Hackers Exploit Patched Synology NAS Vulnerabilities to Deploy C3RB3R Ransomware and Encrypt Files

Synology NAS devices are facing C3RB3R ransomware attacks linked to 2024 security flaws, prompting the company to urge users to update outdated DiskStation Manager versions and packages.

The warning followed reports from the 360 Security Team and Solar Emergency Response Team on October 29. Victims found their files encrypted with the .L0CK3D extension and a ransom note named read-me3.txt.

Security teams provisionally identified the ransomware as C3RB3R. The available reporting does not establish how many devices have been compromised.

The Synology security advisory, tracked as Synology-SA-24:20, covers three vulnerabilities disclosed following Pwn2Own 2024. Published on November 5, 2024, it received several updates as fixes became available across DSM branches.

Although Appinn described the weaknesses as fixed by December 2024, Synology’s revision history shows that several patches arrived during November.

Cyber Security News previously examined the critical CVE-2024-10441 flaw in Synology DSM, which carries a CVSS score of 9.8 and allows unauthenticated remote code execution without user interaction.

Synology NAS Hit by C3RB3R Ransomware Attacks

The advisory also lists CVE-2024-50629, a webapi flaw that lets remote attackers read limited files, and CVE-2024-10445. This update certificate validation flaw lets an adjacent attacker write limited files. These carry scores of 5.3 and 4.3, respectively.

Public reporting has not established which individual vulnerability was used in each ransomware incident or whether attackers combined them.

Early coverage raised concerns because Solar reportedly investigated an affected device running DSM 7.4.1-90080 Update 1. At that stage, researchers were still examining the entry point and had not ruled out an unknown vulnerability.

The later report attributed Synology’s findings to older, patched weaknesses. The published accounts do not explain the apparent mismatch or confirm a new zero-day attack.

Synology NAS devices have faced ransomware threats before. Cyber Security News covered the Diskstation ransomware investigation, involving criminals who targeted Synology storage systems. That separate case provides background on the threat to NAS users. However, the available reports do not establish any connection to C3RB3R.

Synology’s advisory lists fixed releases including DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7, and 6.2.4-25556-8. These are historical patch thresholds, not a recommendation to stop updating. Administrators should install the latest release supported by their NAS model and update official packages and third-party components.

Appinn’s initial incident report recommends removing direct internet access to DSM management and SSH, using a VPN for remote connections, and checking for unusual logins, unknown administrators, and scheduled tasks.

It also advises enabling two-factor authentication and keeping independent offline or off-site backups. For affected users, those separate backups may provide a route to recover encrypted files. Updating remains necessary, but it does not itself restore files already encrypted by ransomware.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.