Synology Urges Critical Update Amid Rising Ransomware Threats
Synology, a Taiwanese technology vendor renowned for its Network Attached Storage (NAS) devices, has issued a strong advisory encouraging its customers to upgrade the DiskStation Manager (DSM) software that powers these units. This plea follows a series of alarming ransomware attacks that have targeted users operating outdated DSM versions, highlighting the pressing need for consumers to ensure their systems are safeguarded against potential cyber threats.
The company has reported that cybercriminals are actively exploiting a specific vulnerability that had been addressed in a security update released in December 2024. The exploitation, which poses a significant risk, aims to encrypt users’ data and extort ransom payments. In a public statement issued last week, Synology emphasized, "These attacks aim to encrypt data and extort ransom," clearly indicating the severity of the situation and the rationale behind the urgent call for updates.
While Synology has remained somewhat tight-lipped regarding the exact nature of the security flaw being exploited, they have pointed customers to a November 2024 security advisory that highlighted three critical vulnerabilities:
-
CVE-2024-10441 (CVSS score: 9.8) – This vulnerability involves improper encoding or escaping of output within the system plugin daemon of DSM. It allows for remote code execution through unspecified vectors, making it particularly formidable.
-
CVE-2024-50629 (CVSS score: 5.3) – This flaw is located in the web API component of DSM, where improper encoding or escaping of output could permit remote attackers to read certain files through unspecified means.
- CVE-2024-10445 (CVSS score: 4.3) – This vulnerability concerns improper certificate validation in the update functionality of DSM, potentially allowing attackers to write to limited files.
These vulnerabilities were patched in various versions of DSM, and Synology has specified which versions users should upgrade to in order to mitigate their exposure. For instance:
- Users operating DSM 7.2.2 are urged to update to version 7.2.2-72806-1 or higher.
- For DSM 7.2.1, they ought to upgrade to version 7.2.1-69057-6 or above.
- DSM 7.2 users should upgrade to 7.2-64570-4 or later.
- Those on DSM 7.1 need to move to version 7.1.1-42962-7 or later.
- Lastly, users of DSM 6.2 should update to at least 6.2.4-25556-8.
The timing of Synology’s advisory is critical, as it coincides with growing reports from customers whose Synology devices have been infected with C3RB3R ransomware, a notorious malware that encrypts files and appends the ".L0CK3D" extension to them. In a recent analysis from Qihoo 360 Internet Security Center, it was revealed that C3RB3R ransomware has a history of targeting NAS devices and has exploited vulnerabilities previously patched by Synology in September 2026.
Once deployed, the C3RB3R ransomware initiates a thorough scan of the files on the compromised device, deliberately excluding 27 specific directories and file extensions—such as BAT, DLL, and EXE—to avoid causing system malfunctions that could disrupt its encryption activities. Following successful encryption, the ransomware leaves behind a ransom note named “read-me3.txt” in each affected directory, escalating the stress and urgency faced by victims.
Historically, NAS devices have increasingly become the targets of ransomware attacks. In 2019, another Taiwanese manufacturer, QNAP Systems, experienced breaches tied to a ransomware known as QNAPCrypt, signaling a broader trend of cyber threats targeting storage solutions. Furthermore, in August 2021, Synology itself alerted users to brute-force attack attempts made by malware such as StealthWorker, which sought to exploit common administrative credentials to disseminate ransomware.
“By leveraging a network of already infected devices, these attacks aim to guess common administrative credentials. If successful, they gain access to the system, ultimately installing a malicious payload that could include ransomware,” Synology clarified.
The emergence of these threats has underscored the importance of proactive cybersecurity measures among NAS users. Synology has strongly reiterated that immediate updates to DSM are essential for safeguarding systems. Furthermore, the company recommended users enable automatic updates to ensure that their devices receive timely protections against emerging vulnerabilities.
In conclusion, Synology’s urgent call to action is a crucial reminder of the vulnerabilities present in outdated software, especially in an era where ransomware threats are proliferating. Customers are encouraged not only to heed these warnings but also to adopt best practices that include keeping software up to date and employing robust security measures to fortify their defenses against ransomware and other cyber threats.