C3RB3R Ransomware Group Escalates Attacks on Synology NAS Hardware

Key points

• The actors behind C3RB3R ransomware are linked to an ongoing increase in attacks on Synology NAS appliances.
• Compromised devices face ransomware impact; no specific CVE has been tied to the campaign.
• Synology is warning customers and advising them to update their devices.
• High severity reflects continuity and data-loss risk for organizations relying on NAS storage.

Synology has begun alerting its customer base to an ongoing increase in ransomware activity tied to the C3RB3R group, with network-attached storage appliances as the focus. The vendor is telling users to bring device software up to date. No CVE has been published for this campaign, so defenders should not wait for a vulnerability identifier before acting.

The exposure is not limited to one sector. Any organization that uses Synology NAS hardware for file sharing, backups, or departmental storage should treat the warning as relevant, including school districts and other public-sector teams that depend on compact storage systems. A compromised appliance can become both a data-loss event and a continuity problem if backups or shared files are affected.

The lack of a named CVE does not make the threat less urgent. It means the campaign may rely on access paths, credentials, or configuration weaknesses that are not captured by a single patch reference. Synology's guidance to update devices remains central, but it should be paired with checks on how those devices are exposed and who can reach their management interfaces.

Because the activity is described as ongoing, the situation can change. Watch for updated Synology advisories, new customer guidance, and signs that the campaign is spreading to additional device types or regions. Security teams should verify firmware status, review administrative access, and confirm that recovery copies exist outside the reach of the NAS.

For K-12 IT teams, the practical priority is to reduce easy entry points and preserve recovery options. Treat NAS appliances as critical infrastructure: inventory them, patch them, limit their internet exposure, and monitor authentication and file activity for unusual behavior.

What to do now

1. Apply the latest Synology device software and firmware updates immediately, then verify that update checks are working.
2. Remove NAS management interfaces from direct internet exposure; require VPN or another controlled access path.
3. Enforce multi-factor authentication and unique strong credentials for all administrative accounts; disable unused or legacy accounts.
4. Maintain offline or immutable backups of NAS data and test restoration before an incident occurs.
5. Review authentication, share, and file activity logs for unusual access or encryption-like behavior.
6. Segment NAS appliances from general user endpoints and limit which systems can reach file-sharing services.
7. Monitor Synology security advisories and distribute the vendor warning to IT and data-owner teams.

Original source

BleepingComputer