Network-attached storage (**NAS**) devices are once again in the crosshairs of ransomware operators. **Synology**, a leading provider of NAS solutions, has confirmed a significant uptick in **C3RB3R** ransomware infections targeting its devices. The company's advisory stresses the critical need for users to enable automatic updates and upgrade their **DSM** software to the latest available version. ### Exploiting Known Vulnerabilities **Synology** states that threat actors are exploiting a vulnerability that was patched in December 2024. While the specific vulnerability under active exploitation remains undisclosed by **Synology**, the company's advisory links to a November 2024 security bulletin (**Synology_SA_24_20**) detailing patches for several critical flaws. These include vulnerabilities allowing for arbitrary code execution (**CVE-2024-10441**), file reading (**CVE-2024-50629**), and file writing (**CVE-2024-10445**) on unpatched devices. It is highly probable that one or a combination of these is being leveraged by the attackers. ### Urgent Call to Action **Synology** has provided a clear directive for its user base: * **Immediate DSM Update:** Upgrade to the latest **DSM** version. Recommended updates include: * **DSM 7.2.2**: Upgrade to 7.2.2-72806-1 or above. * **DSM 7.2.1**: Upgrade to 7.2.1-69057-6 or above. * **DSM 7.2**: Upgrade to 7.2-64570-4 or above. * **DSM 7.1**: Upgrade to 7.1.1-42962-7 or above. * **DSM 6.2**: Upgrade to 6.2.4-25556-8 or above. * **Enable Automatic Updates:** Ensure **DSM** is configured to update automatically. * **Restrict External Access:** Immediately block internet access to the **DSM** management web interface. ### The Resurgence of C3RB3R Reports of **C3RB3R** ransomware infections began surfacing more than two weeks ago, with victims finding their files encrypted with a `.L0CK3D` extension and a ransom note (`read-me3.txt`). The note demands payment for a "**C3rb3r Decryptor**" tool via a dark web portal.  This new wave of **C3RB3R** ransomware borrows its name from the notorious **Cerber** Ransomware-as-a-Service (**RaaS**) that dominated the threat landscape between 2016 and 2019. While the current variant is distinct, its nomenclature is clearly designed to evoke a sense of established threat. Previous iterations of **C3RB3R**, first observed in December 2021, have targeted **Atlassian Confluence** and **GitLab** servers, exploiting critical vulnerabilities such as **CVE-2021-26084**, **CVE-2021-22205**, and **CVE-2023-22518** for remote code execution and authentication bypass. ### The Scale of Exposure Internet threat watchdog **Shadowserver** currently tracks over 380,000 internet-exposed **Synology NAS** devices. This vast attack surface underscores the urgency of **Synology**'s warning and the potential for widespread impact if users fail to patch their systems promptly. The exact number of compromised devices within this exposed pool remains unknown. This incident serves as a stark reminder for IT security professionals and privacy-conscious users alike: robust patch management, restricted external access to critical systems, and regular data backups are non-negotiable pillars of a strong cybersecurity posture.