Synology warned of active ransomware attacks exploiting long-patched DSM vulnerabilities on unupdated NAS devices
Attackers are reportedly deploying the C3rb3r encryptor and demanding thousands of dollars in ransom
Users are urged to patch immediately, restrict internet exposure, and secure NAS access to prevent compromise
Synology, a major network-attached storage (NAS) manufacturer, is warning users about ongoing ransomware attacks targeting devices running outdated software. It urged all users to apply provided patches and secure their devices without delay. In a brief announcement, Synology said it “identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM.” The goal of the attacks seem to be data encryption and a ransom demand. “Synology strongly urges all users running vulnerable versions to update DSM immediately to protect their systems. Synology also recommends enabling automatic updates to keep DSM up to date at all times.” C3rb3r attacks
The announcement is rather stingy on the details. We don’t know which vulnerability the threat actors are exploiting, where exactly, or how successful they are. We also don’t know how many devices are at risk – the Shadowserver Foundation tracks a total of 380,000 internet-connected endpoints (many of which are, most likely, running the latest software version and are thus protected). The company also did not say who the threat actors are, but according to BleepingComputer , there has been a “massive wave of reports” from Synology customers whose data was apparently locked down by the “C3rb3r” encryptor. These customers were asked to pay “thousands of dollars” in ransom, in exchange for the decryption key. The publication says the first reports started surfacing more than two weeks ago…