Synology NAS devices are being targeted by C3RB3R ransomware in attacks linked to security flaws disclosed in 2024. Synology has urged users to update outdated DiskStation Manager (DSM) versions and installed packages.
The alert follows reports from the 360 Security Team and the Solar Emergency Response Team on October 29. Victims discovered their files encrypted with a .L0CK3D extension and a ransom note named read-me3.txt.
Security teams have provisionally identified the ransomware as C3RB3R. Public reporting does not indicate how many devices have been affected.
Synology published an advisory tracked as Synology-SA-24:20 covering three vulnerabilities disclosed after Pwn2Own 2024. The advisory was posted on November 5, 2024, and was updated several times as fixes were released across DSM branches.
Although Appinn reported the weaknesses as fixed by December 2024, Synology’s revision history shows multiple patches arriving during November.
Cyber Security News previously examined the critical CVE-2024-10441 flaw in Synology DSM. That vulnerability carries a CVSS score of 9.8 and permits unauthenticated remote code execution without user interaction.
Synology NAS Hit by C3RB3R Ransomware Attacks
The advisory also lists CVE-2024-50629, a web API flaw that can allow remote attackers to read limited files, and CVE-2024-10445, an update certificate validation flaw that can let an adjacent attacker write limited files. Those two issues have CVSS scores of 5.3 and 4.3, respectively.
Public reporting has not confirmed which specific vulnerability was exploited in each ransomware incident or whether attackers combined multiple flaws.
Early coverage raised concern because Solar reported investigating an affected device running DSM 7.4.1-90080 Update 1. At that time researchers were still determining the entry point and had not ruled out an unknown vulnerability.
Later reporting attributed Synology’s findings to older, patched weaknesses. The published accounts do not reconcile the apparent discrepancy or confirm a new zero-day exploit.
Synology NAS systems have faced ransomware in the past. Cyber Security News previously covered an investigation into Diskstation ransomware that targeted Synology storage systems, which provides background on the threat to NAS users. The available reports do not establish a link between that earlier activity and C3RB3R.
Synology’s advisory lists fixed releases including DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7, and 6.2.4-25556-8. These are historical patch thresholds, not an instruction to stop updating; administrators should install the latest release supported by their NAS model and update official packages and third-party components.
Appinn’s initial incident report recommends removing direct internet access to DSM management and SSH, using a VPN for remote connections, and checking for unusual logins, unknown administrator accounts, and suspicious scheduled tasks.
It also advises enabling two-factor authentication and maintaining independent offline or off-site backups. For affected users, separate backups may allow recovery of encrypted files. Updating systems is necessary to block further exploitation but does not restore files already encrypted by ransomware.
Give your SOC the alert context to stop incidents quickly. Integrate Threat Intel from 16K SOCs.
