Actor Profile

C3RB3R (also known as Cerber and CerberImposter) is a ransomware family that borrowed its name from a notorious Ransomware-as-a-Service operation that dominated the threat landscape from 2016-2019, accounting for over 80% of ransomware attacks at its peak. The current C3RB3R variant first emerged in December 2021 and represents a distinct operation from the original Cerber RaaS. The malware is deployed by threat actors who exploit unpatched vulnerabilities in enterprise infrastructure to encrypt victim data and extort ransom payments through dark web portals. The operators demand thousands of dollars for their "C3rb3r Decryptor" tool and warn victims against third-party recovery attempts.

TTPs (Tactics, Techniques, Procedures)

Initial access is achieved through exploitation of critical vulnerabilities in Synology DiskStation Manager (DSM), specifically CVE-2024-10441 (arbitrary code execution), CVE-2024-50629 (arbitrary file read), and CVE-2024-10445 (arbitrary file write), all patched in December 2024. The threat actors target Internet-exposed NAS management interfaces. Upon successful compromise, the ransomware encrypts files and appends a .L0CK3D extension. A ransom note (read-me3.txt) is dropped instructing victims to purchase decryption software via a dark web portal. Historical campaigns (2021-2023) exploited CVE-2021-26084 and CVE-2021-22205 (RCE) and CVE-2023-22518 (authentication bypass) in Atlassian Confluence and GitLab servers, demonstrating a pattern of targeting enterprise collaboration and storage platforms.

Targets & Patterns

C3RB3R primarily targets storage and IT infrastructure sectors, with current campaigns focused on Synology network-attached storage (NAS) devices in Taiwan and globally. Shadowserver tracks over 380,000 Internet-exposed Synology NAS devices, representing a significant attack surface. The targeting pattern suggests opportunistic exploitation of vulnerable, Internet-facing enterprise storage systems rather than selective victim profiling. Previous campaigns targeted Atlassian Confluence and GitLab servers, indicating a preference for widely-deployed enterprise platforms with known vulnerabilities. The focus on NAS devices aligns with ransomware operators' strategy of compromising backup and storage infrastructure to maximize impact and pressure victims into paying ransoms.

Historical Context

C3RB3R first appeared in December 2021 targeting Atlassian Confluence and GitLab servers through CVE-2021-26084, CVE-2021-22205, and later CVE-2023-22518 in 2023. The malware appropriated the name of the original Cerber RaaS, which operated from 2016-2019 and was responsible for over 80% of ransomware attacks and 25% of enterprise endpoint infections before disappearing. The current Synology NAS campaign represents a significant escalation, with the first victim reports surfacing in mid-October 2024 and prompting Synology's rare security advisory on November 2, 2026. Synology's last similar warning was issued in August 2019 following brute-force attacks leading to eCh0raix ransomware infections, highlighting the severity of the current threat.

Defensive Recommendations

  • Immediately update Synology DSM to patched versions: 7.2.2-72806-1+, 7.2.1-69057-6+, 7.2-64570-4+, 7.1.1-42962-7+, or 6.2.4-25556-8+ to remediate CVE-2024-10441, CVE-2024-50629, and CVE-2024-10445
  • Block Internet access to NAS management web interfaces and restrict administrative access to trusted internal networks or VPN connections only
  • Enable automatic updates on Synology DSM to ensure timely patching of future vulnerabilities
  • Monitor for file encryption activity and the creation of ransom notes (read-me3.txt) or files with .L0CK3D extensions on NAS devices
  • Implement network segmentation to isolate NAS devices from critical production systems and maintain offline, immutable backups to enable recovery without paying ransoms

---

# Geopolitical Context

Geopolitical Context

The C3RB3R ransomware campaign targeting Synology network-attached storage devices represents a continuation of opportunistic cybercrime activity exploiting unpatched enterprise and small-to-medium business infrastructure. With over 380,000 Internet-exposed Synology devices globally, the attack surface spans critical sectors including IT infrastructure and data storage providers. The threat actors are leveraging critical-severity vulnerabilities (CVE-2024-10441, CVE-2024-50629, CVE-2024-10445) patched in December 2024, indicating a focus on organizations with poor patch management practices. This campaign follows C3RB3R's established pattern of targeting enterprise collaboration and infrastructure platforms, previously observed in attacks against Atlassian Confluence and GitLab servers since 2021. The scale and persistence of the operation—with reports emerging over multiple weeks—suggests a financially motivated criminal enterprise rather than state-sponsored activity, though the lack of attribution data precludes definitive assessment.

State Actor Alignment

No state actor attribution is available for this campaign. C3RB3R appears consistent with financially motivated cybercriminal activity rather than state-sponsored operations. The ransomware's operational pattern—exploiting publicly disclosed vulnerabilities for financial extortion—aligns with traditional cybercrime rather than espionage or strategic disruption objectives. The threat actors operate via dark web infrastructure for ransom payment portals, a hallmark of organized cybercrime groups. While Synology is a Taiwanese manufacturer, there is no indication that targeting is geographically or politically motivated; the campaign appears opportunistic, focused on vulnerable devices regardless of location or owner. The absence of sanctions designations or government attribution statements further supports assessment of this as criminal rather than state-directed activity.

Business Impacty pro region

The campaign's impact is global in scope, affecting any organization or individual operating Internet-exposed Synology NAS devices with outdated firmware. With 380,000+ devices potentially vulnerable worldwide, the threat extends across North America, Europe, Asia-Pacific, and other regions where Synology maintains market presence. For European organizations, this incident underscores ongoing challenges in securing small-to-medium enterprise IT infrastructure, particularly devices that may lack dedicated security oversight. The exploitation of storage infrastructure poses data confidentiality and availability risks across critical sectors, potentially affecting healthcare, legal, financial services, and government entities that rely on NAS devices for backup and file sharing. The campaign may also strain incident response resources in countries with significant Synology deployment, particularly if victims lack adequate backup strategies. The incident reinforces broader concerns about supply chain security and the need for coordinated vulnerability disclosure and patching across hardware manufacturers serving global markets.

Forecast

If organizations fail to apply available patches and continue exposing management interfaces to the Internet, C3RB3R infections are likely to continue at scale over the coming weeks to months. The threat actors may expand targeting to additional vulnerabilities in Synology or similar NAS platforms if the current campaign proves financially successful. If law enforcement agencies identify and disrupt C3RB3R infrastructure or operators, the campaign's intensity may diminish, though rebranding or operational shifts remain possible given historical ransomware resilience. Should additional critical vulnerabilities emerge in widely deployed storage platforms, similar opportunistic campaigns exploiting delayed patching cycles are probable. Organizations that implement automatic updates, restrict Internet exposure of management interfaces, and maintain offline backups are likely to significantly reduce their risk profile against this and similar threats.