Synology network-attached storage (NAS) units are being targeted by C3RB3R ransomware using vulnerabilities disclosed in 2024—some of which were already patched. Users are being urged to ensure their DiskStation Manager versions and related packages are fully updated to avoid encryption of files with the “.L0CK3D” extension and the appearance of a ransom note titled read-me3.txt. The potential scope of the attack—how many devices are compromised—remains unclear.
Patched Flaws Reused in New Attacks
The attacks capitalize on three previously disclosed vulnerabilities described in Synology Security Advisory 24:20, released initially on November 5, 2024, following Pwn2Own 2024. Among them is CVE-2024-10441, a critical flaw with a CVSS score of 9.8 that allows remote code execution without authentication or user interaction. Two additional vulnerabilities—CVE-2024-50629 and CVE-2024-10445—were also identified. The former permits remote file reading via a web API, while the latter involves improper certificate validation allowing limited file writes by adjacent attackers.
Although these vulnerabilities were patched by the end of 2024—updates arriving throughout November for various DSM branches—affected devices are still being exploited. Security teams observed infections in devices running DSM 7.4.1-90080 Update 1, a version which was already thought to be secure. It’s not yet confirmed whether a zero-day is involved, or whether attackers are chaining patched vulnerabilities to break in.
Updates and Mitigation Advice
Official patched release thresholds include DSM versions 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7, and 6.2.4-25556-8. Administrators are advised not only to move to these or newer DSM versions but to maintain all official packages and third-party components. Despite updating, already encrypted files cannot be restored from updates alone.
Security guidance further recommends removing direct internet access to DSM management and SSH, using VPNs for remote connections, enabling two-factor authentication, and routinely checking system logs for abnormal admin accounts or scheduled tasks. Offline or off-site backups are stressed as essential erasure protection against data loss from ransomware.
Background: Synology has faced multiple ransomware attacks in the past targeting NAS systems. The current wave—known under the name C3RB3R—is associated with the recent attacks but has no confirmed overlap with earlier Synology incidents. Prior to this outbreak, the critical flaw CVE-2024-10441 was explored widely due to its severity and its capacity to clear major security barriers.
C3RB3R appears to be at the forefront of the latest ransomware threats, exploiting gaps long believed to be closed. Users must assume these vulnerabilities are under active attack, even if patched, and behave accordingly.
Why This Matters & What to Watch
This incident underscores how attackers can still leverage previously patched vulnerabilities when devices aren’t fully updated—or still accessible over the internet despite security fixes. Organizations relying on Synology NAS for storing sensitive data face a heightened risk unless strict practices are followed: prompt patching, strong remote access protocols, and isolated backups must be standard.
Going forward, observers should monitor whether new, previously unknown vulnerabilities are uncovered in Synology systems. Also key to watch: whether patch thresholds announced truly prevent exploitation in the wild, and whether Synology or third–party researchers can identify the exact attack paths used in C3RB3R incidents.
