Synology has detected C3RB3R ransomware attacks against NAS devices running vulnerable versions of DiskStation Manager (DSM). The company says attackers are exploiting a vulnerability patched in December 2024 to encrypt data and demand a ransom. Its advisory urges users to update DSM immediately and enable automatic updates.
The specific flaw used in the attacks has not been identified. Synology referred users to its November 2024 security advisory, which describes three separate vulnerabilities in DSM: one allows remote code execution; another allows certain files to be read; and the third allows limited files to be written through an issue in certificate validation during updates.
Encrypted files and a ransom demand
Reports of the incidents began appearing from users weeks before Synology published its warning. BleepingComputer notes that the first complaints were recorded more than two weeks before its November 2 report. Victims described files encrypted with the .L0CK3D extension and a note offering the “C3rb3r Decryptor” tool to recover the data.
According to BleepingComputer, the note directs victims to a dark web portal and demands thousands of dollars for the decryptor. RedesZone also says the attackers request payment through the Tor network. There is no guarantee that paying will restore the files: INCIBE advises against doing so, according to RedesZone, which also warns that victims could face further attacks or another demand for money.
The ransomware aims to encrypt documents and other files stored on affected devices. BleepingComputer observed that the ransom note offers to restore one file for free as proof that the decryptor works. That offer does not change Synology’s recommendation: patch the system and keep it up to date.
Patches cover several DSM branches
Synology’s security advisory lists these patched versions: DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7, and 6.2.4-25556-8, or later versions. The company urges users running vulnerable versions to install the update for their branch and enable automatic updates.
The three vulnerabilities cited in the advisory have different impacts. CVE-2024-10441, with a CVSS score of 9.8, may allow remote code execution. CVE-2024-50629 enables limited file reads, while CVE-2024-10445 allows limited file writes and is related to certificate validation in the update function. Synology has not confirmed which of them is being exploited in the C3RB3R campaign.
BleepingComputer also advises blocking access to the NAS web administration interface from the Internet and updating DSM. Shadowserver reports more than 380,000 NAS devices exposed to the Internet, but does not specify how many remain unpatched or how many are honeypots. That figure therefore does not equal the number of vulnerable or compromised devices.
The C3RB3R name has also been associated with attacks against Atlassian Confluence and GitLab servers, according to BleepingComputer. In this campaign, the reported targets are Synology devices that continue to run affected DSM versions. The company continues to recommend updating; the specific vulnerability exploited in these attacks has not yet been identified.
Sources: RedesZone, The Hacker News, BleepingComputer, Synology
