Synology warns of C3RB3R ransomware attacks targeting NAS devices

{"title": "Synology Alerts Users to Active C3RB3R Ransomware Hits on NAS Devices", "seo_title": "Synology NAS Exploited: C3RB3R Ransomware Attacks", "seo_description": "Exploited in the wild: Synology DSM pre-7.2.2 via CVE-2024-10441/50629/10445. C3RB3R ransomware encrypts files. Update to DSM 7.2.2-72806-1 or later.", "body_md": "Synology has issued an unusual security alert after detecting a wave of C3RB3R ransomware attacks hitting NAS devices running outdated DiskStation Manager (DSM) software. The company says attackers are exploiting a flaw that was already fixed back in December 2024, pointing to a cluster of bugs disclosed in its November 2024 advisory — CVE-2024-10441 (arbitrary code execution), CVE-2024-50629 (file read), and CVE-2024-10445 (file write) — to break into unpatched systems and encrypt data for ransom. Victims report files appended with a .L0CK3D extension and a ransom note demanding payment for a "C3rb3r Decryptor" tool, with the campaign apparently reviving the name of the old Cerber RaaS group that was prolific before 2020. Synology is urging all customers, especially those on DSM 7.2.2, 7.2.1, 7.2, 7.1, or 6.2, to update immediately to the patched builds, turn on automatic updates, and cut off internet-facing access to the management interface, noting that researchers currently count over 380,000 Synology NAS devices exposed online."}