Synology Warns C3RB3R Ransomware Hits NAS With Outdated DSM
Synology confirms C3RB3R ransomware attacks exploiting a DSM vulnerability patched in December 2024 (advisory Synology-SA-24:20) to encrypt data and extort ransom on NAS devices running outdated versions, without identifying the specific flaw; 360 links the attacks to two flaws patched in September, and Solar suspects a zero-day after a victim on the latest DSM 7.4.1 build. Victims report files with the .L0CK3D extension and a read-me3.txt note directing them to buy a C3RB3R decryptor; a researcher claims thousands of devices were hit, a figure not verified. Update DSM, enable automatic updates, and remove the management interface from direct internet exposure.
What happened
Synology has confirmed ransomware attacks that encrypt data on its NAS storage devices and demand payment to restore files. The vendor says attackers exploit a flaw patched in December 2024 on devices running outdated DSM. Victims report files with the .L0CK3D extension and a ransom note.
Why it matters
Encrypted files become inaccessible, including business data and backups stored on these devices. Any company with an internet-exposed Synology NAS running outdated DSM risks total loss of that data and operational downtime. A researcher claims thousands of devices were hit, a figure not verified.
What to do
Update DSM on every Synology NAS now and enable automatic updates. Remove the management interface from direct internet exposure and check offline backups.
For the technical team
- Affected
- Synology DSM (sistema operacional dos NAS DiskStation) · Synology NAS devices running outdated DSM versions, vulnerable per advisory Synology-SA-24:20. Solar reports one victim on the latest DSM 7.4.1 build.
- Exploitation
- Attacks confirmed by Synology: data encryption and ransom extortion. 360 reports multiple Synology ransomware cases since early October and links the attacks to two critical DSM flaws patched in September; Solar suspects a zero-day. A researcher claims thousands of devices were hit, with all file data lost, a figure not verified; DailyDarkWeb states there is no single confirmed entry route, no verified victim count, and no exfiltration scope.
- Fix
- Update DSM per advisory Synology-SA-24:20 (December 2024 patch) and enable automatic updates; DailyDarkWeb advises following the current update for your model and branch, as older minimum-fixed builds are not the latest DSM. Additional mitigation: remove the management interface from direct internet exposure.
- Vector
- Synology NAS running outdated DSM with the management interface exposed to the internet. Synology says the entry point is a vulnerability patched in December 2024, without identifying it; advisory Synology-SA-24:20 covers remote code execution (CVE-2024-10441), arbitrary file read (CVE-2024-50629), and arbitrary file write (CVE-2024-10445).
- More details
- Ransomware named C3RB3R by Chinese firms 360 and Solar. Entry-point divergence: Synology points to a flaw patched in December 2024 (Synology-SA-24:20), while 360 cites two flaws patched in September; DailyDarkWeb assesses this is not a new zero-day. The read-me3.txt ransom note directs victims to buy a C3RB3R decryptor.
Timeline
Fresh warning notes the flaw exploited by the ransomware was patched in December 2024 and urges users to update DSM immediately.
Synology says the exploited flaw was patched in December 2024 and that the attacks aim to encrypt data and extort ransom.
Synology says the exploited flaw was patched in December 2024 but has not identified the specific vulnerability; victims report files with the .L0CK3D extension and a read-me3.txt ransom note.
Want the next updates in your inbox? Get the daily edition →
See all 7 updates
Outlets amplify Synology's warning about C3RB3R ransomware hitting NAS devices with outdated DSM, with no new facts beyond the vendor alert.
Chinese firms name the ransomware C3RB3R and tie the attacks to two DSM flaws patched in September; a victim on the latest build raises suspicion of a zero-day.
Researcher reports thousands of Synology NAS devices already hit with total file data loss, describing the attack as a zero-day.
Incident opened.
Sources 7 sources
- @DailyDarkWeb @DailyDarkWeb
- @dinodaizovi @dinodaizovi
- @IntCyberDigest @IntCyberDigest
- @BleepinComputer @BleepinComputer
- @DarkWebInformer @DarkWebInformer
See all 7 sources
- Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw The Hacker News
- @TheHackersNews @TheHackersNews
