Synology Warns of Ongoing C3RB3R Ransomware Attacks on NAS Devices
Summary
Synology says attackers are exploiting an unidentified vulnerability patched in December 2024 to target outdated DSM devices with C3RB3R ransomware. It urges users to update DSM, enable automatic updates, and block internet access to management interfaces.
Key points
- Synology says threat actors are targeting NAS devices running outdated DiskStation Manager (DSM) software and exploiting a vulnerability patched in December 2024; the exploited flaw has not been identified.
- The company says the attacks aim to encrypt data and extort ransom.
- Synology advises users to upgrade DSM, enable automatic updates, and block internet access to the management web interface.
- The article lists critical fixed releases for DSM 7.2.2, 7.2.1, 7.2, and 7.1, and a moderate fixed release for DSM 6.2.
- Users have reported encrypted data, ransom notes, and files renamed with a .L0CK3D extension; these are user reports, not independent confirmation of every attack detail.
- Shadowserver tracks more than 380,000 internet-exposed Synology NAS devices, but does not say how many are vulnerable or honeypots.
Article Details
- Event Type
- Ransomware attacks exploiting a vulnerability in outdated Synology DiskStation Manager (DSM) to target NAS devices.
- Impact
- The attacks aim to encrypt data and extort ransom. Synology customers have reported encrypted data and ransom demands for the C3rb3r Decryptor. Synology has not identified which vulnerability is being exploited or how many devices are affected. Shadowserver tracks more than 380,000 internet-exposed Synology NAS devices, but does not report how many are secured or honeypots.
MITRE ATT&CK
CVE
CVE-2024-10441information about patches released for vulnerabilities allowing attackers to execute arbitrary code (CVE-2024-10441), read files (CVE-2024-50629), and write files (CVE-2024-10445) on unpatched devices.CVE-2024-10445attackers to execute arbitrary code (CVE-2024-10441), read files (CVE-2024-50629), and write files (CVE-2024-10445) on unpatched devices.CVE-2024-50629for vulnerabilities allowing attackers to execute arbitrary code (CVE-2024-10441), read files (CVE-2024-50629), and write files (CVE-2024-10445) on unpatched devices.
Malware
CerberThe Cerber ransomware (also known as C3RB3R and CerberImposter), now deployed in attacks targeting Synology NAS devices, borrowed its name from a notorious Ransomware-as-a-Service (RaaS) with the same name that emergedCerberImposterThe Cerber ransomware (also known as C3RB3R and CerberImposter), now deployed in attacks targeting Synology NAS devices, borrowed its name from a notorious Ransomware-as-a-Service (RaaS) with the same name that emerged