Synology urges DSM updates after C3RB3R ransomware exploits old flaws

Synology is urging customers to update the DiskStation Manager (DSM) software on its Network Attached Storage (NAS) devices following a wave of ransomware attacks. The Taiwanese vendor confirmed that threat actors are actively exploiting a vulnerability that was patched in December 2024 to target devices running outdated versions of the operating system.

What happened

The attacks aim to encrypt user data and extort ransom payments, according to a statement released by Synology last week. While the company did not disclose the exact security flaw being exploited in these specific recent incidents, it linked to a November 2024 security advisory that listed three critical vulnerabilities. These flaws range from remote code execution risks to improper certificate validation, all of which could allow attackers to gain unauthorized access or modify files on the device.

Reports from affected customers indicate that their Synology devices have been compromised by C3RB3R ransomware. This malware locks users' files by appending a ".L0CK3D" extension and drops a ransom note named "read-me3.txt" in each encrypted directory. Chinese security vendor Qihoo 360 Internet Security Center analyzed the malware and noted that C3RB3R has a long history of targeting NAS devices. The group has previously exploited other DSM vulnerabilities that were addressed by Synology in September 2026, demonstrating a persistent focus on unpatched storage systems.

To mitigate the risk, Synology has specified the minimum DSM versions required for safety across its supported branches. Users running DSM 7.2.2 must upgrade to version 7.2.2-72806-1 or above, while those on DSM 7.2.1 need version 7.2.1-69057-6 or higher. Older branches also have specific targets: DSM 7.2 requires 7.2-64570-4, DSM 7.1 needs 7.1.1-42962-7, and DSM 6.2 users must install 6.2.4-25556-8 or later. The company strongly recommends enabling automatic updates to ensure systems remain protected against future threats.

Key details

• Active exploitation: Attackers are using a vulnerability patched in December 2024 to compromise unupdated Synology NAS devices.
• Malware identity: The ransomware involved is identified as C3RB3R, which appends ".L0CK3D" to encrypted files.
• Evasion tactics: C3RB3R skips 27 directories and specific file extensions like BAT, DLL, and EXE to avoid crashing the system during encryption.
• Historical context: Qihoo 360 notes C3RB3R previously exploited two high-severity DSM vulnerabilities patched in September 2026.
• Required updates: Synology lists specific build numbers for DSM 6.2 through 7.2.2 that resolve the known security issues.
• Vendor advice: Synology urges immediate manual updates for vulnerable versions and recommends enabling automatic updates for ongoing protection.

Background

Network Attached Storage (NAS) devices are popular among small businesses and homelab enthusiasts for storing large amounts of data locally. However, because they are often connected to the internet for remote access, they become attractive targets for cybercriminals. DiskStation Manager (DSM) is the operating system that runs on Synology NAS devices, handling everything from file management to user permissions. When vulnerabilities are discovered in DSM, they can allow attackers to execute code remotely or bypass authentication, effectively giving them control over the stored data.

Ransomware groups like C3RB3R specifically target these devices because they often contain critical business records or personal archives that victims are willing to pay to recover. By skipping system files and certain executable formats, the malware ensures the NAS remains operational enough to display the ransom note, increasing the pressure on the victim to pay. This tactic contrasts with destructive malware that might brick the device entirely, as the attackers' primary goal is financial extortion rather than simple disruption.

Why it matters

For teams that run their own software and manage their own infrastructure, this incident highlights the critical importance of patch management for peripheral systems. It is common for IT leads to focus heavily on securing application servers and databases while neglecting the underlying storage appliances. A compromised NAS can lead to total data loss, disrupting operations far more severely than a temporary application outage. Since many small and mid-sized companies rely on self-hosted solutions for cost efficiency, the burden of security maintenance falls entirely on their internal teams.

Furthermore, the use of older, patched vulnerabilities suggests that many devices are not being updated regularly. This lag creates a window of opportunity for attackers who scan the internet for known weak points. For DevOps engineers and sysadmins, this serves as a reminder that security is not a one-time configuration but an ongoing process. Failing to apply firmware updates can render even robust network defenses ineffective if the storage layer itself is compromised.

What you can do

• Check your DSM version: Log in to your Synology NAS and verify the current build number against the safe versions listed in the advisory.
• Apply updates immediately: If your version is below the recommended threshold, download and install the latest DSM update without delay.
• Enable automatic updates: Configure your NAS to check for and install security patches automatically to prevent future lapses.
• Audit backup integrity: Ensure your backups are stored on separate, offline, or immutable media to protect against ransomware encryption.
• Restrict network access: Limit exposure by disabling unused services and ensuring only necessary ports are open to the internet.
• Monitor for anomalies: Watch for unusual file extensions or unexpected ransom notes in your storage directories as early indicators of compromise.