Synology Warns of C3RB3R Ransomware Hitting Old DSM

Active. Synology says threat actors are exploiting a vulnerability patched in December 2024 to encrypt data on NAS devices running outdated DiskStation Manager (DSM). Source: BleepingComputer, November 2, 2026. Confidence: high that the vendor issued the warning. Confidence: low on which flaw is involved.

Timeline, per BleepingComputer:

• More than two weeks before the advisory: first victim reports surface. Ransom note named read-me3.txt, encrypted files renamed with a .L0CK3D extension. The note points to a dark web portal selling a “C3rb3r Decryptor” for thousands of dollars. Confidence: medium. These are user reports relayed by the outlet, not vendor-confirmed.
• Last Thursday, October 29 (BleepingComputer says “Thursday”; the date is derived from its November 2 publication): Synology publishes an advisory urging users on vulnerable DSM versions to update immediately and enable automatic updates. It also advises blocking internet access to the management web interface. Confidence: high, quoted from the vendor advisory.
• Synology has not named the exploited flaw. Its advisory links a November 2024 bulletin covering CVE-2024-10441 (code execution), CVE-2024-50629 (file read) and CVE-2024-10445 (file write). Which one is under attack: unconfirmed. A Synology spokesperson had not responded to BleepingComputer’s request for details at publication.

Synology lists these fixed releases. All branches are rated critical except 6.2, rated moderate: DSM 7.2.2 at 7.2.2-72806-1 or above, 7.2.1 at 7.2.1-69057-6 or above, 7.2 at 7.2-64570-4 or above, 7.1 at 7.1.1-42962-7 or above, and 6.2 at 6.2.4-25556-8 or above. Confidence: high, vendor table as reproduced by BleepingComputer.

Exposure: BleepingComputer reports that Shadowserver tracks over 380,000 internet-exposed Synology NAS devices. Confidence: medium, a third-party count relayed secondhand. Patched share and honeypot count: not reported.

Naming: BleepingComputer says the ransomware borrows its name from the Cerber ransomware-as-a-service operation that emerged in 2016 and disappeared at the end of 2019. Confidence: medium, outlet characterization. Analysis: the shared name alone does not establish a link to the original operators. Any such link: unconfirmed.

History, per BleepingComputer. Confidence: medium, outlet background, not independently checked here.

• Synology’s last comparable attack warning came in August 2019, after brute-force attacks led to eCh0raix ransomware infections.
• From December 2021, C3RB3R was deployed against Atlassian Confluence and GitLab servers in attack waves exploiting CVE-2021-26084, CVE-2021-22205 and CVE-2023-22518.

Unconfirmed: the specific CVE, the number of encrypted devices, attribution. None reported.

More coverage in the ransomware hub.