Synology NAS ransomware surge: update DSM and block web access

Synology has warned customers about a rise in C3RB3r ransomware attacks that target network-attached storage devices running outdated DiskStation Manager software, according to BleepingComputer. The company urged users to enable automatic updates and upgrade DSM to the latest patched releases to protect their data.

What Synology has said and the known facts

According to BleepingComputer, Synology reported that threat actors are exploiting a vulnerability patched in December 2024 to attack devices running older DSM builds. Synology linked its advisory to a November 2024 security notice that lists three addressed issues: CVE-2024-10441, CVE-2024-50629, and CVE-2024-10445. The company recommended updating to fixed DSM releases and turning on automatic updates.

BleepingComputer published the upgrade guidance Synology provided, which lists fixed-release availability for several DSM lines, for example:

• DSM 7.2.2: Upgrade to 7.2.2-72806-1 or above.
• DSM 7.2.1: Upgrade to 7.2.1-69057-6 or above.
• DSM 7.2: Upgrade to 7.2-64570-4 or above.
• DSM 7.1: Upgrade to 7.1.1-42962-7 or above.
• DSM 6.2: Upgrade to 6.2.4-25556-8 or above.

The advisory also told users to block access to the management web interface from the Internet, a straightforward step to reduce remote exposure.

How the ransomware is operating

Reports collected by outlets show affected Synology users saw files encrypted with a .L0CK3D extension and a ransom note named read-me3.txt dropped in encrypted folders. BleepingComputer reproduced part of the note, which includes the line, "All your important files have been encrypted." The note directs victims to buy a "C3rb3r Decryptor" from a dark web site.

The malware family now called C3RB3r (also referenced as CerberImposter) has prior history. BleepingComputer notes it borrowed its name from an older Cerber RaaS that was active through 2019, and that C3RB3r has previously been used against servers such as Atlassian Confluence and GitLab by exploiting known remote code execution and authentication bypass flaws.

Who might be exposed

BleepingComputer cites internet threat monitoring showing many Synology devices are visible on the public Internet. The outlet reports Shadowserver tracks more than 380,000 internet-exposed Synology NAS devices, though that tracker does not say how many are patched or safe. Synology also said the attacks are targeting devices running outdated DSM versions, and customer reports of encrypted data began surfacing more than two weeks before the advisory.

Synology NAS ransomware: what to do now

If you manage one or more Synology NAS devices, treat this as urgent. Practical steps include:

• Apply Synology's DSM updates now: upgrade to the fixed releases listed in Synology's advisory (for example, 7.2.2-72806-1 or higher for DSM 7.2.2). Follow Synology's release guidance exactly.
• Enable automatic updates so future patches install without manual steps.
• Block management web access from the Internet. Restrict the NAS management interface to private networks or VPN access only.
• Verify and isolate backups. Confirm you have recent offline or air-gapped backups before making changes, and keep them disconnected from the network until you need them.
• If you suspect compromise, disconnect the device from the network, preserve logs, and avoid reconnecting it until you have assessed the situation.
• Review who has administrative access and rotate any weak or shared credentials; consider stronger authentication for admin accounts.
• If you do not have in-house expertise, contact a security professional before attempting recovery.

For a quick external check of your site exposure, start with a free external scan on our security page: /security.html.

If a device is already encrypted

If you find a device with encrypted files or the read-me3.txt ransom note, do not immediately reconnect the device to your network. BleepingComputer's reporting shows the attackers use encryption and a dropped ransom file to demand payment for a decryptor. At a minimum, disconnect the device, collect evidence such as logs and timestamps, and use backups to restore data where possible. Consider engaging incident response or a forensic specialist to avoid losing evidence and to reduce the chance of reinfection.

Context and past incidents

BleepingComputer points out Synology rarely publishes alerts about active attacks; the previous notable warning was in August 2019 after brute-force activity that led to eCh0raix infections. The group behind C3RB3r has been observed in multiple campaigns over recent years, including attacks on other server products via previously patched remote code execution and authentication flaws.

Bottom line

Synology NAS ransomware attacks target devices that have not been updated. Follow Synology's advisory, apply the listed DSM updates, enable automatic updates, and block Internet access to management interfaces. If you have backups and follow the steps above you will reduce the chance of data loss and downtime.