C3RB3R атакует Synology: почему обновления NAS нельзя откладывать

Since October 2026, attackers have been hitting Synology network storage devices with the C3RB3R (Cerber) ransomware, encrypting user files and appending the .L0CK3D extension while dropping ransom notes demanding payment via Tor. Synology confirmed the campaign is exploiting CVE-2024-10441, an unauthenticated remote code execution flaw that was actually patched back in December 2024, meaning only devices running outdated DSM firmware are at risk. Researchers from 360.cn also flagged two additional critical bugs, CVE-2026-13639 and CVE-2026-13684, both rated 9.8, which allow arbitrary file read/write and denial-of-service attacks, though Synology has not confirmed these were used in the current wave and already fixed them in September's DSM update. No user interaction or credentials are needed—any NAS exposed to the internet or local network without the latest updates can be compromised, so owners are urged to disable internet-facing access and apply DSM updates immediately.