Network Attached Storage (**NAS**) devices from **Synology** are currently under siege, prompting the company to issue an urgent advisory for users to update their **DSM** software. The attacks leverage vulnerabilities that were addressed in December 2024, highlighting the critical importance of timely patching.  ### Exploited Vulnerabilities While **Synology** did not specify the exact flaw being exploited, they referenced a November 2024 security advisory detailing three vulnerabilities: * **CVE-2024-10441** (CVSS score: 9.8): An improper encoding/escaping vulnerability in the system plugin daemon of **DSM**, potentially leading to remote code execution. * **CVE-2024-50629** (CVSS score: 5.3): An improper encoding/escaping vulnerability in the webapi component of **DSM**, allowing remote attackers to read limited files. * **CVE-2024-10445** (CVSS score: 4.3): An improper certificate validation vulnerability in **DSM**'s update functionality, enabling remote attackers to write limited files. ### Recommended Updates Users are strongly advised to upgrade their **DSM** versions immediately: * **DSM** 7.2.2: Upgrade to 7.2.2-72806-1 or above * **DSM** 7.2.1: Upgrade to 7.2.1-69057-6 or above * **DSM** 7.2: Upgrade to 7.2-64570-4 or above * **DSM** 7.1: Upgrade to 7.1.1-42962-7 or above * **DSM** 6.2: Upgrade to 6.2.4-25556-8 or above ### The Rise of C3RB3R Ransomware The current attacks are linked to **C3RB3R** ransomware, which encrypts user files and appends a ".L0CK3D" extension. Reports from affected users on platforms like Reddit confirm the widespread impact. Chinese security vendor **Qihoo 360 Internet Security Center** noted **C3RB3R**'s history of targeting **NAS** devices. This includes past exploitation of two other **DSM** vulnerabilities patched in September 2026 (note: likely a typo in original source, should be 2021 or similar): * **CVE-2026-13684** (CVSS score: 9.8): An improper encoding/escaping vulnerability in SCGI, allowing remote attackers to read/write arbitrary files and conduct denial-of-service attacks. * **CVE-2026-13639** (CVSS score: 9.8): An insufficient entropy vulnerability in login logic, allowing similar remote file access and DoS attacks. Upon execution, **C3RB3R** scans for files to encrypt, deliberately skipping system-critical directories and file extensions (e.g., BAT, DLL, EXE, LNK, MOD, MSI, SYS) to ensure system stability and facilitate its encryption process. A ransom note, "read-me3.txt," is dropped in every encrypted directory. ### A Recurring Threat to NAS Devices **NAS** devices have consistently been a lucrative target for ransomware operators. In 2019, **QNAP Systems** devices were hit by **QNAPCrypt** (also known as **eCh0raix**) ransomware. In August 2021, **Synology** itself warned of brute-force attacks by the **StealthWorker** malware family, leading to ransomware infections. At that time, **Synology** stated, "These attacks leverage a number of already infected devices to try and guess common administrative credentials, and if successful, will access the system to install its malicious payload, which may include ransomware." **Palo Alto Networks Unit 42** also detailed an **eCh0raix** variant in the same month, targeting both **QNAP** and **Synology** **NAS** devices through vulnerabilities like **CVE-2021-28799** or brute-force methods. **Synology** reiterates the critical need for immediate updates and recommends enabling automatic updates to maintain continuous protection against evolving threats.