Synology warns of C3RB3R ransomware attacks exploiting patched DSM flaws on internet-exposed NAS devices
Synology issued a rare advisory warning that threat actors are exploiting a vulnerability patched in December 2024 to deploy C3RB3R (Cerber) ransomware on NAS devices running outdated DiskStation Manager (DSM). Victims report encrypted files with a .L0CK3D extension and a ransom note demanding thousands of dollars for a "C3rb3r Decryptor" via a dark web portal. Synology has not named the exact flaw, but linked to an advisory covering CVE-2024-10441, CVE-2024-50629 and CVE-2024-10445. Shadowserver tracks over 380,000 internet-exposed Synology NAS devices, though it is unclear how many are vulnerable.
Entenda a falha
A vulnerabilidade
Synology says attackers are exploiting a flaw patched in December 2024 in outdated DiskStation Manager (DSM) to deploy C3RB3R (Cerber) ransomware on NAS devices. Synology has not named the exploited CVE. It linked an advisory covering CVE-2024-10441 (arbitrary code execution, the most severe), CVE-2024-50629 (file read) and CVE-2024-10445 (file write). BleepingComputer dates that advisory to November 2024, while Synology's text refers to a December 2024 patch. The articles give no version numbers, only that DSM must be updated to the latest release. The attack path appears to involve internet-exposed management interfaces. Synology's advice is to block internet access to the web interface.
Como funciona
The articles do not describe the internal mechanism of the exploited flaw, since Synology has not confirmed which one it is. What they say is that devices running outdated DSM and reachable from the internet are being compromised. After that, the ransomware encrypts the files, appends the .L0CK3D extension and drops a ransom note named read-me3.txt. The note directs victims to a dark web portal to buy a 'C3rb3r Decryptor' for thousands of dollars. The linked advisory describes the three candidate flaws only as code execution, file read and file write on unpatched devices.
Por que é vulnerável
The articles do not give a root cause for the exploited flaw, because Synology has not said which CVE is involved. What they show is that the exposure comes from devices running DSM versions that lack the patches from the late 2024 advisory, combined with management web interfaces reachable from the internet. The fix is to install the patched DSM release, and Synology also recommends enabling automatic updates.
Como foi descoberta
Synology says it identified the exploitation itself and published a rare advisory on a Thursday. It issues such warnings rarely, the last being in August 2019 over eCh0raix brute-force attacks. According to BleepingComputer, user reports of encrypted data began more than two weeks before the advisory, and the advisory followed a wave of those reports. Synology has not confirmed which vulnerability is used. Shadowserver tracks over 380,000 internet-exposed Synology NAS devices, but it is unclear how many are vulnerable or are honeypots.
Explicação gerada por IA a partir da matéria e dos artigos, em 02/11/2026 10:16.
2 exploits públicos
Há código de exploração publicado no Exploit-DB para CVE-2021-22205, CVE-2021-26084. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.
-
GitLab 13.10.2 - Remote Code Execution (RCE) (Unauthenticated)
The file abuses GitLab's handling of uploaded images, which hands attacker-supplied DjVu files to ExifTool (CVE-2021-22204), to get unauthenticated remote code execution on GitLab before 13.10.3. The attacker only needs network access to the web interface; no account or user interaction is required. One crafted upload makes the server run commands as the git user, shown here as a reverse shell. It is a working exploit, tested by the author on 13.10.1 and 13.10.2, though not verified by Exploit-DB.
-
Confluence Server 7.12.4 - 'OGNL injection' Remote Code Execution (RCE) (Unauthenticated)
This script exploits the OGNL injection flaw in Atlassian Confluence Server (CVE-2021-26084), where a page-creation action in the Webwork layer evaluates attacker-supplied input as an expression. It needs no authentication, only network access to a vulnerable instance (here, versions before 7.12.5). It offers an interactive loop that runs operating system commands on the server, Windows or Linux, and prints the output, so it is a working unauthenticated remote code execution exploit. It genuinely matches the listed CVE.
Detalhes técnicos
- Reports began more than two weeks before the advisory; the ransomware drops the ransom note read-me3.txt and appends .L0CK3D to encrypted files.
- The linked advisory covers arbitrary code execution (CVE-2024-10441), file read (CVE-2024-50629) and file write (CVE-2024-10445).
- The actual exploited vulnerability has not been confirmed by Synology.
- C3RB3R reuses the name of the 2016 Cerber RaaS; since December 2021 it has also been deployed against Atlassian Confluence and GitLab servers via CVE-2021-26084, CVE-2021-22205 and CVE-2023-22518.
- Synology's last comparable alert was in August 2019 (eCh0raix brute-force attacks).
Remediação
- Update DSM to the latest version immediately and enable automatic updates.
- Block access to the management web interface from the Internet.
Linha do tempo
-
Synology warns of C3RB3R ransomware attacks exploiting patched DSM flaws on internet-exposed NAS devices
ler a análise desta fonte ocultar
Synology issued a rare advisory warning that threat actors are exploiting a vulnerability patched in December 2024 to deploy C3RB3R (Cerber) ransomware on NAS devices running outdated DiskStation Manager (DSM). Victims report encrypted files with a .L0CK3D extension and a ransom note demanding thousands of dollars for a "C3rb3r Decryptor" via a dark web portal. Synology has not named the exact flaw, but linked to an advisory covering CVE-2024-10441, CVE-2024-50629 and CVE-2024-10445. Shadowserver tracks over 380,000 internet-exposed Synology NAS devices, though it is unclear how many are vulnerable.
Technical Details
- Reports began more than two weeks before the advisory; the ransomware drops the ransom note read-me3.txt and appends .L0CK3D to encrypted files.
- The linked advisory covers arbitrary code execution (CVE-2024-10441), file read (CVE-2024-50629) and file write (CVE-2024-10445).
- The actual exploited vulnerability has not been confirmed by Synology.
- C3RB3R reuses the name of the 2016 Cerber RaaS; since December 2021 it has also been deployed against Atlassian Confluence and GitLab servers via CVE-2021-26084, CVE-2021-22205 and CVE-2023-22518.
- Synology's last comparable alert was in August 2019 (eCh0raix brute-force attacks).
Remediation
- Update DSM to the latest version immediately and enable automatic updates.
- Block access to the management web interface from the Internet.