As outlined in Bleeping Computer, Synology has issued an urgent warning to customers regarding a surge in C3RB3R ransomware attacks targeting its network-attached storage devices.
The company reports that threat actors are actively exploiting vulnerabilities patched in December 2024 to compromise devices running outdated versions of DiskStation Manager. These attacks result in data encryption and subsequent extortion demands. While Synology has not specified the exact exploit, it referenced security advisories for vulnerabilities that allow for arbitrary code execution, file reading and file writing. Affected users report that the ransomware appends a .L0CK3D extension to files and leaves a ransom note demanding payment for a decryption tool. The C3RB3R ransomware shares a name with a notorious operation that was prominent between 2016 and 2019. Synology strongly urges users to update their software immediately and enable automatic updates to prevent further infections. Additionally, the company recommends blocking access to the management web interface from the internet. With over 380,000 Synology devices currently exposed online, the risk to users remains significant. The company rarely issues such security alerts, underscoring the severity of the current threat landscape for NAS owners.
Source: Bleeping Computer
