Synology NAS devices targeted in ransomware attacks
Original title: Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw
Threat actors exploit a patched DSM flaw to encrypt data on unupdated Synology NAS devices using C3RB3R ransomware.
Synology reported ransomware attacks on NAS devices exploiting a vulnerability patched in December 2024. The issue in the system plugin daemon could lead to remote code execution on outdated DSM versions. Customers using C3RB3R ransomware saw files locked with .L0CK3D extensions. The vendor urges immediate upgrades and automatic updates.
Unconfirmed: Exact exploited flaw not disclosed by Synology
- Exploits CVE-2024-10441 for RCE in system plugin daemon
- Patched in DSM 7.2.2-72806-1 and earlier versions
- Linked to C3RB3R ransomware
- Enabling automatic updates recommended
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2024-10441+2 related CVEs | Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation… | 9.8 group max | 1% |
From the original article
2 min read at thehackernews.com
Synology is urging customers to update the DiskStation Manager (DSM) software powering its Network Attached Storage (NAS) devices following ransomware attacks. The Taiwanese vendor said it observed threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM. "These attacks aim to encrypt data and extort ransom," it said in a statement
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.