Synology, one of the world's most popular network-attached storage (NAS) makers, is warning customers to update the DSM operating system. According to The Hacker News, attackers are exploiting a vulnerability patched back in December 2024 to break into drives running old versions and encrypt files with ransomware called C3RB3R.
How to spot it
According to customer reports, the ransomware, a Linux variant of the veteran Cerber family, locks files and adds the ".L0CK3D" extension. Anyone who finds such files on their drive was probably attacked. According to reports, Synology confirmed in an email to customers that the ransomware exploits only the flaw fixed in the old update.
Why it is so dangerous
NAS drives are used at home and in small businesses precisely for backup: family photos, business documents, computer backups. When the drive itself is encrypted, the backup disappears along with the original. And because many drives are connected to the internet for remote access, attackers can scan for and find them easily.
What to do now
1. Update DSM to the latest version. 2. Check whether the drive is exposed to the internet, and block it if not needed. 3. Keep an additional backup copy that isn't always connected to the network. The flaw was fixed nearly two years ago, a reminder that most breaches don't exploit new flaws but devices nobody updated.
