Network-attached storage maker Synology has warned owners to patch their equipment immediately after a sudden surge of C3RB3R ransomware infections compromised Internet-exposed systems. Attackers are breaking into appliances running outdated versions of the DiskStation Manager operating system, locking files and demanding thousands of dollars in ransom payments.
Key points
- Synology published an urgent security advisory urging all customers to update DiskStation Manager and turn on automatic software updates.
- Attackers are exploiting unpatched flaws to encrypt device volumes, appending the .L0CK3D extension and leaving payment notes on compromised drives.
- Non-profit security group Shadowserver Foundation tracks over 380,000 Internet-exposed Synology storage appliances worldwide.
- The company advises owners to cut Internet access to administrative web portals until all security updates are applied.
How the attacks compromise Synology drives
Synology confirmed the campaign in a Thursday advisory, stating that criminals are taking advantage of software weaknesses resolved in updates issued in December 2024. The intrusions target devices running older editions of DiskStation Manager (DSM), the custom Linux-based operating system that manages Synology storage hardware.
Reports of intrusions surfaced two weeks before the company notice. Victims reported finding their directories inaccessible, with existing file names altered to include a “.L0CK3D” suffix. The ransomware also places a plain text note named “read-me3.txt” in affected folders, instructing victims to navigate to a dark web portal to acquire a decryption application.
“All your important files have been encrypted,” the ransom note warns. The attackers claim that third-party recovery tools will corrupt files permanently and offer to decrypt one sample file without payment to prove their software functions.
Synology has not publicly pinpointed the single software bug providing the initial entry point. The hardware maker referenced a November 2024 security advisory that addressed three serious vulnerabilities. Those earlier flaws included CVE-2024-10441, which permitted arbitrary code execution, alongside CVE-2024-50629 and CVE-2024-10445, which enabled unauthorised file reading and file writing on vulnerable machines.
Why network storage remains a high-value target
Network-attached storage units serve as central data repositories for households, creative professionals and small businesses. Because these appliances frequently house primary copies of databases, raw media files and central system backups, attackers treat them as lucrative targets for extortion.
Security watchdog Shadowserver Foundation now tracks over 380,000 Internet-exposed Synology NAS devices across the globe. While that figure includes honeypots and appliances that have already received patches, it illustrates how many private systems remain visible to automated scanners scanning the open Internet.
Public warnings from Synology regarding active malware infections are rare. The vendor last issued a comparable alert in August 2019, when a large-scale brute-force credential stuffing campaign compromised units with the eCh0raix ransomware.
The lineage of the Cerber name
The malware payload in the current wave borrows its branding and extortion infrastructure from Cerber, an operation that emerged in 2016 as a franchise service. At its operational peak between 2016 and 2017, the original Cerber syndicate controlled a notable share of global corporate ransomware incidents before closing its portals towards the end of 2019.
A distinct strain known as C3RB3R, sometimes labelled CerberImposter, emerged in December 2021. Rather than distributing payloads through phishing emails or malicious office documents, the operators behind this variant focus almost entirely on unpatched server software and network appliances.
In previous campaigns, operators behind the newer variant exploited remote code execution bugs in Atlassian Confluence, catalogued as CVE-2021-26084, and GitLab servers through CVE-2021-22205. The same group later incorporated authentication bypass exploit CVE-2023-22518 to compromise corporate collaboration infrastructure.
How to protect vulnerable NAS units
Synology recommends that system administrators verify their DSM operating system version without delay. Users should enable automatic updates in the control panel to receive security hotfixes as soon as engineering teams release them.
Hardware owners should also inspect their local router settings. The manufacturer warns users to disable port forwarding for DSM management ports 5000 and 5001, effectively closing public Internet access to administrative interfaces. Remote management should instead run through encrypted virtual private networks or authenticated relay tools such as Synology QuickConnect with two-factor authentication enforced.
