Synology has warned customers that attackers are encrypting data and demanding ransom on its network-attached storage devices that still run outdated software, BleepingComputer reported Monday. Network-attached storage, or NAS, devices are file servers that many small businesses, branch offices and departments use for shared files and backups, so an attack on them can take out the copies an organization would need to recover.
What Happened
In a notice dated Oct. 29, the Taipei-based company said threat actors are "exploiting a vulnerability patched in December 2024" on devices running old versions of DiskStation Manager (DSM), its NAS operating system. It told anyone on a vulnerable version to update immediately and turn on automatic updates. It did not name the flaw or say how many customers were hit.
The notice points to Synology's advisory SA-24:20, which covers three flaws revealed at the 2024 Pwn2Own hacking contest. The most serious, CVE-2024-10441, lets an attacker run code remotely without logging in and carries a severity score of 9.8 out of 10. The advisory was first published in November 2024, and its revision history shows fixes for older DSM versions arriving into early December. Synology has not explained the date mismatch, and a spokesperson was not immediately available for comment, BleepingComputer reported. The advisory lists no workaround other than updating.
The ransomware, C3RB3R, takes its name from Cerber, a ransomware operation that emerged in 2016, and has been used since December 2021 against Atlassian Confluence and GitLab servers, according to BleepingComputer. Victim reports surfaced more than two weeks before Synology's notice. The ransom note sells a decryption tool through a dark-web site, which victims reportedly were charged thousands of dollars for.
Why It Matters
Synology rarely issues attack warnings; its previous one came in August 2019 during the eCh0raix ransomware campaign, BleepingComputer noted. Shadowserver, a nonprofit that scans the internet for exposed systems, tracks more than 380,000 Synology NAS devices reachable online, but it does not say how many are patched.
Storage appliances often sit outside central patching programs, which is how a fix nearly two years old can still leave devices open. Beyond updating, BleepingComputer advises blocking internet access to the DSM management interface. Leaders should also confirm that at least one backup copy is kept offline or on a separate system that the NAS cannot overwrite.
What to Watch
Whether Synology names the exploited flaw or discloses how many customers were hit, and whether Shadowserver or others report how many exposed devices remain unpatched.
