Synology cảnh báo một làn sóng ransomware C3RB3R đang nhắm vào các thiết bị NAS chạy phiên bản DiskStation Manager (DSM) lỗi thời. Kẻ tấn công khai thác lỗ hổng đã được vá từ tháng 12/2024 để mã hóa dữ liệu và đòi tiền chuộc. Người quản trị cần cập nhật DSM ngay, ngắt giao diện quản trị khỏi Internet và kiểm tra khả năng phục hồi từ bản sao lưu.
A Rare Warning From Synology
In an October 29, 2026 notice, Synology confirmed that threat actors are abusing an old vulnerability on unpatched devices. The company has not identified the exact CVE used in the attacks, but directed users to Synology-SA-24:20, which lists flaws enabling code execution and file reading or writing on unpatched DSM systems.
How C3RB3R Encrypts Data
Các báo cáo ban đầu cho biết ransomware đổi phần mở rộng tệp thành .L0CK3D và để lại thư đòi tiền chuộc read-me3.txt. Nạn nhân được hướng tới một cổng trên dark web để mua công cụ “C3rb3r Decryptor”. Chưa có bằng chứng công khai cho thấy mọi thiết bị Synology đều bị ảnh hưởng; điểm chung được xác nhận là các máy bị nhắm tới đang chạy DSM lỗi thời.
DSM Releases That Need Upgrading
According to a patch table compiled by BleepingComputer from Synology's advisory, DSM 7.2.2 should be at least 7.2.2-72806-1; DSM 7.2.1 at least 7.2.1-69057-6; DSM 7.2 at least 7.2-64570-4; DSM 7.1 at least 7.1.1-42962-7; and DSM 6.2 at least 6.2.4-25556-8. Users should check the official advisory for their model and support branch before upgrading.
A Concerning Exposure Footprint
Shadowserver data shows more than 380,000 Internet-accessible Synology NAS devices. That does not mean every device is vulnerable, because the count may include patched systems and honeypots, but it demonstrates a large attack surface. NAS appliances often hold important copies of data, so one incident can affect operations, backups, and recovery at the same time.
Actions to Take Now
Administrators should update DSM, enable automatic updates, and avoid exposing the management interface to the Internet. Remote access should use a VPN or another controlled access method, together with multifactor authentication, a strong unique password, and login restrictions. Teams should review unknown accounts, scheduled tasks, authentication logs, file changes, and unusual connections.
If Encryption Has Already Started
Isolate the NAS from the network, but do not erase data or reinstall the system before preserving evidence. Organizations should determine the scope, rotate credentials from a clean device, inspect systems that used the same accounts, and contact an incident-response team. Recovery should begin only from a tested offline backup after the intrusion path and persistence mechanisms have been removed.
Lessons for Protecting Storage Systems
The C3RB3R incident is a reminder that storage appliances are not black boxes that can run without maintenance. Backups are useful only when separated from primary administrator accounts, protected through immutable or offline copies, and tested in recovery exercises. Timely patching, reduced Internet exposure, and change monitoring are the three most important defensive layers.
VNCyberS compiled from Synology, BleepingComputer, and The Hacker News
Tiếng Việt
English