Synology Says Ransomware Actors Exploit Patched DSM Flaw to Target NAS Devices
Summary
Synology says ransomware actors are exploiting a flaw patched in December 2024 to target NAS devices running outdated DSM. The company urges users to update; customers have reported C3RB3R ransomware infections.
Key points
- Synology says it observed actors exploiting a vulnerability patched in December 2024 against NAS devices running outdated DiskStation Manager (DSM).
- The company did not identify the flaw being exploited; it linked to a November 2024 advisory listing three vulnerabilities.
- Synology said the attacks aim to encrypt data and extort ransom.
- Customers have reported Synology devices hit by C3RB3R ransomware, which reportedly adds the ".L0CK3D" extension to files.
- Synology urges users of vulnerable DSM versions to update immediately and recommends enabling automatic updates.
Article Details
- Event Type
- Ransomware attacks targeting Synology NAS devices by exploiting a vulnerability patched in December 2024.
- Impact
- The attacks aim to encrypt data and extort ransom. Synology did not disclose the specific flaw being exploited; customers have reported devices hit by C3RB3R ransomware.
MITRE ATT&CK
CVE
Malware
CerberThe development comes amid reports from customers that their Synology devices have been hit by C3RB3R ransomware, which has been observed locking users' files with a ".L0CK3D" extension.eCh0raixThis is not the first time NAS devices have been the target of ransomware attacks. In 2019, NAS devices manufactured by Taiwan-based QNAP Systems were compromised by QNAPCrypt (aka eCh0raix) ransomware.QNAPCryptThis is not the first time NAS devices have been the target of ransomware attacks. In 2019, NAS devices manufactured by Taiwan-based QNAP Systems were compromised by QNAPCrypt (aka eCh0raix) ransomware.StealthWorkerThen, in August 2021, Synology warned of brute-force attacks driven by a malware family called StealthWorker that led to ransomware infections.
Vendors
QNAPThis is not the first time NAS devices have been the target of ransomware attacks. In 2019, NAS devices manufactured by Taiwan-based QNAP Systems were compromised by QNAPCrypt (aka eCh0raix) ransomware.SynologySynology is urging customers to update the DiskStation Manager (DSM) software powering its Network Attached Storage (NAS) devices following ransomware attacks.