Criminals are locking files on Synology storage boxes that have not been updated, and asking for thousands of dollars to unlock them.
Synology, the Taiwanese maker of home and office storage boxes, has warned owners to update them right away. Criminals are using a ransomware called C3RB3R to lock files on devices running old software, then demanding payment to unlock them.
These boxes are called network-attached storage, or NAS. They hold photos, backups and work files, and people reach them over a home or office network. Synology said attackers are exploiting a weakness it fixed in December 2024. The attacks hit devices running outdated versions of its DiskStation Manager (DSM) software, which is the system that runs the box.
Synology has not said which weakness is being used. It pointed to a November 2024 notice covering three fixes. Those flaws let an attacker run code, read files or write files on an unpatched device.
Reports began more than two weeks before the warning. Affected users find a note named read-me3.txt and files that end in .L0CK3D. The note says the only safe way to get files back is to buy a tool called C3rb3r Decryptor from a dark web site. Victims say the price is thousands of dollars.
Synology rarely warns customers about attacks. Its last alert like this was in August 2019, after another ransomware wave. Shadowserver, a group that tracks internet threats, counts over 380,000 Synology devices reachable from the internet. It does not say how many are already protected, or how many are decoy systems set up to study attackers.
The name is not new. An older Cerber ransomware operation began in 2016 and ended in 2019. C3RB3R has been seen since December 2021, including attacks on Atlassian Confluence and GitLab servers.
Synology says the attacks target outdated DSM versions. Owners who already run the latest version are not the target of this wave. Anyone unsure which version they have should check, since the fix has been available for a long time.
The alert box above lists the steps. The main ones are to update DSM, turn on automatic updates, keep the management page off the internet and keep a separate backup.
Several things are still unknown. Synology has not named the flaw, and a spokesperson was not available to BleepingComputer for details. It is also unclear how many devices have been locked. Owners should watch Synology's advisory for updates.
If you own a Synology storage box, update its DSM software today and keep a backup that is not always plugged in.
The Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone numberFake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourself
