Ing. Calogero Bono
Synology has warned customers that some attackers are exploiting a vulnerability fixed in December 2024 to hit NAS devices running older versions of DSM. The attacks aim to encrypt data and demand a ransom. According to reports gathered by the industry press, the C3RB3R ransomware is behind them. For anyone keeping company archives on a NAS, the issue is concrete, because a single postponed update is enough.
A few terms before we get into the facts. NAS is a network-attached storage drive that shares files across a company. DSM is DiskStation Manager, the operating system of Synology NAS devices. CVE is the code that identifies a known vulnerability. CVSS is the severity score, from 0 to 10. N-day is a flaw already fixed but still exploitable on devices that were never updated.
What did Synology say about the attacks?
The Taiwanese manufacturer said it had observed attackers exploiting a vulnerability fixed in December 2024 against devices with obsolete DSM. In the statement, reported by The Hacker News, it reads that "these attacks aim to encrypt data and extort a ransom".
Synology urges those using vulnerable versions to update DSM immediately and recommends enabling automatic updates. It does not, however, indicate which flaw is being used.
Which vulnerabilities and which DSM versions?
The company points to a November 2024 advisory listing three flaws.
- CVE-2024-10441, CVSS 9.8, remote code execution.
- CVE-2024-50629, CVSS 5.3, reading of limited files.
- CVE-2024-10445, CVSS 4.3, writing of limited files.
The fixed versions
- DSM 7.2.2 with 7.2.2-72806-1 or later
- DSM 7.2.1 with 7.2.1-69057-6 or later
- DSM 7.2 with 7.2-64570-4 or later
- DSM 7.1 with 7.1.1-42962-7 or later
- DSM 6.2 with 6.2.4-25556-8 or later
According to TechRadar, only for 6.2 is the severity "moderate", elsewhere it is critical.
What is the C3RB3R ransomware?
Customer reports describe files locked with the .L0CK3D extension. According to The Hacker News, the Chinese company Qihoo 360 analyzed C3RB3R and describes a "long history" of attacks on NAS devices, including through two DSM flaws fixed by Synology in September 2026.
The malware skips 27 directories and certain extensions such as BAT, DLL and EXE, so as not to cause crashes that would hinder encryption. In every encrypted folder it leaves a ransom note called read-me3.txt. According to TechRadar, citing BleepingComputer, customers would have to pay "thousands of dollars" for the key.
Had NAS devices already been hit in the past?
Yes. In 2019 QNAP NAS devices were hit by QNAPCrypt, also known as eCh0raix. In August 2021 Synology warned of brute-force attacks linked to StealthWorker. That same month Unit 42 of Palo Alto Networks described a variant of eCh0raix capable of hitting both QNAP and Synology.
Unit 42 then estimated around 250,000 QNAP and Synology NAS devices exposed to the internet, mostly QNAP. The point is that small office devices are a steady target, often without dedicated security staff. For the risks facing small businesses, see our guide on ransomware for SMEs.
Limits to know
Synology does not say which vulnerability is being exploited, where, or with what success. It is not known how many devices are at risk. The Shadowserver Foundation counts 380,000 connected endpoints, many probably already updated. The link between the attack and C3RB3R comes from customer reports, not from confirmation by the manufacturer.
What changes for those working in digital
If you own a Synology NAS, check your DSM version today and compare it with the table. Enable automatic updates, as the company recommends. Remove the NAS from public access or limit it to a few verified users. Remember that RAID and built-in backups do not necessarily protect against encryption, so a separate copy is needed. If the damage has already happened, our guide on incident response and recovery without paying can help.
Our take
This case shows an old problem. A flaw fixed almost two years ago is still causing damage, because in small businesses the NAS is installed and then forgotten. The lack of transparency in the advisory also remains, since it does not name the flaw and forces users to infer it. A manufacturer should give more precise guidance, especially while attacks are ongoing. That said, responsibility for updating stays with whoever manages the device.
Frequently asked questions
Which Synology vulnerability is exploited in the attacks?
Synology has not identified it. It did point to a November 2024 advisory listing three flaws, including CVE-2024-10441 with a CVSS of 9.8. Which one is actually being used has not been confirmed.
Which DSM versions are safe?
Those equal to or later than the fixed builds, for example 7.2.2-72806-1 for 7.2.2 or 6.2.4-25556-8 for 6.2. Check the manufacturer's advisory for your version.
How can you recognize a NAS hit by C3RB3R?
Encrypted files carry the .L0CK3D extension, and each encrypted folder contains a note called read-me3.txt. These are the signs reported in the analyses cited.
Are RAID and NAS backups enough against ransomware?
Not necessarily. TechRadar notes that RAID and built-in backups do not necessarily protect against data encryption. A separate copy is required.
Should you enable automatic updates?
Yes, that is Synology's recommendation. This keeps DSM up to date without relying on anyone remembering to do it.
What to watch in the coming weeks on NAS attacks
The picture is still incomplete. It is worth following what Synology clarifies and how reports evolve.
- Check whether Synology publishes a more detailed advisory naming the exploited flaw.
- Verify that your NAS does not respond to internet traffic with an external access test.
- Try restoring a backup disconnected from the NAS, so you know it actually works.
