C3RB3R Ransomware Exploits Unpatched Synology DSM Versions to Encrypt NAS Data
What Happened — Synology announced a surge in C3RB3R ransomware activity targeting Network‑Attached Storage (NAS) devices that run outdated versions of DiskStation Manager (DSM). Threat actors are leveraging a vulnerability patched in December 2024 (the same fixes that address CVE‑2024‑10441, CVE‑2024‑50629, and CVE‑2024‑10445) to gain code execution, read/write files, and ultimately encrypt data. Infected systems receive a ransom note and a “.L0CK3D” file extension, with attackers demanding payment for a decryption tool. Synology’s advisory urges all customers to upgrade to the latest DSM releases (7.2.2‑72806‑1 or newer, etc.) and to enable automatic updates and internet‑blocking of the management web UI.
Why It Matters for Trust & Control Assurance — The incident tests the effectiveness of your vulnerability‑management and patch‑deployment controls, a single control objective that maps to many compliance frameworks.
Who Is Affected — Organizations across all sectors that deploy Synology NAS appliances (e.g., technology firms, healthcare providers, education institutions, SMBs).
Recommended Actions
- Identify the DSM version on every Synology device and upgrade to the latest release.
- Enable automatic DSM updates and enforce network‑level blocking of the management interface from the Internet.
- Document the patch‑deployment process and retain evidence for audit readiness.
Technical Notes
- Attack vector: Exploitation of a patched DSM vulnerability (CVE‑2024‑10441, CVE‑2024‑50629, CVE‑2024‑10445).
- Ransomware behavior: File encryption with “.L0CK3D” extension, ransom note “read‑me3.txt”.
- Severity: Critical for affected DSM versions.
Source: BleepingComputer