Executive Summary
Synology has issued a rare attack advisory regarding C3RB3R ransomware (also known as Cerber or CerberImposter) actively targeting DiskStation Manager (DSM) devices. The campaign exploits a suite of vulnerabilities patched in December 2024, emphasizing a significant 'patch gap' where attackers utilize known flaws against the long tail of unpatched, internet-exposed systems. Over 380,000 Synology NAS devices are currently visible via internet scanning, presenting a large attack surface for opportunistic extortion.
The attack chain involves the exploitation of vulnerabilities to gain a foothold, followed by the deployment of an encryptor that renames files and leaves a ransom note. This threat specifically targets the backup and storage tier of organizations, which can be catastrophic for recovery efforts if the NAS is the primary backup repository. Affected sectors include any organization or individual utilizing Synology storage with exposed management interfaces.
Historically, C3RB3R has targeted various internet-facing software such as Atlassian Confluence and GitLab using older CVEs. This latest wave reinforces the actor's strategy of targeting unpatched edge appliances that are often neglected in standard patch management cycles.