INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).
Synology Warns of C3RB3R Ransomware Attacks via Outdated DSM Versions
|
2026-11-03 16:31
CRITICAL
LOW
RANSOMWARE & EXTORTION
Executive Summary
AI-generated
Taiwanese network-attached storage (NAS) appliance maker Synology warned customers to update their devices immediately due to a surge in C3RB3r ransomware attacks. The company urged users to enable automatic updates and upgrade the DiskStation Manager (DSM) software running on their NAS devices to the latest version to protect their data. "Synology has identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM. These attacks aim to encrypt data and extort ransom," it said in a Thursday advisory .
Technical Mitigations AI-generated
• Apply the vendor fix for CVE-2024-10441, CVE-2024-10445 and treat internet-facing systems that were not patched in time as potentially compromised until verified.
Technical Observables 1 IoCs Login Required
Indicators of Compromise (IoCs) Protected
Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.
files 1
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CVE-2021-26084CVE-2021-26084
CVE-2024-50629CVE-2024-50629
CVE-2024-10441CVE-2024-10441
CVE-2021-22205CVE-2021-22205
CVE-2023-22518CVE-2023-22518
CVE-2024-10445CVE-2024-10445
Target & Sectors
TW
Incident Timeline
August 2019
Synology rarely issues security advisories warning of attacks targeting its customers' devices, with the last such alert published in August 2019 following large-scale brute-force attacks that led to eCh0raix ransomware infections .
Click on any entity below to view its context and source!
tactic
Ransomware
Synology rarely issues security advisories warning of attacks targeting its customers' devices, with the last such alert
published in August 2019
following large-scale brute-force attacks that led to
eCh0raix ransomware infections
.
December 2021
Starting in December 2021, when it was first spotted , C3RB3R was also deployed on Atlassian Confluence and GitLab servers as part of several attack waves exploiting remote code execution ( CVE-2021-26084 and CVE-2021-22205 ) and…
Click on any entity below to view its context and source!
vulnerability
CVE-2021-26084
Starting in December 2021,
when it was first spotted
, C3RB3R was also deployed on Atlassian Confluence and GitLab servers as part of
several
attack
waves
exploiting remote code execution (
CVE-2021-26084
and
CVE-2021-22205
) and authentication bypass (
CVE-2023-22518
) flaws.
vulnerability
CVE-2021-22205
Starting in December 2021,
when it was first spotted
, C3RB3R was also deployed on Atlassian Confluence and GitLab servers as part of
several
attack
waves
exploiting remote code execution (
CVE-2021-26084
and
CVE-2021-22205
) and authentication bypass (
CVE-2023-22518
) flaws.
vulnerability
CVE-2023-22518
Starting in December 2021,
when it was first spotted
, C3RB3R was also deployed on Atlassian Confluence and GitLab servers as part of
several
attack
waves
exploiting remote code execution (
CVE-2021-26084
and
CVE-2021-22205
) and authentication bypass (
CVE-2023-22518
) flaws.
tactic
Remote Code Execution
Starting in December 2021,
when it was first spotted
, C3RB3R was also deployed on Atlassian Confluence and GitLab servers as part of
several
attack
waves
exploiting remote code execution (
CVE-2021-26084
and
CVE-2021-22205
) and authentication bypass (
CVE-2023-22518
) flaws.
tactic
T1213.001 - Confluence
Starting in December 2021,
when it was first spotted
, C3RB3R was also deployed on Atlassian Confluence and GitLab servers as part of
several
attack
waves
exploiting remote code execution (
CVE-2021-26084
and
CVE-2021-22205
) and authentication bypass (
CVE-2023-22518
) flaws.
organisation
GitLab
Starting in December 2021,
when it was first spotted
, C3RB3R was also deployed on Atlassian Confluence and GitLab servers as part of
several
attack
waves
exploiting remote code execution (
CVE-2021-26084
and
CVE-2021-22205
) and authentication bypass (
CVE-2023-22518
) flaws.
November 2024
Threat actors are exploiting vulnerabilities in Synology's DSM versions, specifically CVE-2024-10441, CVE-2024-50629, and CVE-2024-10445, to target unpatched NAS devices.
