Taiwanese network-attached storage maker Synology says attackers are using a vulnerability fixed in December 2024 to hit devices running outdated versions of DiskStation Manager. The company says the attacks are meant to encrypt data and extort ransom, and it has urged users to update right away.
Synology C3RB3R attack details
Synology told users to enable automatic updates and move their DiskStation Manager software to the latest version. In a Thursday advisory, it said the threat actors are targeting devices that still run vulnerable releases. The company also said its update advice is aimed at protecting systems from encryption and ransom demands. A Synology spokesperson was not immediately available when BleepingComputer asked for more details.
What Synology says to do
Synology advises users to block access to the management web interface from the Internet and update DSM so attackers cannot use the flaw to break in and encrypt devices. The company has not said which vulnerability is being abused in the current wave, but it pointed to a November 2024 security advisory that covered fixes for three bugs on unpatched devices. Those flaws allow arbitrary code execution through CVE-2024-10441, file reading through CVE-2024-50629, and file writing through CVE-2024-10445.
DSM versions and fixes
Product | Severity | Fixed Release Availability
DSM 7.2.2 | Critical | Upgrade to 7.2.2-72806-1 or above.
DSM 7.2.1 | Critical | Upgrade to 7.2.1-69057-6 or above.
DSM 7.2 | Critical | Upgrade to 7.2-64570-4 or above.
DSM 7.1 | Critical | Upgrade to 7.1.1-42962-7 or above.
DSM 6.2 | Moderate | Upgrade to 6.2.4-25556-8 or above.
Earlier Cerber activity
Synology rarely publishes alerts about attacks against its customers. The last one before this was in August 2019, after large-scale brute-force attacks led to eCh0raix ransomware infections. The current wave follows a broad set of reports from customers whose data was encrypted and who were asked to buy a “C3rb3r Decryptor” tool from a dark web portal for thousands of dollars.
The first reports appeared more than two weeks ago. Affected users said the ransomware dropped read-me3.txt and added the .L0CK3D extension to encrypted files. One ransom note said, “All your important files have been encrypted.” It also warned that trying third-party recovery software would be fatal for the files and said the only safe way to decrypt them was to buy the special decryption software.
The same note said users could get instructions for buying the decryption software and could restore one file for free to check that “C3rb3r Decryptor” would work. The ransomware used in these attacks is also known as C3RB3R and CerberImposter, and it borrows its name from a ransomware-as-a-service operation with the same name that appeared in 2016. Before that older operation disappeared at the end of 2019, it accounted for more than 80% of all ransomware attacks and a quarter of all ransomware infections on enterprise endpoints.
Other C3RB3R campaigns and exposure
Starting in December 2021, C3RB3R was also used against Atlassian Confluence and GitLab servers in several attack waves. Those waves used remote code execution flaws CVE-2021-26084 and CVE-2021-22205, along with the authentication bypass flaw CVE-2023-22518. Shadowserver now tracks over 380,000 Internet-exposed Synology NAS devices, but it does not say how many are already secured or are honeypots.
Licensed under CC BY-ND 4.0 International