synology NAS devices.

TL;DR Synology warns that C3RB3R ransomware is hitting unpatched DSM NAS devices and tells users to update and block internet access to the management interface.
Open original ↗
Document

What it is

Synology issued an advisory warning that attackers are exploiting a vulnerability patched in December 2024 to encrypt data on NAS devices running outdated DiskStation Manager (DSM). The ransomware is C3RB3R (also called Cerber or CerberImposter). Victims are told to buy a "C3rb3r Decryptor" from a dark web portal for thousands of dollars. Synology rarely issues advisories about attacks on its customers. Its previous one was in August 2019, after brute-force attacks that spread eCh0raix ransomware.

How it works

Synology has not said which vulnerability is being exploited. It linked a November 2024 security advisory covering three flaws:

  • CVE-2024-10441: arbitrary code execution
  • CVE-2024-50629: file read
  • CVE-2024-10445: file write

These are candidates only, and the page does not say which one is used. Encrypted files get a .L0CK3D extension, and a ransom note named read-me3.txt is dropped. The portal offers to decrypt one file free as proof. The note warns that third-party recovery software will damage the files. The first victim reports appeared more than two weeks before the advisory.

Preconditions / Affected

Devices running DSM versions that predate the December 2024 patch are affected. Exposure of the management web interface to the Internet is the condition Synology tells users to remove. Shadowserver tracks over 380,000 Internet-exposed Synology NAS devices. It does not say how many are already patched or are honeypots, so that figure is an upper bound on exposure, not a count of vulnerable systems.

What to do

  • Update DSM to the latest version immediately.
  • Enable automatic DSM updates.
  • Block access to the management web interface from the Internet.
  • Check the November 2024 Synology advisory to confirm your DSM build includes the fixes for the three CVEs above.

Caveats

Synology did not respond to BleepingComputer's request for details. The exploited CVE is unconfirmed, so patching to the current DSM release is safer than patching only one of the three. The page gives no indicators beyond the note name, the file extension and the decryptor branding, and no decryption method.

C3RB3R was first seen in December 2021. It has also been deployed on Atlassian Confluence and GitLab servers, using CVE-2021-26084, CVE-2021-22205 and CVE-2023-22518.

Organisations named here

  • Shadowserver
  • Synology

CVEs named here

  • CVE-2024-10441
  • CVE-2024-50629
  • CVE-2024-10445
  • CVE-2021-26084
  • CVE-2021-22205
  • CVE-2023-22518

Technologies named here

  • Shadowserver
  • Atlassian Confluence
  • GitLab
  • Confluence
  • DiskStation Manager automatic updates
  • Synology DiskStation Manager
  • Synology DiskStation Manager (DSM), outdated versions
  • Synology NAS devices

Techniques named here

  • Ransomware-as-a-service
  • Brute Force
  • Data encrypted for impact ransomware extortion
  • Exploitation of known vulnerabilities in unpatched software

Concepts named here

  • Internet exposure of management interfaces
  • Patch management

Threat actors named here

  • C3RB3R
  • eCh0raix

Related in Threat Intel