Click on any entity below to view its context and source!
vulnerability
CVE-2024-10441
While Synology has yet to share
which vulnerability is being exploited in these ongoing attacks, it linked to a
November 2024 security advisory
with information about patches released for vulnerabilities allowing attackers to execute arbitrary code (CVE-2024-10441), read files (CVE-2024-50629), and write files (CVE-2024-10445) on unpatched devices.
vulnerability
CVE-2024-50629
While Synology has yet to share
which vulnerability is being exploited in these ongoing attacks, it linked to a
November 2024 security advisory
with information about patches released for vulnerabilities allowing attackers to execute arbitrary code (CVE-2024-10441), read files (CVE-2024-50629), and write files (CVE-2024-10445) on unpatched devices.
vulnerability
CVE-2024-10445
While Synology has yet to share
which vulnerability is being exploited in these ongoing attacks, it linked to a
November 2024 security advisory
with information about patches released for vulnerabilities allowing attackers to execute arbitrary code (CVE-2024-10441), read files (CVE-2024-50629), and write files (CVE-2024-10445) on unpatched devices.
November 5, 2024
Threat actors are exploiting vulnerabilities in Synology's DSM versions to target NAS devices.
Click on any entity below to view its context and source!
organisation
IT Information Security
Follow me on Twitter:
@securityaffairs
and
Facebook
and
Mastodon
Pierluigi Paganini
(
SecurityAffairs
– hacking, NAS)
facebook
linkedin
twitter
Cybercrime
Hacking
information security news
IT Information Security
NAS
Pierluigi Paganini
ransomware
Security Affairs
Security News
Synology
infrastructure
4.3
The third issue, CVE-2024-10445, is rated 4.3 and concerns improper certificate validation in the update functionality.
infrastructure
7.2.2
Users should check the full version number installed on their NAS and compare it with the minimum fixed releases listed in the advisory:
DSM 7.2.2: 7.2.2-72806-1 or later.
infrastructure
7.2.2-72806
Users should check the full version number installed on their NAS and compare it with the minimum fixed releases listed in the advisory:
DSM 7.2.2: 7.2.2-72806-1 or later.
organisation
Synology
Synology hasn’t confirmed which of these vulnerabilities attackers are exploiting.
December 2024
Threat actors are exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM.
2026/10/26
Last week's advisory follows a massive wave of reports from Synology customers whose data was encrypted and who were prompted to buy "C3rb3r Decryptor" tool from a dark web portal for thousands of dollars.
Click on any entity below to view its context and source!
organisation
Synology
Last week's advisory follows a massive wave of reports from Synology customers whose data was encrypted and who were prompted to buy "C3rb3r Decryptor" tool from a dark web portal for thousands of dollars.
October 29, 2026
Synology disclosed the attacks on October 29, 2026.
2026/11/03
Internet threat watchdog Shadowserver now tracks over 380,000 Internet-exposed Synology NAS devices , but doesn't provide information on how many have already been secured against these attacks or are honeypots.
Click on any entity below to view its context and source!
organisation
Synology NAS
"
C3RB3R ransom note (BleepingComputer)
The Cerber ransomware (also known as C3RB3R and CerberImposter), now deployed in attacks targeting Synology NAS devices, borrowed its name from a notorious Ransomware-as-a-Service (RaaS) with the same name
that emerged in 2016
.
organisation
CerberImposter
"
C3RB3R ransom note (BleepingComputer)
The Cerber ransomware (also known as C3RB3R and CerberImposter), now deployed in attacks targeting Synology NAS devices, borrowed its name from a notorious Ransomware-as-a-Service (RaaS) with the same name
that emerged in 2016
.
organisation
DSM
The company urged users to enable automatic updates and upgrade the DiskStation Manager (DSM) software running on their NAS devices to the latest version to protect their data.
organisation
DiskStation
The company urged users to enable automatic updates and upgrade the DiskStation Manager (DSM) software running on their NAS devices to the latest version to protect their data.
organisation
DSM 6.2
DSM 6.2
Moderate
Upgrade to 6.2.4-25556-8 or above.
infrastructure
7.2.2
Product
Severity
Fixed Release Availability
DSM 7.2.2
Critical
Upgrade to 7.2.2-72806-1 or above.
infrastructure
7.2.2-72806
Product
Severity
Fixed Release Availability
DSM 7.2.2
Critical
Upgrade to 7.2.2-72806-1 or above.
organisation
DSM 7.2
DSM 7.2
Critical
Upgrade to 7.2-64570-4 or above.
organisation
Adaptive Security's
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
organisation
Microsoft 365
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
organisation
Google Workspace
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
infrastructure
380,000 exposed Synology NAS devices
Internet threat watchdog Shadowserver
now tracks over 380,000 Internet-exposed Synology NAS devices
, but doesn't provide information on how many have already been secured against these attacks or are honeypots.
