{"id":2183,"date":"2026-11-04T07:19:41","date_gmt":"2026-11-04T00:19:41","guid":{"rendered":"https:\/\/vncybers.vn\/synology-dsm-cu-ransomware-c3rb3r-nas\/"},"modified":"2026-11-04T07:19:41","modified_gmt":"2026-11-04T00:19:41","slug":"synology-outdated-dsm-c3rb3r-ransomware-nas","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/synology-dsm-cu-ransomware-c3rb3r-nas\/","title":{"rendered":"Hackers Exploit Outdated Synology DSM to Deploy C3RB3R Ransomware"},"content":{"rendered":"

Synology c\u1ea3nh b\u00e1o m\u1ed9t l\u00e0n s\u00f3ng ransomware C3RB3R \u0111ang nh\u1eafm v\u00e0o c\u00e1c thi\u1ebft b\u1ecb NAS ch\u1ea1y phi\u00ean b\u1ea3n DiskStation Manager (DSM) l\u1ed7i th\u1eddi.<\/strong> K\u1ebb t\u1ea5n c\u00f4ng khai th\u00e1c l\u1ed7 h\u1ed5ng \u0111\u00e3 \u0111\u01b0\u1ee3c v\u00e1 t\u1eeb th\u00e1ng 12\/2024 \u0111\u1ec3 m\u00e3 h\u00f3a d\u1eef li\u1ec7u v\u00e0 \u0111\u00f2i ti\u1ec1n chu\u1ed9c. Ng\u01b0\u1eddi qu\u1ea3n tr\u1ecb c\u1ea7n c\u1eadp nh\u1eadt DSM ngay, ng\u1eaft giao di\u1ec7n qu\u1ea3n tr\u1ecb kh\u1ecfi Internet v\u00e0 ki\u1ec3m tra kh\u1ea3 n\u0103ng ph\u1ee5c h\u1ed3i t\u1eeb b\u1ea3n sao l\u01b0u.<\/p>\n

A Rare Warning From Synology<\/h2>\n

In an October 29, 2026 notice, Synology confirmed that threat actors are abusing an old vulnerability on unpatched devices. The company has not identified the exact CVE used in the attacks, but directed users to Synology-SA-24:20, which lists flaws enabling code execution and file reading or writing on unpatched DSM systems.<\/p>\n

\"Storage
Network storage should be separated from the public Internet and updated regularly. Photo: Taylor Vick\/Unsplash.<\/figcaption><\/figure>\n

How C3RB3R Encrypts Data<\/h2>\n

C\u00e1c b\u00e1o c\u00e1o ban \u0111\u1ea7u cho bi\u1ebft ransomware \u0111\u1ed5i ph\u1ea7n m\u1edf r\u1ed9ng t\u1ec7p th\u00e0nh .L0CK3D<\/code> v\u00e0 \u0111\u1ec3 l\u1ea1i th\u01b0 \u0111\u00f2i ti\u1ec1n chu\u1ed9c read-me3.txt<\/code>. N\u1ea1n nh\u00e2n \u0111\u01b0\u1ee3c h\u01b0\u1edbng t\u1edbi m\u1ed9t c\u1ed5ng tr\u00ean dark web \u0111\u1ec3 mua c\u00f4ng c\u1ee5 \u201cC3rb3r Decryptor\u201d. Ch\u01b0a c\u00f3 b\u1eb1ng ch\u1ee9ng c\u00f4ng khai cho th\u1ea5y m\u1ecdi thi\u1ebft b\u1ecb Synology \u0111\u1ec1u b\u1ecb \u1ea3nh h\u01b0\u1edfng; \u0111i\u1ec3m chung \u0111\u01b0\u1ee3c x\u00e1c nh\u1eadn l\u00e0 c\u00e1c m\u00e1y b\u1ecb nh\u1eafm t\u1edbi \u0111ang ch\u1ea1y DSM l\u1ed7i th\u1eddi.<\/p>\n

DSM Releases That Need Upgrading<\/h2>\n

According to a patch table compiled by BleepingComputer from Synology's advisory, DSM 7.2.2 should be at least 7.2.2-72806-1; DSM 7.2.1 at least 7.2.1-69057-6; DSM 7.2 at least 7.2-64570-4; DSM 7.1 at least 7.1.1-42962-7; and DSM 6.2 at least 6.2.4-25556-8. Users should check the official advisory for their model and support branch before upgrading.<\/p>\n

A Concerning Exposure Footprint<\/h2>\n

Shadowserver data shows more than 380,000 Internet-accessible Synology NAS devices. That does not mean every device is vulnerable, because the count may include patched systems and honeypots, but it demonstrates a large attack surface. NAS appliances often hold important copies of data, so one incident can affect operations, backups, and recovery at the same time.<\/p>\n

Actions to Take Now<\/h2>\n

Administrators should update DSM, enable automatic updates, and avoid exposing the management interface to the Internet. Remote access should use a VPN or another controlled access method, together with multifactor authentication, a strong unique password, and login restrictions. Teams should review unknown accounts, scheduled tasks, authentication logs, file changes, and unusual connections.<\/p>\n

If Encryption Has Already Started<\/h2>\n

Isolate the NAS from the network, but do not erase data or reinstall the system before preserving evidence. Organizations should determine the scope, rotate credentials from a clean device, inspect systems that used the same accounts, and contact an incident-response team. Recovery should begin only from a tested offline backup after the intrusion path and persistence mechanisms have been removed.<\/p>\n

Lessons for Protecting Storage Systems<\/h2>\n

The C3RB3R incident is a reminder that storage appliances are not black boxes that can run without maintenance. Backups are useful only when separated from primary administrator accounts, protected through immutable or offline copies, and tested in recovery exercises. Timely patching, reduced Internet exposure, and change monitoring are the three most important defensive layers.<\/p>\n

VNCyberS<\/strong> compiled from Synology, BleepingComputer, and The Hacker News<\/em><\/p>","protected":false},"excerpt":{"rendered":"

Synology c\u1ea3nh b\u00e1o m\u1ed9t l\u00e0n s\u00f3ng ransomware C3RB3R \u0111ang nh\u1eafm v\u00e0o c\u00e1c thi\u1ebft b\u1ecb NAS ch\u1ea1y phi\u00ean b\u1ea3n DiskStation Manager (DSM) l\u1ed7i th\u1eddi. K\u1ebb t\u1ea5n c\u00f4ng khai th\u00e1c l\u1ed7 h\u1ed5ng \u0111\u00e3 \u0111\u01b0\u1ee3c v\u00e1 t\u1eeb th\u00e1ng 12\/2024 \u0111\u1ec3 m\u00e3 h\u00f3a d\u1eef li\u1ec7u v\u00e0 \u0111\u00f2i ti\u1ec1n chu\u1ed9c. Ng\u01b0\u1eddi qu\u1ea3n tr\u1ecb c\u1ea7n c\u1eadp nh\u1eadt DSM ngay, ng\u1eaft giao […]<\/p>\n","protected":false},"author":2,"featured_media":2182,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[46,1066,1065,238,43,1068,1064,1067],"class_list":["post-2183","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tin-tuc","tag-an-ninh-mang","tag-c3rb3r","tag-dsm","tag-nas","tag-ransomware","tag-sao-luu-du-lieu","tag-synology","tag-synology-sa-2420"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2183","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=2183"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2183\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/2182"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=2183"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=2183"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=2183"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}