SecOraLens
CriticalRansomware

Hackers Exploit Patched Synology NAS Vulnerabilities to Deploy C3RB3R Ransomware and Encrypt Files

Cyber Security News·Source published ·1 min read

What happened?

Synology NAS devices are facing C3RB3R ransomware attacks linked to 2024 security flaws, prompting the company to urge users to update outdated DiskStation Manager versions and packages. The warning followed reports from the 360 Security Team and Solar Emergency Response Team on October 29. Victims found their files encrypted with the.L0CK3D extension and a ransom note named read-me3.txt. Security teams provisionally identified the ransomware as C3RB3R. The available reporting does not establish how many devices have been compromised.

Key details

  • Synology NAS devices are being targeted by C3RB3R ransomware linked to 2024 security flaws.
  • Victims found files encrypted with .L0CK3D extension and a ransom note named read-me3.txt.
  • Synology advisory Synology-SA-24:20 covers three vulnerabilities disclosed after Pwn2Own 2024.
  • CVE-2024-10441 allows unauthenticated remote code execution with CVSS 9.8.
  • CVE-2024-50629 lets remote attackers read limited files, CVE-2024-10445 lets adjacent attacker write limited files.
  • Reports have not established which vulnerability was used in each ransomware incident.
  • Synology urges users to update outdated DSM versions and packages.

Fixes and mitigations

  1. Install the latest DSM release supported by the NAS model and update official and third-party packages.
  2. Fixed DSM releases include 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7, and 6.2.4-25556-8.
  3. Remove direct internet access to DSM management and SSH; use VPN for remote connections.
  4. Enable two-factor authentication and keep independent offline or off-site backups.

What to look for

  • Files encrypted with .L0CK3D extension.
  • Ransom note named read-me3.txt present.
  • Unusual logins, unknown administrators, or unexpected scheduled tasks.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.

Back to all advisories