Synology Warns of C3RB3R Ransomware Targeting NAS Devices

Taiwanese network-attached storage (NAS) manufacturer Synology is urging customers to update their devices immediately after a spike in C3RB3R ransomware attacks targeting NAS systems running older versions of DiskStation Manager (DSM). The company recommends enabling automatic updates, installing the latest available DSM release and blocking Internet access to the NAS management interface.

“Synology has identified attackers targeting devices running older versions of DSM by exploiting vulnerabilities patched in December 2024. These attacks aim to encrypt data and extort a ransom,” the company said in a Thursday advisory.

“Synology strongly recommends all users running vulnerable versions to update DSM immediately to protect their systems. We also recommend enabling automatic updates to keep DSM up to date.”

Synology urges users to secure vulnerable NAS devices

When BleepingComputer requested additional information about the C3RB3R attacks, a Synology spokesperson was not immediately available.

Synology has not disclosed which vulnerabilities are being exploited in the ongoing attacks. However, its November 2024 security advisories describe patches for flaws that allow attackers to execute arbitrary code (CVE-2024-10441), read files (CVE-2024-50629) or write files (CVE-2024-10445) on unpatched devices.

Users should immediately block Internet access to the DSM management web interface and update their software to help prevent attackers from compromising and encrypting their NAS devices.

Victims report encrypted files and ransom demands

Synology rarely issues security advisories about attacks targeting its customers’ devices. The company’s previous alert was issued in August 2019 after a large-scale brute-force attack led to eCh0raix ransomware infections.

The latest advisory followed extensive reports from Synology customers who said their data had been encrypted and that they were directed to purchase the “C3rb3r Decryptor” from a dark web portal for thousands of dollars.

The first reports appeared more than two weeks ago. Affected users said the ransomware created a ransom note named read-me3.txt and added the .L0CK3D extension to encrypted files. Additional victim reports and ransomware discussions were posted on Reddit.

The ransom note states:

“All your important files are encrypted. Any attempt to restore them using third-party software will be fatal to your files. The only way to safely decrypt your files is to purchase a special decryption software ‘C3rb3r Decryptor.’”

“This page will show you the complete steps on how to buy the decryption software to restore all your files. Also, this page will let you restore any single file for free, so ‘C3rb3r Decryptor’ will definitely come in handy.”

C3RB3R ransomware has targeted other servers

The ransomware currently being used against Synology NAS devices is known as Cerber, C3RB3R or CerberImposter. It borrowed its name from the infamous Cerber ransomware-as-a-service (RaaS) operation that emerged in 2016.

Before disappearing at the end of 2019, the original Cerber operation accounted for more than 80% of ransomware attacks and a quarter of all ransomware infections on enterprise endpoints.

C3RB3R has also been used against Atlassian Confluence and GitLab servers since it was first discovered in December 2021. Those attacks exploited remote-code-execution vulnerabilities CVE-2021-26084 and CVE-2021-22205, as well as the authentication-bypass flaw CVE-2023-22518.

Internet threat-monitoring organization Shadowserver currently tracks more than 380,000 Synology NAS devices exposed to the Internet. Its tracking data does not indicate how many of those devices are protected against the attacks or how many may be honeypots.

Source: www.bleepingcomputer.com