November 03, 2026
Threat actors are exploiting a 2024 security flaw in outdated DSM versions to target Synology NAS devices, prompting the company to urge users to update their systems immediately.
Click on any entity below to view its context and source!
tactic
Ransomware
Synology Warns of Ransomware Attacks Targeting NAS Devices Running Outdated DSM Versions
Pierluigi Paganini
November 03, 2026
Synology warns of ransomware attacks exploiting a 2024 flaw in outdated NAS devices, urging users to update DSM immediately.
organisation
DSM
Synology Warns of Ransomware Attacks Targeting NAS Devices Running Outdated DSM Versions
Pierluigi Paganini
November 03, 2026
Synology warns of ransomware attacks exploiting a 2024 flaw in outdated NAS devices, urging users to update DSM immediately.
organisation
Synology NAS
A security fix released in 2024 is now at the centre of ransomware attacks against Synology NAS devices.
organisation
DiskStation
The company has found attackers targeting systems that still run outdated versions of DiskStation Manager (DSM), putting files stored on these network storage devices at risk of encryption and extortion.
Tactical Metrics
Metrics
infrastructure
6.2
Software Version
Click for context!
The advisory was updated as fixes became available across different software branches, with the DSM 6.2 update released on December 5.
Metrics
infrastructure
4.3
Software Version
The third issue, CVE-2024-10445, is rated 4.3 and concerns improper certificate validation in the update functionality.
Metrics
infrastructure
7.2.2
Software Version
Users should check the full version number installed on their NAS and compare it with the minimum fixed releases listed in the advisory:
DSM 7.2.2: 7.2.2-72806-1 or later.
Product
Severity
Fixed Release Availability
DSM 7.2.2
Critical
Upgrade to 7.2.2-72806-1 or above.
Metrics
infrastructure
7.2.2-72806
Software Version
Users should check the full version number installed on their NAS and compare it with the minimum fixed releases listed in the advisory:
DSM 7.2.2: 7.2.2-72806-1 or later.
Product
Severity
Fixed Release Availability
DSM 7.2.2
Critical
Upgrade to 7.2.2-72806-1 or above.
Metrics
infrastructure
Microsoft 365
Affected Product
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
Metrics
infrastructure
380,000
Exposed Synology Nas Devices
Internet threat watchdog Shadowserver
now tracks over 380,000 Internet-exposed Synology NAS devices
, but doesn't provide information on how many have already been secured against these attacks or are honeypots.
Intelligence Sources
BleepingComputer
2026-11-02
Synology warns of C3RB3R ransomware attacks targeting NAS devices
BleepingComputer
Security Affairs
2026-11-03
Unpublish from Social Media?
Are you sure you want to delete this podcast video from all synchronized social networks (YouTube, Facebook, Threads)?
Important:
Due to Meta API restrictions, Instagram Reels cannot be deleted automatically via API by third-party apps.
View Profile to Delete Manually
View Profile to Delete Manually
Tactical Intelligence
Report Intelligence Issue
Podcast Options
Generate
Incident Version History
CURRENT VERSION
Last Updated: 2026-11-04T07:58
Comprehensive Tactical Telemetry
Highly Correlated Entities
13x
timeline
Temporal Reference
November 03, 2026
date
12x
organisation
Identified Entity
DSM
entity
6x
vulnerability
Exploited CVE
CVE-2024-10441
cve
4x
tactic
Cyber Operation Type
Ransomware
tactic
4x
infrastructure
Software Version
6.2
version
3x
general metric
Dsm
7
dsm
2x
vulnerability
CVSS Score
10
score
Contextual Telemetry
Context Block
6 METRICS
general metric
Update
6
update
target region
Target Country
Taiwan, Province of China
country
general metric
%
80
%
tactic
MITRE ATT&CK Technique
T1213.001 - Confluence
technique
infrastructure
Affected Product
Microsoft 365
software
infrastructure
Exposed Synology Nas Devices
380,000
exposed synology nas devices
Click on any entity below to view its context in the main text!
Selective Unpublish
Select the networks you want to remove this post from. The system will try to delete the real post through the API and clean the database so you can publish it again.
By navigating this website, you accept the use of strictly necessary technical cookies for session security and basic platform functionality. We do not use tracking or advertising cookies. Read our Privacy Policy.
Generating report…
0s