Synology has confirmed that threat actors are exploiting a vulnerability it patched in late 2024 to break into Synology NAS devices running outdated versions of DiskStation Manager (DSM), encrypt their data and demand ransom. The company issued the warning on October 29 and urged all users on vulnerable versions to update DSM immediately.
The attacks are linked to the C3RB3R ransomware. Synology has not said how many customers have been hit, and the number of victims is unknown.
What Synology said
In a statement published October 29, Synology said it “has identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM. These attacks aim to encrypt data and extort ransom.”
Synology also recommended that users enable automatic updates so DSM stays current. The statement points to its security advisory Synology-SA-24:20 for details. It is the first time since the 2019 eCh0raix campaign that Synology has publicly warned customers about an active ransomware campaign against its devices.
The vulnerabilities behind the attacks
Synology-SA-24:20 covers 3 DSM flaws first demonstrated at the Pwn2Own Ireland 2024 hacking contest. Synology rates the advisory critical:
- CVE-2024-10441 (CVSS 9.8): an improper encoding or escaping flaw in the system plugin daemon that allows remote attackers to execute arbitrary code.
- CVE-2024-50629 (CVSS 5.3): a flaw in the webapi component that lets remote attackers read limited files.
- CVE-2024-10445 (CVSS 4.3): an improper certificate validation flaw in the update function that lets an adjacent attacker write limited files.
Synology has not said which of the 3 CVEs the attackers are using. CVE-2024-10441 is the only one that allows remote code execution without authentication, which makes it the most likely candidate, but that has not been confirmed. The same CVEs also affect Synology’s BeeStation OS (BSM) before version 1.1-65374.
Fixed DSM versions
The advisory was first published in November 2024, with fixes for older branches rolling out through early December 2024. Devices are protected on the following releases or later:
- DSM 7.2.2:
7.2.2-72806-1 - DSM 7.2.1:
7.2.1-69057-6 - DSM 7.2:
7.2-64570-4 - DSM 7.1:
7.1.1-42962-7 - DSM 6.2:
6.2.4-25556-8
Any NAS still running an older build than these has been exposed for nearly 2 years.
What victims are seeing
Victims have reported files renamed with a .L0CK3D extension and a ransom note named read-me3.txt that points them to a paid “C3rb3r Decryptor.” Reports from affected users began appearing more than 2 weeks before Synology’s statement, and Chinese security teams published warnings about the campaign on October 29.
C3RB3R is not new. The ransomware has previously been deployed through vulnerabilities in internet-facing servers, including Atlassian Confluence flaws CVE-2021-26084 and CVE-2023-22518 and GitLab flaw CVE-2021-22205. The NAS campaign follows the same playbook: find exposed, unpatched systems at scale and encrypt them.
Why exposed NAS devices are at risk
Many home and small business users expose DSM directly to the internet for remote access. Internet scanning by the Shadowserver Foundation tracks more than 380,000 Synology NAS devices reachable online. Not all of them run vulnerable versions, but any device that has not taken an update since 2024 is a target. Because a NAS is often the main backup location for a household or small office, encryption can wipe out the copy people rely on to recover.
Edge devices have been a steady entry point for ransomware crews this year, from Storm-1175’s zero-day driven Medusa attacks to Qilin’s exploitation of a PAN-OS VPN bypass. The Synology attacks show that older, already patched bugs remain just as useful when devices never get updated.
What Synology owners should do now
- Check your DSM version. Open Control Panel, then Update & Restore, and confirm you are on one of the fixed builds above or newer. Install any pending update.
- Turn on automatic updates. Synology recommends this so future security fixes install without manual action.
- Take DSM off the open internet. Close port forwarding for DSM and use a VPN or Synology’s relay services for remote access instead.
- Enable 2-factor authentication on all DSM accounts and disable the default admin account if it is still active.
- Keep an offline backup. A backup on the same NAS, or one the NAS can write to, can be encrypted along with everything else.
- Do not pay or use unknown “decryptors.” If files already show the
.L0CK3Dextension, disconnect the device from the network and contact Synology support.
