Synology NAS owners: update DSM now as C3RB3R ransomware hits old versions
Synology says attackers are using a flaw patched in December 2024 to encrypt outdated NAS devices. Update DSM and lock down remote access.
The skim
- Synology says attackers are exploiting a flaw it patched in December 2024 to hit Synology NAS devices running outdated versions of DSM with C3RB3R ransomware.
- Synology points to a 2024 advisory whose most serious bug, CVE-2024-10441, can let a remote attacker run code on the device. It hasn't said exactly which flaw is being used.
- If you own a Synology NAS, update DSM now, turn on automatic updates and make sure its admin page isn't reachable from the internet.
What happened
In a notice published Oct. 29, Synology warned that "Synology has identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM." DSM is the operating system that runs Synology's network-attached storage boxes, which many homes and small offices use for file storage and backups.
Synology's notice refers users to advisory Synology-SA-24:20, which covers three flaws: CVE-2024-10441, which lets remote attackers execute arbitrary code and is rated 9.8 out of 10, plus CVE-2024-50629 and CVE-2024-10445, which let attackers read and write files. Synology hasn't said which one is being exploited, and when BleepingComputer asked, a spokesperson pointed to the same advisory.
According to BleepingComputer, victims started reporting infections more than two weeks ago. Infected devices get a ransom note named read-me3.txt, encrypted files get a .L0CK3D extension, and victims are told to buy a "C3rb3r Decryptor" from a dark web site for thousands of dollars. The same ransomware strain has previously hit Atlassian Confluence and GitLab servers. Hong Kong's HKCERT issued its own alert on Nov. 2.
Why it matters
This is the first time Synology has warned of an active ransomware campaign against its devices since the eCh0raix attacks in 2019, BleepingComputer notes. The Shadowserver Foundation tracks more than 380,000 Synology NAS devices exposed online, though it doesn't say how many are already patched.
A NAS is often where people keep the backups that are supposed to save them from ransomware. If the NAS itself gets encrypted, you can lose the originals and the safety net at the same time.
What to do now
- Check your DSM version. Sign in to DSM and open Control Panel > Update & Restore. The fixed versions are DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7 and 6.2.4-25556-8 or later. Whatever you're on, install the latest update offered for your model.
- Turn on automatic updates in the same Update & Restore section, as Synology recommends.
- Close the front door. Block internet access to the DSM management web interface, as BleepingComputer advises. If you need remote access, use a VPN instead of forwarding the admin port on your router.
- Keep an offline or cloud copy of anything irreplaceable, so the NAS isn't your only backup.
If you find a read-me3.txt note or .L0CK3D files, disconnect the NAS from the network and contact Synology support before trying to restore anything.
Sources: Synology, Synology security advisory, BleepingComputer and HKCERT.
