Synology NAS users reportedly targeted again by C3RB3R ransomware
Catalin Cimpanu's Bluesky post states that Synology NAS users are being targeted with C3RB3R ransomware again.
Written by a model from the sources below. Verify against them.
- Vendor
- Synology
- Product
- NAS devices
- Status
- Reported, not confirmed
- Disclosed
- Catalin Cimpanu on Bluesky: “Synology has identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM.”
- Exploited vulnerability
- Catalin Cimpanu on Bluesky: “Synology NAS users are being targeted with the C3RB3R ransomware again”
- C3RB3R
Summary
The post links to a Synology page, a GitHub project, and Reddit threads, but the item itself gives no further detail on scope or infection method.
What to do
Check Synology DSM and package versions and apply all available updates.
Restrict NAS access from the internet and disable unneeded remote access services.
Confirm that backups are current and stored offline or immutable.
Review the linked Synology advisory and community reports for indicators of compromise.
Timeline
- Made public by Catalin Cimpanu on Bluesky
- First seen by cve.now2 days
- Record last updated
Evidence 2
- SocialMastodon
“Une vague d'attaques exploitant des failles système cible les NAS Synology exposés sur Internet avec le rançongiciel C3RB3R”
- PressCatalin Cimpanu on Bluesky
“Synology NAS users are being targeted with the C3RB3R ransomware again”
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about the ransomware attack on Synology
Was Synology breached?
Catalin Cimpanu on Bluesky reports it. No statement from Synology has reached cve.now yet.
What should Synology customers do?
Check Synology DSM and package versions and apply all available updates. Restrict NAS access from the internet and disable unneeded remote access services. Confirm that backups are current and stored offline or immutable. Review the linked Synology advisory and community reports for indicators of compromise.