Synology has warned customers that threat actors are targeting NAS devices running outdated versions of its DiskStation Manager (DSM) software with C3RB3R ransomware. The company is urging users to update their systems immediately and enable automatic updates.
According to Synology, attackers are exploiting a vulnerability patched in December 2024. The attacks are designed to encrypt stored data and demand a ransom from affected users.
The company advises users to block access to the NAS management web interface from the Internet and install the latest available DSM release. The recommended fixes are DSM 7.2.2-72806-1 or later, DSM 7.2.1-69057-6 or later, DSM 7.2-64570-4 or later, DSM 7.1.1-42962-7 or later, and DSM 6.2.4-25556-8 or later. The first four branches are rated critical, while DSM 6.2 is rated moderate.
Synology has not yet provided further information about the vulnerabilities associated with arbitrary code execution (CVE-2024-10441), file reading (CVE-2024-50629), and file writing (CVE-2024-10445) on unpatched devices.
The warning follows reports from Synology customers whose files were encrypted and renamed with the .L0CK3D extension. The ransomware reportedly leaves a read-me3.txt ransom note directing victims to a dark web portal to purchase a tool called “C3rb3r Decryptor” for thousands of dollars.
C3RB3R, also known as Cerber or CerberImposter, has previously been used in attacks against Atlassian Confluence and GitLab servers. Shadowserver is currently tracking more than 380,000 Internet-exposed Synology NAS devices, although it has not disclosed how many are protected against this campaign or represent honeypots.
Sources: BleepingComputer.