What Happened
Synology has warned customers of a surge in C3RB3R ransomware attacks against NAS devices, BleepingComputer reports. Attackers exploit a flaw patched in December 2024 on devices running outdated DSM software. Synology has not confirmed which flaw is in play. It points owners to its November 2024 advisory, which covers CVE-2024-10441 for code execution, CVE-2024-50629 for file reads, and CVE-2024-10445 for file writes.
Critical fixes apply to DSM 7.1, 7.2, 7.2.1, and 7.2.2. A moderate-severity fix applies to DSM 6.2. Victims find files renamed with a .L0CK3D extension and a ransom note demanding payment for a “C3rb3r Decryptor” tool. Shadowserver tracks more than 380,000 internet-exposed Synology NAS devices.
Why This Matters for Canadian Organizations
NAS boxes hold the files Canadian small businesses, clinics, law offices, and municipal teams run on. Many sit in a closet with default settings and no one assigned to patch them. Backups often live on the same device, so ransomware takes the production data and the safety net together.
The exposure carries legal weight. A ransomware attack on a NAS holding client or patient records is a breach of security safeguards under PIPEDA. If the breach creates a real risk of significant harm, your organization must report it to the Privacy Commissioner and notify affected individuals. The patch has been available for nearly two years, so regulators will ask why it was never applied.
Our TechTalk coverage follows the pattern: old flaws, unpatched devices, steady payoffs for criminals.
What to Do
Update DSM on every Synology device today and turn on automatic updates. Block internet access to the management interface and remove any port forwarding to it. Find your exposed devices before an attacker does by checking your external IP ranges. Keep an offline or immutable backup copy away from the NAS. Test a restore. Review file shares for unexpected .L0CK3D files and isolate any affected device from the network. For more daily coverage, see our latest news.
