C3RB3R Ransomware Targets Synology NAS via Patched Vulnerabilities
Attackers are leveraging previously patched vulnerabilities in Synology NAS devices to deploy the C3RB3R ransomware, encrypting user files and demanding payment.
Synology NAS devices are currently under attack by the C3RB3R ransomware, which exploits security flaws that the company had previously addressed through software updates. The attacks were reported by security teams, including the 360 Security Team and Solar Emergency Response Team, prompting Synology to issue a renewed warning to users to update their DiskStation Manager (DSM) software and installed packages.
Victims of these attacks have reported finding their files encrypted with the distinctive .L0CK3D extension, accompanied by a ransom note named read-me3.txt. Security researchers have provisionally identified the ransomware strain as C3RB3R. While the exact number of compromised devices remains unclear, the ongoing nature of the attacks underscores the persistent threat to NAS users.
The vulnerabilities exploited in these attacks include CVE-2024-10441, a critical flaw in Synology DSM with a CVSS score of 9.8 that allows for unauthenticated remote code execution without user interaction. Additionally, CVE-2024-50629, a webapi flaw enabling limited file reading, and CVE-2024-10445, a certificate validation flaw allowing adjacent attackers to write limited files, are also implicated. These vulnerabilities were disclosed following the Pwn2Own 2024 competition.
Synology released a security advisory, Synology-SA-24:20, detailing these vulnerabilities and providing patches. While initial reports suggested fixes were available by December 2024, Synology's update history indicates that patches were rolled out throughout November 2024. The advisory lists fixed releases for various DSM versions, including DSM 7.2.2-72806-1 and older branches, emphasizing the need for administrators to install the latest supported versions for their specific NAS models.
It remains unclear which specific vulnerability or combination of vulnerabilities attackers are using to gain initial access. Early reports investigated an affected device running a seemingly updated DSM version, leading to speculation about a potential zero-day exploit. However, later analysis pointed towards the exploitation of older, already patched weaknesses, suggesting that unpatched or improperly updated systems are the primary targets.
This incident is not the first time Synology NAS devices have been targeted by ransomware. Previous attacks, such as the Diskstation ransomware campaign, have highlighted the attractiveness of NAS systems for data encryption and extortion. However, current reports do not indicate any connection between the C3RB3R attacks and these prior incidents.
To mitigate the risk, Synology and security researchers strongly advise users to update their DSM and all official packages to the latest available versions. Beyond patching, best practices include disabling direct internet access to the DSM management interface and SSH, using VPNs for remote access, enabling two-factor authentication (2FA), and regularly checking for unusual login activity or unauthorized administrative changes. Maintaining independent, offline, or off-site backups is crucial for recovery in the event of an encryption attack.
The ongoing exploitation of patched vulnerabilities serves as a stark reminder that timely patching and robust security hygiene are paramount for protecting networked-attached storage devices, which often contain sensitive personal and business data.