Synology has warned that attackers are targeting NAS devices running outdated versions of its DiskStation Manager (DSM) software. The company urges users to install the available updates immediately and secure access to their devices.
Synology said the attacks exploit a vulnerability it patched in December 2024. The company did not identify the specific flaw being used or disclose how many devices have been compromised. It also recommends enabling automatic updates to keep DSM current.
Reports cited by BleepingComputer describe Synology customers whose data was encrypted by the C3rb3r ransomware. The attackers reportedly demanded thousands of dollars in exchange for decryption keys. Synology has not named the attackers or confirmed the scale of the reported incidents.
The December fixes were linked to three vulnerabilities listed in a November 2024 security advisory: CVE-2024-10441, which could allow arbitrary code execution; CVE-2024-50629, involving arbitrary file reads; and CVE-2024-10445, which could allow files to be written to compromised devices.
The required DSM update depends on the version in use. Synology lists DSM 7.2.2-72806-1 or later, DSM 7.2.1-69057-6 or later, DSM 7.2-64570-4 or later, DSM 7.1.1-42962-7 or later, and DSM 6.2.4-25556-8 or later as patched releases.
Synology NAS devices are used to store and share files and can also serve as centralized backups. To reduce exposure, users are advised to remove NAS devices from the public internet where possible, or restrict access to trusted identities. RAID redundancy and built-in backup features do not necessarily prevent ransomware from encrypting stored data.
Sources: TechRadar.