Shadowserver now tracks over 380,000 Internet-exposed Synology NAS devices, a startling figure that frames a recent surge of C3RB3r ransomware attacks warning Synology issued to its customers.
Synology advisory and immediate actions urged
Synology on Thursday warned customers to update their devices immediately and to "enable automatic updates and upgrade the DiskStation Manager (DSM) software running on their NAS devices to the latest version to protect their data." The company said threat actors are exploiting a vulnerability patched in December 2024 to target devices running outdated DSM versions with attacks that "aim to encrypt data and extort ransom."
The advisory specifically recommends that users block access to the management web interface from the Internet and update DSM software to prevent attackers' attempts to hack and encrypt devices. A Synology spokesperson was not immediately available when BleepingComputer reached out for more information on these C3RB3r ransomware attacks.
C3RB3R ransomware behavior: notes, extensions, and demands
Synology's alert follows a wave of customer reports in which victims found their data encrypted and a ransom demand directing them to buy a "C3rb3r Decryptor" tool on a dark web portal for thousands of dollars. According to those reports, the ransomware dropped a ransom note named read-me3.txt and appended the extension .L0CK3D to encrypted files.
The ransom note reads in part: "All your important files have been encrypted. Any attempts to restore your files with thrid-party software will be fatal for your files! The only way to decrypt your files safely is to buy the special decryption software 'C3rb3r Decryptor'... At this page you will receive the complete instructions how to buy the decryption software for restoring all your files. Also at this page you will be able to restore any one file for free to be sure 'C3rb3r Decryptor' will help you."
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildVulnerabilities named: CVE-2024-10441, CVE-2024-50629, CVE-2024-10445
Synology identified that attackers are exploiting a vulnerability patched in December 2024 and noted additional vulnerabilities tied to the current incident. The company has "yet to share information about patches released for vulnerabilities allowing attackers to execute arbitrary code (CVE-2024-10441), read files (CVE-2024-50629), and write files (CVE-2024-10445) on unpatched devices." The advisory makes clear these CVE identifiers are central to how attackers are breaching and manipulating unpatched NAS systems.
Exposure scale, history of Cerber-derived operations, and timeline
Shadowserver's count of over 380,000 Internet-exposed Synology NAS devices provides scale but not a status update on which systems are patched or are honeypots. The first public reports of encrypted Synology devices appeared more than two weeks before the advisory, and Synology noted that it rarely issues security advisories of this kind — the last such alert it published came in August 2019 after widespread brute-force attacks that led to eCh0raix ransomware infections.
The campaign carries the C3RB3R name, which traces to a ransomware family previously known as Cerber. The source material notes that the original Cerber RaaS, active until the end of 2019, at one point "accounted for more than 80% of all ransomware attacks and a quarter of all ransomware infections on enterprise endpoints." Since December 2021, C3RB3R has also been deployed against Atlassian Confluence and GitLab servers through a series of vulnerabilities (CVE-2021-26084 and CVE-2021-22205) and an authentication bypass (CVE-2023-22518).
What this means for Synology users, enterprises, and security teams
- Synology users: The company "strongly urges all users running vulnerable versions to update DSM immediately to protect their systems" and to enable automatic updates so DSM stays current.
- Enterprises and affected customers: Organizations that discovered encrypted files were being presented with a dark-web portal asking thousands of dollars for a "C3rb3r Decryptor"; they will need to evaluate backups, incident response plans, and the feasibility of recovery versus paying ransom.
- Security teams and defenders: The campaign links to named CVEs that allow arbitrary code execution, file reads, and writes on unpatched devices, making patch management and blocking management interfaces from direct Internet access priority mitigations.
Synology's advisory is concise: update DSM, enable automatic updates, and close management interfaces to the Internet. The practical question left by the facts is how many of the more than 380,000 Internet-exposed devices Shadowserver tracks have already been patched — Shadowserver does not disclose how many are secured or are honeypots — and how quickly owners will apply the fixes Synology recommends.
