Synology has issued a call for immediate action from its users following a wave of ransomware attacks targeting its Network Attached Storage (NAS) devices. These attacks exploit a previously patched vulnerability in the DiskStation Manager (DSM) software, which was addressed by Synology in December 2024. The Taiwanese company has observed that threat actors are using this flaw to encrypt data and demand ransom from affected users.

Although Synology did not specify which vulnerability is being targeted, the attacks have been linked to issues highlighted in a November 2024 security advisory. Users have reported that their devices are being hit by the C3RB3R ransomware, which encrypts files with a '.L0CK3D' extension. This ransomware has a history of attacking NAS devices by leveraging DSM vulnerabilities. It scans files on compromised devices, avoiding certain directories and file types to maintain system stability during encryption. Encrypted files come with a ransom note named 'read-me3.txt'.

This situation is a reminder of past incidents where NAS devices have been targeted. In 2019, QNAP Systems' NAS devices fell victim to eCh0raix ransomware. Similarly, in August 2021, Synology devices were under threat from StealthWorker-driven brute-force attacks, which also led to ransomware infections. These attacks often involve guessing common administrative credentials to install malicious payloads.

Synology is strongly advising all users to update their DSM software to the latest version to safeguard their systems. The company also recommends enabling automatic updates to ensure DSM remains current and to mitigate the risk of future vulnerabilities being exploited.