Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw
Summary: Synology is urging customers to update DiskStation Manager after observing threat actors exploit a vulnerability patched in December 2024 against NAS devices running outdated DSM versions, with the attacks aimed at encrypting data and extorting ransom. Customers have reported C3RB3R ransomware infections that append a .L0CK3D extension and drop a ransom note named read-me3.txt in each encrypted directory, and Qihoo 360 noted C3RB3R's long history of attacking NAS devices, including via two DSM flaws Synology addressed earlier.
Key Takeaway: The fix for this flaw has been available since December 2024, yet attacks are succeeding against devices that were never updated - and C3RB3R skips 27 directories and extensions such as EXE and DLL specifically so encryption completes without crashing the device.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-28799
- Related
- CVE-2021-28799: QNAP NAS Improper Authorization Vulnerability Known Exploited Vulnerabilities · Mar 31, 2022