Synology is warning customers to update DiskStation Manager now because of a wave of C3RB3r ransomware attacks, BleepingComputer reports. That’s rare: its last attack warning was in 2019, during the eCh0raix brute-force wave.
What we know
- Attackers are exploiting “a vulnerability patched in December 2024” on outdated DSM versions, then encrypting data and demanding ransom
- Synology hasn’t said which CVE, but it pointed to its November 2024 advisory: CVE-2024-10441 (code execution), CVE-2024-50629 (file read) and CVE-2024-10445 (file write)
- Fixed builds include DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7 and 6.2.4-25556-8 or later
- Victims are being pushed to buy a “C3rb3r Decryptor” from a dark web portal
What to do
- Update DSM and turn on automatic updates
- Block the management web interface from the internet
- Keep an offline or immutable backup a ransomware gang can’t reach
My take
A home-lab NAS is often the box nobody updates. Garlic on this one because Synology still hasn’t named the exact bug.
God Bless, and Needs Garlic!
