Ransomware Attacks Target Synology NAS Devices Via Patched Flaw

"These attacks aim to encrypt data and extort ransom," Synology said in a statement released last week.

Synology's advisory and the patched DSM versions

Synology has urged customers to update the DiskStation Manager (DSM) software that runs its Network Attached Storage (NAS) devices after observing threat actors exploiting a vulnerability that the vendor says was patched in December 2024. Synology linked its alert to a November 2024 security advisory that listed three separate vulnerabilities and provided explicit upgrade targets for affected DSM branches.

• DSM 7.2.2 — upgrade to 7.2.2-72806-1 or above
• DSM 7.2.1 — upgrade to 7.2.1-69057-6 or above
• DSM 7.2 — upgrade to 7.2-64570-4 or above
• DSM 7.1 — upgrade to 7.1.1-42962-7 or above
• DSM 6.2 — upgrade to 6.2.4-25556-8 or above

Synology also recommended enabling automatic updates to keep DSM current "at all times."

The three CVEs Synology cited

The November 2024 advisory named three specific vulnerabilities that Synology tied to the ongoing exploitation. The advisory listed:

• CVE-2024-10441 (CVSS score: 9.8) — described as an improper encoding or escaping of output vulnerability in the system plugin daemon that could lead to remote code execution via unspecified vectors.
• CVE-2024-50629 (CVSS score: 5.3) — an improper encoding or escaping of output vulnerability in the webapi component that could allow remote attackers to read limited files via unspecified vectors.
• CVE-2024-10445 (CVSS score: 4.3) — an improper certificate validation vulnerability in the update functionality that could allow remote attackers to write limited files via unspecified vectors.

Synology did not disclose a single, specific flaw being exploited in the recent attacks; instead, it pointed to that advisory and the three CVEs it contained.

C3RB3R ransomware and the observed outcome

Customer reports tied to the incidents name a ransomware family tracked as C3RB3R. Synology said the observed attacks “aim to encrypt data and extort ransom.” Affected devices have reportedly had files locked and renamed with a ".L0CK3D" extension, according to the reports Synology referenced.

Historical context: QNAPCrypt, StealthWorker and eCh0raix

Synology and others have seen NAS-targeting ransomware before. The vendor's bulletin recalled several earlier campaigns and variants:

• In 2019, NAS devices made by QNAP Systems were compromised by QNAPCrypt (also known as eCh0raix) ransomware.
• In August 2021, Synology warned of brute-force attacks driven by a malware family called StealthWorker that led to ransomware infections. Synology described those attacks as leveraging already infected devices to guess common administrative credentials and, if successful, install malicious payloads that could include ransomware. Synology warned infected devices might carry out additional attacks on other Linux-based devices, including Synology NAS.
• That same month in 2021, Palo Alto Networks Unit 42 disclosed an eCh0raix variant targeting NAS devices from both QNAP and Synology, using vulnerabilities such as CVE-2021-28799 or brute-force methods against commonly used administrative credentials.

What this means for technologists and end users

• Technologists and security teams: Synology's public linkage to the November 2024 advisory gives a concrete remediation path — upgrade to the DSM builds listed (for example, 7.2.2-72806-1 or above) and consider enabling automatic updates. The advisory names CVE-2024-10441 as the highest-severity entry (CVSS 9.8), highlighting a potential remote code execution risk that teams will prioritize when patching.
• End users and small organizations: Reports that C3RB3R has been observed locking files with a ".L0CK3D" extension are a direct signal to check DSM build versions on any exposed NAS and to apply the specific DSM upgrades Synology published. Synology's statement underscores that devices running outdated DSM remain at risk.

Synology's advisory is precise about what to install, and its warnings echo past patterns: ransomware operators continue to target NAS devices by exploiting old vulnerabilities and weak admin credentials. The vendor's explicit upgrade targets — across DSM 6.2, 7.1, 7.2 and its maintenance branches — give administrators a clear checklist. Whether device owners follow that checklist determines, in the short term, which NAS systems remain viable targets for C3RB3R and similar families.

Read the original Synology advisory and reporting here: https://thehackernews.com/2026/11/synology-nas-devices-targeted-in.html