Synology warned customers to update immediately amid a surge of C3RB3R (Cerber-imposter) ransomware attacks exploiting DiskStation Manager flaws patched in December 2024 — including CVE-2024-10441 (arbitrary code execution), CVE-2024-50629 (arbitrary file read) and CVE-2024-10445 (arbitrary file write) — against devices running outdated versions. Ransom notes (read-me3.txt) rename encrypted files with a .L0CK3D extension and direct victims to a dark-web portal selling a "C3rb3r Decryptor" for thousands of dollars; the first victim reports surfaced more than two weeks ago. Synology, which last issued a ransomware warning in 2019 (after the eCh0raix brute-force campaign), lists critical fixes across DSM 7.2.2 down to 7.2 and recommends enabling automatic updates and blocking internet access to the management interface. Shadowserver tracks over 380,000 internet-exposed Synology NAS devices, making the attack surface substantial — and C3RB3R has previously hit Confluence and GitLab servers via their own RCE flaws, so the operators move with the patch lag.

• Source article