Ransomware Is Locking Synology NAS Boxes Through a Bug Patched Almost Two Years Ago. Check Your DSM Version Today.
If you have a Synology NAS, open Control Panel and check the DSM version now. On October 29, Synology said threat actors are exploiting a vulnerability it patched in late 2024, aiming to encrypt data and demand ransom from devices running outdated DSM. Security researchers are calling the ransomware C3RB3R, and it renames locked files with a .L0CK3D extension.
What Synology said
Synology's October 29 notice is short. It says attackers are exploiting a vulnerability patched in December 2024, that they target devices on outdated DSM versions, and that it "strongly urges all users running vulnerable versions to update DSM immediately." It also recommends turning on automatic updates. The notice points to advisory Synology-SA-24:20 but does not name a CVE, affected versions or fixed versions.
What the advisory it points to says
Synology-SA-24:20 covers DSM flaws from Pwn2Own 2024. It was published November 5, 2024 and last updated March 28, 2025, and the vendor lists no workaround, so updating is the only fix. It lists three CVEs:
CVE-2024-10441, Critical, CVSS 9.8. A flaw in the system plugin daemon allows remote code execution without credentials.
CVE-2024-50629, Moderate, 5.3. Allows remote reading of limited files.
CVE-2024-10445, Moderate, 4.3. An update-certificate flaw allows writing limited files.
The fixed releases, by DSM line: 7.2.2-72806-1 or later, 7.2.1-69057-6 or later, 7.2-64570-4 or later, 7.1.1-42962-7 or later, and 6.2.4-25556-8 or later.
Synology's notice does not say which of the three CVEs is being used. We are not claiming it is CVE-2024-10441. That is the one that gives remote code execution, so it is the likeliest fit, but it is our inference, not Synology's statement. Also, the notice says December 2024 while the advisory is dated November 2024, and we have not resolved the difference.
Researchers disagree on the entry point
Reporting we read says the Chinese security firm 360 ties the attacks to two critical DSM flaws that Synology patched in September, not to the 2024 advisory. One report says the infection does not spread mainly from infected Windows machines over SMB shares. Until someone publishes a clean root-cause analysis, update to the current DSM release, not just to the version in the table above. The September fixes would be newer than every version listed there.
What the ransomware leaves behind
Researchers describe C3RB3R as a variant of the old Cerber family. Locked files get the .L0CK3D extension, and each folder gets a ransom note asking for Bitcoin. One report traces the first encryptions to early October, which means devices may have been hit for weeks before the October 29 notice.
What to do
Update DSM now. Compare your version to the table above, then go further and install the latest release for your model. Turn on automatic updates.
Take the management interface off the internet. If your NAS is reachable from outside through port forwarding, move it behind a VPN. This is our advice, not Synology's.
Look for the signs. Search your shares for files ending in .L0CK3D and for new ransom notes.
Check your backups. Keep a copy the NAS cannot overwrite, such as an offline disk or a cloud copy with versioning that a compromised device cannot delete. Backups kept on the same NAS can be encrypted along with everything else.
If you were hit, disconnect the box from the network, leave it as it is for forensics if you can, and check whether a decryptor exists before you consider paying.
What we do about it, and what we cannot
We are not a news site, so here is where we stand, as of this writing.
No indicators to block yet. We searched our indicator and actor indexes for C3RB3R and L0CK3D and found no record. The reporting we read publishes no hashes, domains or addresses. If researchers publish infrastructure, we ingest it the same day, with the actor attached, and add a dated update here.
KEV does not list it. Our check shows CVE-2024-10441 is not in CISA's catalog today. That is a gap in the catalog, not evidence of safety, since the vendor itself says exploitation is happening.
Our edge does not touch your NAS. The edge shield protects web properties placed behind it. A Synology box on your office network is not behind it, so your protection here is the update and the network changes above.
We will keep watching. An edge scan for this family needs a path to look for, and the reporting names none. That is a limit of this post, not a finding.
Free API keys for our blocklist feed are open to anyone, and the day indicators exist, they are the first thing to go in.
Limits
The Synology notice and advisory are primary sources we read directly. The ransomware name, the .L0CK3D extension, the early-October timeline and the 360 attribution come from secondary articles that mostly repeat one another, and we did not read 360's analysis. We have not tested any exploit, and we do not hold a sample of the ransomware.
Five percent of this is wrong somewhere. It always is.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments