Synology NAS devices hit by C3RB3R ransomware exploiting previously patched flaws
- Severity
- High
- Sources
- 1
What happened
C3RB3R ransomware, provisionally identified, is encrypting files on Synology NAS devices (.L0CK3D extension, read-me3.txt note), reported by 360 Security Team and Solar. Synology advisory Synology-SA-24:20 covers CVE-2024-10441 (CVSS 9.8, unauthenticated RCE), CVE-2024-50629 (CVSS 5.3, limited file read) and CVE-2024-10445 (CVSS 4.3, limited file write via certificate validation). Public reporting does not confirm which flaw was used, whether they were chained, or the initial access vector, and one early investigation involved DSM 7.4.1-90080 Update 1. Defenders should apply the latest DSM and package updates, remove direct internet exposure of DSM and SSH, use a VPN, hunt for unknown admins, unusual logins and scheduled tasks, enable 2FA, and maintain offline backups.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Update DiskStation Manager and installed packages to the latest release supported by your NAS model.
- Remove direct internet access to DSM management and SSH, and use a VPN for remote connections.
- Check the NAS for unusual logins, unknown administrator accounts and unexpected scheduled tasks.
- Enable two-factor authentication and keep independent offline or off-site backups.
Written by AI from the sources, checked against them