Synology C3RB3R: NAS Devices Encrypted via Exploitation of Known Vulnerabilities in Outdated DSM

1. Overview

• Title: Synology Recommends Updating DSM in Response to Ransomware Attacks Targeting Older DSM Versions
• Source: Synology
• Published: 2026-10-29
• Original: Synology
• Related Sources: BleepingComputer: Synology Warns Customers of Ongoing C3RB3R Ransomware Attacks, Synology-SA-24:20 DSM (PWN2OWN 2024)
• Related Malware: C3RB3R, CerberImposter
• Related Threat Groups: Unspecified
• Related CVEs: CVE-2024-10441, CVE-2024-50629, CVE-2024-10445 (referenced in the advisory; specific CVEs used in this campaign are unconfirmed)
• Related Products: Synology DiskStation Manager (DSM), Synology NAS
• Severity: critical

2. Quick Summary

Synology announced that it has confirmed attacks exploiting vulnerabilities patched in December 2024 against outdated DSM installations. Concurrently, BleepingComputer reported file encryption and ransom demands targeting NAS devices by the C3RB3R ransomware.

3. Attack Flow

From Outdated DSM to Data Encryption

1. Attackers exploit vulnerabilities patched in December 2024 against outdated DSM instances that are reachable from the internet or accessible to attackers.
2. Specific execution paths and privileges post-intrusion have not been publicly disclosed. Investigations into encryption incidents typically involve checking for suspicious processes and volume writes on the NAS.
3. C3RB3R encrypts files, appends the .L0CK3D extension, and places a ransom note named read-me3.txt (based on user reports and notes confirmed by BleepingComputer).
4. The attackers demand the purchase of a decryption tool (C3rb3r Decryptor) via a dark web site.

4. Attacker Position and Execution Location

• Vulnerabilities are exploited from a network position capable of reaching outdated DSM instances, leading to data encryption on the NAS. The specific accessible services, initial payloads, and execution privileges exploited in this campaign have not been disclosed.

5. Indicators for Victims and Administrators

Victims

• Files in shared folders become inaccessible, extensions are changed to .L0CK3D, and a read-me3.txt note appears.

Administrators

• Suspicious external requests to DSM, abnormal behavior in system or web processes, rapid bulk file writing or renaming, generation of ransom notes, and stoppage of file sharing services.

6. Prerequisites and Conditions for Failure

Prerequisites

• Running an outdated version of DSM that lacks patches released up to December 2024.
• The attacker can reach the target DSM service and gain the ability to write to the targeted storage volume.

Conditions for Failure and Mitigations

Mitigation	Mitigation Scope and Role	Limitations and Considerations
Update to Official Patched Versions and Enable Auto-Updates	Blocks exploitation of known vulnerabilities patched in December 2024	Does not recover already encrypted data or remediate persistence established prior to patching
Restrict External Access to Management Interfaces (VPN / IP Whitelists)	Prevents direct internet reachability and indiscriminate vulnerability exploitation	Does not prevent access originating from within the same network or from compromised pivot hosts
MFA and Principle of Least Privilege for Accounts	Limits unauthorized logins and privilege abuse using credentials	Does not serve as an alternative control against unauthenticated vulnerability exploitation
Offline / Immutable Backups	Enables data recovery following encryption incidents	Does not prevent the initial intrusion; requires isolation with separate credentials and storage locations

7. Impact Upon Successful Exploitation

• Shared data and backups stored on the NAS are encrypted.
• File sharing services become unavailable, operational burdens arise from recovery efforts, and ransom demands occur.
• Because data exfiltration prior to encryption has not been publicly confirmed, investigations should also cover credential/session compromise and outbound communications.

8. Observable Logs

• Email: No email vectors specific to this incident have been reported.
• Proxy / SWG / DNS: External requests targeting NAS management interfaces, outbound connections to unknown hosts, and access records pointing to dark web URLs.
• Endpoint / EDR: Suspicious child processes launched from DSM web or system processes, unknown binaries, creation of read-me3.txt, mass renaming to .L0CK3D, and high volumes of file write or rename operations.
• Identity / IdP: Login histories to DSM, administrator account modifications, MFA configuration changes, token issuances, and newly created accounts or permission changes.
• SaaS / Cloud: Synology account activity logs, remote access configuration changes, failed backup jobs, and cloud synchronization anomalies.
• Network: Scanning or exploitation patterns targeting management ports, pre- and post-encryption outbound traffic, and abnormal SMB or NFS service traffic.

9. Attack Success Assessment

Initial Execution Confirmed

• Assessment Stage: Initial execution confirmed (initial_execution) / Scope: Ongoing attacks targeting outdated DSM instances.
• Basis: Public reporting: Synology announced exploitation of patched vulnerabilities in outdated DSM, and BleepingComputer reported user encryption incidents. Initial payloads, execution privileges, and specific exploited CVEs have not been publicly disclosed.

