Overview
- Synology issued a rare public advisory after customers reported devices with encrypted files carrying a ".L0CK3D" extension and ransom notes demanding a 'C3rb3r Decryptor'.
- The vendor said attackers are abusing vulnerabilities addressed in Synology's November–December 2024 security fixes and published exact DSM builds users must install to be protected.
- Synology told users to enable automatic updates and to block Internet access to management web interfaces to cut off remote attack paths.
- Security trackers show a large attack surface with more than 380,000 Internet-exposed Synology NAS devices that remain at risk if not updated.
- C3RB3R has been seen since 2021 targeting server software, and an infection on a NAS can lock shared files and backups and disrupt business operations, so immediate patching is critical.