Synology warns of C3RB3R ransomware hitting outdated NAS devices

Synology is warning customers that attackers are deploying C3RB3R ransomware against network-attached storage (NAS) devices left running outdated DiskStation Manager (DSM) software, and the company traces the campaign to a flaw it had already fixed in 2024 (BleepingComputer). Once on a device, the malware encrypts files, appends a .L0CK3D extension, and drops a ransom note demanding thousands of dollars for a decryptor. Synology has not named the exact vulnerability in play, but its own attribution is plain. The patch shipped in 2024. The attacks are happening now.

What happened

Synology published its advisory in late October, saying it had identified threat actors exploiting a vulnerability it patched in 2024 and warning that the attacks are ongoing. The company did not disclose the specific CVE. Instead, it pointed customers to SA-24:20, a bulletin it first issued in 2024 that covers three flaws in DSM: CVE-2024-10441, an arbitrary code execution issue; CVE-2024-50629, a file-read information disclosure flaw; and CVE-2024-10445, a file-write flaw. Which of the three, or which combination, is being used in these intrusions is something Synology has not said. Some lower-authority reports have speculated about newer flaws as the entry point, but those claims are not confirmed and are not Synology's position; the vendor's attribution points to the 2024 patch, and the precise entry vector has not been independently pinned down.

The remediation is specific. Synology lists the DSM branches at risk and the builds that close the hole: DSM 7.2.2 (fixed in 7.2.2-72806-1), 7.2.1 (7.2.1-69057-6), 7.2 (7.2-64570-4), and 7.1 (7.1.1-42962-7) are all rated Critical, while DSM 6.2 (6.2.4-25556-8) is rated Moderate. The company urges affected users to update DSM immediately and to turn on automatic updates so the next fix lands without a manual step.

C3RB3R itself is not new. It is a variant of Cerber, a ransomware-as-a-service family that first surfaced in 2016 and has resurfaced under several names since. In the Synology cases, victims report that it encrypts their files, appends the .L0CK3D extension, and leaves a note named read-me3.txt that directs them to a dark-web portal selling a "C3rb3r Decryptor" for thousands of dollars. There is no known free decryptor. The first user reports surfaced more than two weeks before the campaign drew wider attention, which means the window for exposed, unpatched devices to be hit was open well before many owners heard a word about it.

The pool of reachable targets is large. Shadowserver, which scans the internet for exposed systems, tracks more than 380,000 internet-facing Synology NAS devices. That figure is the exposed attack surface, not an infection count, and not every exposed box runs a vulnerable DSM build. It is the water an opportunistic campaign fishes in.

Why it matters

NAS devices sit in an awkward spot. They hold the data people least want to lose (family archives, business records, backups), and they are built to be reachable, often deliberately exposed to the internet so their owners can get to files from anywhere. Many run for years with little attention, administered by small businesses or home users rather than a security team, and DSM updates that wait on a manual click often go unclicked. That combination (valuable data, internet exposure, and slow patching) is what makes storage appliances such a dependable ransomware target.

The patch gap is the real story. This is not a zero-day. It is a flaw with a fix that has been available since 2024, used against the devices whose owners never applied it. Ransomware crews understand that math. Finding a brand-new vulnerability is expensive, but scanning the internet for boxes still running a build that a patch from 2024 would have closed is cheap and repeatable. The economics favor the attacker whenever a known fix goes uninstalled on something reachable.

It is the same pattern behind the busiest ransomware operations of the year. As we noted when Qilin topped much of the 2026 leaderboards, the groups doing the most damage rarely need an exotic exploit; they need something exposed and a way in that already exists. The defensive lesson rhymes across both stories: the vulnerabilities that hurt are the reachable ones, which is why prioritizing the flaws an attacker can actually reach matters more than clearing a severity queue from the top down.

SOURCE: SHADOWSERVER / SYNOLOGY

A ransom note on a home or small-business NAS rarely makes a headline the way a corporate breach does, but the loss is immediate and personal. When the box that holds the only copy of the backups is the box that gets encrypted, there is often no second line of defense to fall back on.

The ransomware that reaches your files rarely needs a new flaw. It needs an old one, already patched, still live on a storage box facing the internet.

The attack-surface read

The patch is the fix, but the prior question is knowing you have the box at all. A NAS exposed for a long-finished project, a unit at a branch office, an appliance an acquired team set up and forgot: these are the ones that miss the update, precisely because no one is tracking them. Closing this campaign's door means matching the advisory to the real, reachable devices you run, not to a vendor name on an inventory sheet.

That is the work of knowing your attack surface, an accurate and current picture of what faces the internet, so an advisory like Synology's becomes a short list of hosts to update rather than a question mark. It is the premise Threatless is built on: AI-native exposure management that keeps that picture current, so a reachable, unpatched storage box surfaces as work to close before it becomes a ransom note. Start today with one question: which of your storage devices can be reached from the internet, and are any of them still running a DSM build older than Synology's fixed release?