Follow-on Compromise Confirmed

• Assessment Stage: Follow-on compromise confirmed (follow_on_compromise) / Scope: Incidents caused by C3RB3R ransomware.
• Basis: Public reporting: BleepingComputer reported file encryption, read-me3.txt files, .L0CK3D extensions, and ransom demands based on user reports and obtained ransom notes. Synology also described the attacks as aiming for data encryption and ransom demands.

10. Investigation Playbook

Trigger

• Operation of outdated DSM, direct exposure to the internet, discovery of read-me3.txt or .L0CK3D files, and mass file encryption serve as investigation triggers.

Initial Assessment

• Check DSM build numbers, patch application history, external exposure settings, timestamps of initially encrypted files, ransom notes, administrator login history, and backup integrity.

Endpoint

• Preserve various DSM logs, running processes, installed packages, task scheduler entries, auto-start configurations, and file modification timelines to check for known indicators of compromise or unknown binaries.

Identity / Cloud

• Verify whether DSM administrator accounts, Synology accounts, remote access configurations, API keys/tokens, and backup credentials have been misused or modified.

Follow-on Compromise

• Track data exfiltration, credential theft, lateral movement to other NAS devices or hosts, and deletion of backups.

Containment

• Isolate the affected NAS from the network, perform evidence preservation, execute a clean reinstall, update to a patched version, rotate credentials, and recover from offline backups.

Assessment

• Evaluate vulnerability exposure, code execution, account compromise, file encryption, and data exfiltration as distinct, separated stages.

11. Defense and Detection Ideas

Single Event Detection

• Detect the creation of read-me3.txt, the application of the .L0CK3D extension, and rapid bulk file renaming or writing activities.

Timeline Correlation

• Correlate suspicious external requests, abnormal DSM process activity, credential or configuration changes, mass file encryption, and ransom note generation along a unified timeline.

Hunting Perspective

• Inventory NAS devices running outdated builds and internet exposure states, and review historical web, system, and network logs during the attack window.

Logging Blind Spots

• Because local logs inside the NAS may be damaged or deleted by attackers or encryption processes, forward and preserve Syslog, firewall, DNS, and backup logs to external infrastructure.

Priority Mitigations

• Immediately update to patched versions, block management interfaces from the internet, secure offline or immutable backups, and pre-test recovery procedures.

12. Facts / Inference / Hypothesis

Facts

• Synology announced that attackers have exploited vulnerabilities patched in December 2024 against outdated DSM instances in attacks aiming for data encryption and ransom demands.
• Synology advised users running vulnerable versions to immediately update DSM and enable auto-updates.
• Synology-SA-24:20, referenced by Synology, patches CVE-2024-10441 (pre-authentication RCE), CVE-2024-50629 (limited file read), and CVE-2024-10445 (limited file write via MITM on adjacent networks).
• However, Synology has not disclosed which specific vulnerability within Synology-SA-24:20 is actively being exploited in ongoing C3RB3R attacks.
• Patched versions include DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7, 6.2.4-25556-8 and later.
• User reports confirm the ransom note read-me3.txt, the encrypted file extension .L0CK3D, and demands to purchase the C3rb3r Decryptor on the dark web. These details were compiled by BleepingComputer based on user reports and obtained notes.
• Shadowserver has observed over 380,000 Synology NAS devices exposed to the internet, which represents an observation of public exposure counts rather than an indicator of vulnerable or compromised device counts.

Inference

• Because Synology-SA-24:20 includes a pre-authentication RCE (CVE-2024-10441), it is considered a candidate vector for initial intrusion, but it cannot be definitively concluded that C3RB3R exploited CVE-2024-10441. Individual CVEs are treated as the scope of remediation covered by updates rather than as confirmed evidence of active exploitation.

Hypothesis

No additional hypotheses. Unconfirmed items are documented under "Limitations and Open Questions".

13. MITRE ATT&CK Mapping

ID	Technique	Confidence	Basis
T1190	Exploit Public-Facing Application	high	Synology confirmed active exploitation of patched vulnerabilities in outdated DSM. Specific CVEs unannounced.
T1486	Data Encrypted for Impact	high	BleepingComputer reported NAS data encryption based on user reports and ransom notes.

14. Limitations and Open Questions

• Specific exploited CVEs, threat actors, initial payloads, number of compromised devices, presence of pre-encryption data exfiltration, and decryptability remain undisclosed.

15. Impact on SOCs and Organizations

Organizations utilizing Synology NAS for backups or file sharing should immediately halt direct internet exposure, prioritize updating to official patched versions or later, and conduct recovery testing. Because ransomware encryption can affect the NAS and its backups simultaneously, verify that backups are offline or immutable and protected by credentials segregated from the production environment.

16. Summary by Role

• SOC: Check for external access to DSM, abnormal web/system process behavior, read-me3.txt files, .L0CK3D extensions, high-volume file modifications or writes in short timeframes, and outbound traffic to unknown destinations.
• Administrators: Isolate management interfaces from the internet, update to official patched versions or later, and enable auto-updates and offline backups.
• Users: If suspicious file encryption or ransom notes are discovered, isolate the NAS from the network immediately, leave files untouched, and contact administrators right away.