Synology Warns of C3RB3R Ransomware: Update DSM Now
Synology says C3RB3R ransomware is hitting NAS boxes on outdated DSM. Here are the safe versions and the steps to lock your NAS down today.
If you own a Synology NAS and haven't touched its updates in a while, stop and check it today. Synology says ransomware gangs are breaking into boxes that run old versions of its DSM software and locking up everything stored on them.
What happened
In a notice dated October 29, Synology said attackers are exploiting a vulnerability it patched back in December 2024, going after devices still running outdated DSM releases. It didn't name the exact bug, but the notice points to its SA-24:20 advisory, which covered flaws that let an attacker run code and read or write files on an unpatched NAS.
BleepingComputer (which flagged it on X) says owners started reporting infections more than two weeks ago. Victims find their files renamed with a .L0CK3D extension and a ransom note called read-me3.txt in their folders, pushing them to buy a "C3rb3r Decryptor" from a dark web site. Hong Kong's HKCERT put out its own alert on November 2.
Why it matters
Synology almost never publishes warnings like this. The last time was in 2019, during the eCh0raix brute-force wave. A NAS is often where the family photos, the work archive and the "backup of the backup" all live, so losing one hurts far more than losing a laptop. Shadowserver tracks more than 380,000 Synology boxes reachable from the internet, and plenty of them were set up years ago and then forgotten in a cupboard.
The annoying part is that the fix has been sitting there for almost two years. This is the kind of attack that only lands on devices nobody's been looking after.
What to do
- Open DSM, go to Control Panel, then Update & Restore, and install the newest DSM your model supports. Turn on automatic updates while you're in there.
- Per SA-24:20, the minimum safe builds are DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7 and 6.2.4-25556-8. Newer is better.
- Don't leave the DSM login page open to the internet. Close port forwarding on your router and reach the NAS over a VPN instead. My Tailscale vs WireGuard comparison covers the easy options.
- Keep at least one backup that's offline or can't be overwritten, like a USB drive you unplug afterwards.
- Already seeing .L0CK3D files? Pull the network cable, don't reset the box, and get help before you do anything else. Updating DSM won't decrypt files that are already locked.
Comments ()