Summary
- Synology identified ransomware attacks against outdated DSM installations.
- The exploited weakness was patched in December 2024.
- The exact CVE used in the current attacks has not been confirmed.
Synology has warned that ransomware operators are exploiting a weakness patched in December 2024 against storage systems still running outdated versions of DiskStation Manager, putting business files and recovery infrastructure at risk.
The Synology warning concerns attacks on network-attached storage appliances, which organisations use to retain shared files, local backups, application data, and documents required for daily operations.
Recent activity has been associated with C3RB3R ransomware, a family used to encrypt files and demand payment. The company has not published a reliable total of compromised customers or the aggregate value of losses from the current campaign.
Synology has linked the observed attacks to an older security weakness for which a fix was available. It has not publicly confirmed the individual CVE used to exploit the affected systems, so attributing the activity to a particular vulnerability would exceed the available evidence.
The warning illustrates why network storage remains a significant operational dependency. An appliance may serve several teams or offices while appearing to be a relatively simple file-sharing device rather than a server requiring continuous security maintenance.
Such systems may also retain copies intended for disaster recovery. An incident can become especially difficult when the same administrative accounts or network paths provide access to both active data and the files needed to restore it.
Attackers who gain control of vulnerable storage infrastructure may be able to encrypt data, disrupt access, or interfere with backup processes. The actual effect depends on permissions, storage layout, and whether independent recovery copies are available.
The current exploitation demonstrates that issuing a security fix does not automatically remove exposure from the installed base. Devices can remain on older software because they are poorly inventoried, considered too disruptive to update, or maintained by a contractor without a regular patching programme.
Some NAS appliances also provide remote administration, synchronisation, or application hosting. Those functions can make a device more useful, but they may expose management interfaces to external networks unless access restrictions are carefully configured.
Synology has urged customers to update supported versions of DiskStation Manager and reduce unnecessary internet exposure. Automatic updating may be suitable for some environments, while others require compatibility checks and planned maintenance.
The update process is separate from recovery after a suspected compromise. Removing a vulnerable version does not necessarily establish that an attacker has lost all access if credentials, accounts, or other components were altered during an intrusion.
Organisations dealing with ransomware may need to inspect the affected appliance and assess the integrity of the information stored on it before restoring normal connectivity. Where the device contains backup copies, alternative trusted sources may be necessary.
A basic recovery plan must consider the separation of backup credentials and storage destinations, the availability of offline or immutable copies, and the ability to restore essential files within an acceptable time.
These arrangements have practical limitations: immutable storage is useful only if the correct data has been retained and recovery procedures have been tested. A nominal backup does not establish that critical information can be reconstructed after a serious incident.
Synology has separately published guidance relating to newer vulnerabilities in PHP-dependent packages. That work should not be presented as confirmation that those flaws were exploited in the C3RB3R attacks described in the current warning.
The distinction between concurrent advisories matters when deciding what to investigate. Different vulnerabilities may affect different software components and require different remediation steps, even where they concern products from the same manufacturer.
Older appliances also raise lifecycle questions. A product may remain technically functional after its regular update support has ended, but continued use can leave the operator without a vendor fix when a newly identified security weakness emerges.
The current campaign’s full reach remains uncertain. What is established is that ransomware operators are targeting installations that have not received a previously available security correction.
The gap between patch release and operational deployment remains a central exposure for organisations depending on network storage to protect and recover business information.
