Taiwanese network-attached storage (NAS) maker Synology issued an advisory telling customers to update their DiskStation Manager (DSM) software immediately, following a surge in C3RB3R ransomware attacks. According to the company, the attackers are exploiting a vulnerability patched in December 2024 to target devices running outdated versions, encrypting data and demanding a ransom.
According to BleepingComputer, the first reports of encryption appeared more than two weeks ago: the ransomware adds a .L0CK3D extension to files, drops a ransom note and demands that victims buy a "decryptor" on a dark web site for thousands of dollars. Synology did not say which vulnerability is being exploited, but linked to a November 2024 advisory about flaws that allow code execution, file reads and file writes on unpatched devices. It is the company's first such alert since 2019.
What to do: update DSM to the latest version, turn on automatic updates and block internet access to the device's management interface. It is not yet known how many devices have been hit.