Synology warns of C3RB3R ransomware attacks targeting NAS devices

Synology is urging customers to update their network storage devices immediately after reporting a surge in attacks using C3RB3R ransomware, according to BleepingComputer.

The company says attackers are using a flaw that was fixed in December 2024 to hit devices with old DiskStation Manager (DSM) software. (BleepingComputer)

In a Thursday advisory, Synology said these attacks encrypt data and demand ransom, urging users to update DSM right away. (BleepingComputer)

The attackers are using the C3RB3R ransomware, which encrypts files and adds a .L0CK3D extension, then leaves a ransom note demanding payment for a ‘C3rb3r Decryptor’ tool.

You need to check your device’s software version and update it right away to stop them.

What to check this week

First, check your DSM software version and upgrade to the latest release for your specific model.

• DSM 7.2.2: Upgrade to 7.2.2-72806-1 or above.
• DSM 7.2.1: Upgrade to 7.2.1-69057-6 or above.
• DSM 7.2: Upgrade to 7.2-64570-4 or above.

DSM 7.1: Upgrade to 7.1.1-42962-7 or above.

DSM 6.2: Upgrade to 6.2.4-25556-8 or above.

Second, enable automatic updates in your DSM settings to keep the software current at all times.

Third, block access to the management web interface from the Internet to prevent attackers from reaching your device.

Synology has not yet shared information about patches for three specific vulnerabilities that allow attackers to execute arbitrary code, read files, and write files on unpatched devices.

Internet threat watchdog Shadowserver tracks over 380,000 Internet-exposed Synology NAS devices, though it doesn’t specify how many have been secured against these specific attacks.

Synology rarely issues such warnings; the last one appeared in August 2019 after brute-force attacks led to eCh0raix infections, according to BleepingComputer.

Cheap to fix now, expensive to fix later. Check your NAS version today.

Sources: BleepingComputer.