Synology NAS units are under threat from the C3RB3R ransomware, which is linked to 2024 security vulnerabilities, prompting the company to advise users to update their DiskStation Manager versions and packages. The warning followed reports from the 360 Security Team and Solar Emergency Response Team on October 29. Victims reported their files being encrypted with the .L0CK3D extension and a ransom note named read-me3.txt.
The Synology security advisory, tracked as Synology-SA-24:20, addresses three vulnerabilities discovered following the Pwn2Own 2024 event.
Released on November 5, 2024, it received updates as patches became available across various DSM branches. Although Appinn had previously described the weaknesses as fixed by December 2024, Synology's revision history indicates that several fixes were introduced in November. Previously, ZeroOwl had examined the critical CVE-2024-10441 flaw in Synology DSM, which carries a CVSS score of 9.8 and allows unauthenticated remote code execution without user interaction.
Initial coverage raised concerns because Solar reportedly investigated an affected device running DSM 7.4.1-90080 Update 1. The published accounts fail to address the apparent discrepancy or confirm a new zero-day exploit. Latest DSM patches fix two CVEs, but the attack entry point remains unknown (source: Appinn).
Appinn's initial incident report recommends removing direct internet access to DSM management and SSH, using a VPN for remote connections, and checking for unusual logins, unknown administrators, and scheduled tasks.
