Synology urges immediate DSM updates as C3RB3R ransomware targets NAS devices
Owners of exposed, outdated Synology storage appliances face encrypted data unless they patch and restrict remote access to the management interface.
Synology, the Taiwanese maker of network-attached storage appliances, has told customers to update DiskStation Manager immediately after a rise in C3RB3R ransomware attacks against its NAS devices. The attackers are exploiting a flaw that was patched in December 2024 on systems still running older DSM builds, encrypting data and demanding payment. Victims have reported a ransom note and a .L0CK3D file extension, with a paid decryptor offered through a dark web site. Synology advises blocking access to the management interface from the internet and turning on automatic updates, and the company has not yet disclosed patches for three further flaws. Shadowserver counts more than 380,000 internet-exposed Synology NAS devices.
Why it matters
Network-attached storage often holds backups and shared files for households and small offices, so an attack that encrypts it can halt access to that data across a whole network. The attackers are exploiting a flaw Synology patched in December 2024, which means the risk falls on owners who have not installed that update rather than on the devices as a whole. Synology has not yet released fixes for three further vulnerabilities, so owners who keep their management interface reachable from the internet remain exposed even after updating. Shadowserver's count of more than 380,000 internet-exposed devices shows how many people could be affected if they do not act.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.