Synology urges immediate updates as C3RB3r ransomware attacks hit NAS devices
Synology has issued a rare security advisory urging customers to patch their network-attached storage devices immediately as attackers exploit a vulnerability patched in December 2024 to deploy C3RB3r ransomware that encrypts data and demands ransom.
BleepingComputer
Taiwanese network-attached storage maker Synology issued a security advisory on Thursday urging customers to update their devices immediately in response to a surge in C3RB3r ransomware attacks that encrypt data and extort ransom payments.
The company said threat actors are exploiting a vulnerability that was patched in December 2024 to target devices running outdated versions of DiskStation Manager (DSM), the software that runs on its NAS appliances. Synology strongly urged all users running vulnerable versions to update DSM right away and to enable automatic updates to keep the software current at all times.
Synology has not identified the specific flaw being abused in the ongoing attacks. Its advisory linked to a November 2024 security notice describing patches for three vulnerabilities that allow attackers to execute arbitrary code (CVE-2024-10441), read files (CVE-2024-50629) and write files (CVE-2024-10445) on unpatched devices. A Synology spokesperson was not immediately available when BleepingComputer sought further information about the attacks.
Customers were advised to immediately block access to the DSM management web interface from the Internet and to update their DSM software to prevent attackers from hacking and encrypting their devices.
The advisory followed a wave of reports from Synology customers whose data was encrypted and who were prompted to buy a "C3rb3r Decryptor" tool from a dark web portal for thousands of dollars. The first reports surfaced more than two weeks ago, with affected users describing a ransom note named read-me3.txt and encrypted files given a .L0CK3D extension.
"All your important files have been encrypted," the note warns, adding that attempts to restore files with third-party software would be fatal and that the only safe option is to purchase the C3rb3r Decryptor. The note also offers to restore one file for free so victims can verify the tool works.
The C3RB3r name, also written as Cerber and known as CerberImposter, is borrowed from a notorious ransomware-as-a-service operation that emerged in 2016. Before disappearing at the end of 2019, that operation accounted for more than 80 percent of all ransomware attacks and a quarter of all ransomware infections on enterprise endpoints.
The newer C3RB3R strain was first spotted in December 2021 and has since been deployed against Atlassian Confluence and GitLab servers in several attack waves exploiting remote code execution flaws CVE-2021-26084 and CVE-2021-22205, as well as the authentication bypass flaw CVE-2023-22518.
Internet threat watchdog Shadowserver currently tracks more than 380,000 Internet-exposed Synology NAS devices, though it does not indicate how many have been secured against these attacks or how many are honeypots. Synology rarely issues advisories warning of attacks on its customers, with its previous alert published in August 2019 after large-scale brute-force attacks led to eCh0raix ransomware infections.