As reported by The Hacker News, Synology has confirmed active ransomware attacks against NAS devices running outdated DiskStation Manager (DSM) firmware. The exploitation campaign deploys a ransomware strain dubbed C3RB3R, which encrypts victim files with a .L0CK3D extension. This is not a zero-day story — it's something arguably worse for defenders: a critical vulnerability patched nearly a year ago that remains unpatched across a substantial install base.
Vulnerability Details
| CVE | CVSS | Severity | Description |
|---|---|---|---|
| CVE-2024-10441 | 9.8 | Critical | Improper encoding/escaping in DSM system plugin daemon enabling remote code execution |
| CVE-2024-50629 | 5.3 | Medium | Improper encoding/escaping in DSM webapi allowing limited file reads |
| CVE-2024-10445 | 4.3 | Medium | Improper certificate validation in DSM update functionality allowing limited file writes |
Affected Products and Patch Status
A vendor advisory is available and active exploitation has been confirmed in the wild. The primary attack vector is almost certainly CVE-2024-10441 given its 9.8 CVSS rating and RCE capability — the other two CVEs are more likely supporting access primitives for lateral movement or data staging.
Why This Matters Beyond Synology
This incident exposes a systemic blind spot in enterprise asset management: network-attached storage appliances are infrastructure, not peripherals. They hold production data, backups, archives, and often credentials or certificates stored in flat files. Yet they're frequently excluded from vulnerability scanning programs, patch management SLAs, and hardening baselines. A CVSS 9.8 RCE sitting unpatched for eleven months on a device holding your crown jewels is an unforced error.
The C3RB3R variant following in the footsteps of eCh0raix and StealthWorker confirms that NAS platforms remain a durable target for ransomware operators. The economics are straightforward: NAS devices are internet-exposed by design (remote access, file sharing, sync services), often run legacy firmware, and store high-value data whose owners will pay. Threat actors need only scan for DSM login pages and test default or weak credentials before dropping a payload.
Who Is Most at Risk
- SMBs and mid-market firms using Synology as primary or backup storage without dedicated security staff
- Home labs and prosumer deployments with DSM exposed directly to the internet via port forwarding
- Branch offices and remote sites where NAS firmware updates are not centrally managed
- Organizations running DSM 6.2 or older branches approaching or past end-of-support
- Backup systems that live on the same NAS — ransomware on primary storage and backup storage simultaneously means no recovery option
Shield53 Recommendations
Immediate Actions
- Patch now. Upgrade every Synology NAS to the minimum patched build listed above. If a device cannot be patched (EOL hardware), isolate it or retire it.
- Disable internet exposure. DSM should not be reachable from the public internet. Use a VPN or zero-trust access layer for remote administration. Close port 5000/5001 on your edge firewall immediately.
- Enforce MFA. Enable two-factor authentication for all DSM admin accounts. Review and remove unused accounts. Replace default
admincredentials if still present. - Verify backup integrity. Confirm offline or immutable backups exist and are restorable. If your only backup lives on the same NAS, you do not have a backup — you have a redundant copy that will be encrypted alongside the primary.
- Hunt for indicators. Search for files with the
.L0CK3Dextension, ransom notes, and unexpected SSH sessions. Review DSM logs at/var/log/synolog/synosec.logand/var/log/messagesfor anomalous login patterns or plugin daemon activity. - Snapshot before remediation. If a device is suspected compromised, capture a memory dump and disk image before wiping — useful for forensics and potential law enforcement coordination.
Structural Fixes
- Add NAS devices to your vulnerability management program with the same SLA as servers
- Centralize DSM updates using Synology's Central Management System or a configuration management tool
- Segment NAS traffic — storage should not share a flat network with user workstations
- Implement 3-2-1 backup discipline with at least one offline copy
Nearly a year elapsed between patch and widespread exploitation. The window of opportunity for attackers was created not by Synology — they released the fix promptly — but by deployment practices that treat storage as someone else's problem. Fix that gap before the next NAS ransomware campaign arrives, because it will.
