Synology is urging customers to update their network-attached storage devices immediately after a surge in C3RB3R ransomware attacks, according to BleepingComputer. The company asked users to enable automatic updates and upgrade the DiskStation Manager (DSM) software running on their NAS devices to the latest version.
In an advisory published Thursday, October 29, Synology said it has identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM, with attacks that aim to encrypt data and extort a ransom. The company strongly urged all users running vulnerable versions to update DSM immediately and recommended enabling automatic updates so DSM stays current at all times.
Synology linked to a 2024 security advisory, SA-24:20, that covers patches for flaws allowing attackers to execute arbitrary code (CVE-2024-10441), read files (CVE-2024-50629) and write files (CVE-2024-10445) on unpatched devices. A Synology spokesperson directed BleepingComputer to the same advisory when asked which flaw is being exploited. Because those patches have been available for nearly two years, systems that kept their software current were already protected.
The advisory lists the fixed releases. DSM 7.2.2 users should move to 7.2.2-72806-1 or above, DSM 7.2.1 users to 7.2.1-69057-6 or above, and DSM 7.2 users to 7.2-64570-4 or above. DSM 7.1 users should upgrade to 7.1.1-42962-7 or above, and DSM 6.2 users to 6.2.4-25556-8 or above. The advisory rates the issue critical for the DSM 7 branches and moderate for DSM 6.2. NAS owners are also advised to block access to the management web interface from the internet.
The notice stands out because Synology rarely issues security advisories about attacks on its customers’ devices. The last such alert, according to BleepingComputer, came in August 2019 after large-scale brute-force attacks led to eCh0raix ransomware infections. Last week’s advisory followed a wave of reports from customers whose data had been encrypted. Affected users described a ransom note named read-me3.txt and a .L0CK3D extension added to encrypted files, with the note directing them to buy a tool called C3rb3r Decryptor.
The C3RB3R name, also written Cerber, borrows from a ransomware-as-a-service operation that emerged in 2016 and disappeared at the end of 2019. BleepingComputer reports that the original operation accounted for more than 80% of all ransomware attacks at its peak. Since December 2021, the C3RB3R name has also been used in attacks on Atlassian Confluence and GitLab servers.
In the same announcement, Synology said it is extending fixes for the PHP2Shell issue to older DSM releases, including DSM 7.0, 7.1 and 6.2. The notice treats this as a separate set of updates, so administrators should apply both rather than assuming one covers the other.
The advisory carries a practical lesson about storage appliances. A network-attached storage device often sits in a closet or a small office, runs for years without attention and holds the very files a ransomware crew wants to encrypt. Because the flaws at the center of this warning were fixed in December 2024, the attacks are not about a new zero-day. They are about devices that never received a patch that has been available for most of two years. Attackers do not need to be sophisticated when a known flaw is waiting on hundreds of thousands of reachable machines.
Internet threat watchdog Shadowserver tracks more than 380,000 internet-exposed Synology NAS devices, though it does not say how many have already been secured. That scale is one reason the guidance is so direct: devices that are exposed and out of date are the easiest for attackers to reach, and updating closes the door.
The checklist for IT teams is short. Confirm which DSM versions are running on every Synology device, update anything on an affected release, turn on automatic updates, block internet access to the management interface, and keep backups stored separately from the primary device. Synology’s security advisory page lists the fixed builds by DSM version.
Leave a Reply