C3RB3R ransomware attacks on Synology NAS devices
What happened
Synology warned customers of ongoing C3RB3R ransomware attacks targeting NAS devices, which aim to encrypt data and extort ransom. Synology has identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM. The company urged users to enable automatic updates and upgrade the DiskStation Manager (DSM) software running on their NAS devices to the latest version to protect their data.
AI summary of accepted evidence. Check the original sources for the full context.
Reported impact
An affected population has not been established in the accepted evidence.
- Attack method
- exploiting a vulnerability patched in December 2024
Source evidence
1Read the original reporting and statements. Multiple articles may rely on the same underlying source.
BleepingComputer01Synology warns of C3RB3R ransomware attacks targeting NAS devices
Retrieved 3 Nov 2026
The company urged users to enable automatic updates and upgrade the DiskStation Manager (DSM) software running on their NAS devices to the latest version to protect their data.
Attributed reporting
1 more excerpt
Synology has identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM.
Attributed reporting
Updates and corrections
- Revision 1
Incident updated.