Tayvanlik tarmoqga ulangan saqlash (NAS) qurilmalari ishlab chiqaruvchisi Synology mijozlarini qurilmalarini zudlik bilan yangilashga chaqirdi, chunki C3RB3r ransomware hujumlari keskin ko'paygan.
Kompaniya foydalanuvchilarga avtomatik yangilanishlarni yoqishni va NAS qurilmalarida ishlaydigan DiskStation Manager (DSM) dasturini ma'lumotlarini himoya qilish uchun eng so'nggi versiyaga yangilashni tavsiya qildi.
"Synology tahdid aktorlari 2024-yil dekabr oyida tuzatilgan zaiflikdan foydalanib, DSM ning eskirgan versiyalarida ishlaydigan qurilmalarni nishonga olayotganini aniqladi. Bu hujumlar ma'lumotlarni shifrlash va to'lov talab qilishga qaratilgan", — deb aytildi payshanba kungi maslahatda.
"Synology zaif versiyalarni ishlatayotgan barcha foydalanuvchilarni tizimlarini himoya qilish uchun DSM ni zudlik bilan yangilashga qat'iy chaqiradi. Synology shuningdek, DSM ni doimo yangilab turish uchun avtomatik yangilanishlarni yoqishni tavsiya qiladi."
BleepingComputer ushbu C3RB3r ransomware hujumlari haqida qo'shimcha ma'lumot olish uchun murojaat qilganida, Synology vakili darhol javob bera olmadi.
Synology hali ham ushbu davom etayotgan hujumlarda qaysi zaiflikdan foydalanilayotganini ochiqlamagan bo'lsa-da, u 2024-yil noyabr oyidagi xavfsizlik maslahatiga havola qildi, unda zaif qurilmalarda hujumchilarga ixtiyoriy kodni bajarish (CVE-2024-10441), fayllarni o'qish (CVE-2024-50629) va fayllarni yozish (CVE-2024-10445) imkonini beradigan zaifliklar uchun chiqarilgan tuzatishlar haqida ma'lumot berilgan.
Synology foydalanuvchilariga boshqaruv veb-interfeysiga Internetdan kirishni darhol bloklash va qurilmalarini buzish va shifrlashga urinishlarini to'xtatish uchun DSM dasturini yangilash tavsiya etiladi.
| Mahsulot | Jiddiylik | Tuzatilgan versiya mavjudligi |
|---|---|---|
| DSM 7.2.2 | Kritik | 7.2.2-72806-1 yoki undan yuqoriga yangilang. |
| DSM 7.2.1 | Kritik | 7.2.1-69057-6 yoki undan yuqoriga yangilang. |
| DSM 7.2 | Kritik | 7.2-64570-4 yoki undan yuqoriga yangilang. |
| DSM 7.1 | Kritik | 7.1.1-42962-7 yoki undan yuqoriga yangilang. |
| DSM 6.2 | O'rtacha | 6.2.4-25556-8 yoki undan yuqoriga yangilang. |
Synology o'z mijozlarining qurilmalariga qaratilgan hujumlar haqida kamdan-kam xavfsizlik maslahatlari e'lon qiladi; oxirgi bunday ogohlantirish 2019-yil avgust oyida eCh0raix ransomware infektsiyalariga olib kelgan keng ko'lamli brute-force hujumlaridan so'ng e'lon qilingan.
O'tgan haftadagi maslahat Synology mijozlarining ma'lumotlari shifrlangan va ulardan qorong'u veb portalidan minglab dollarga "C3rb3r Decryptor" vositasini sotib olish so'ralganligi haqidagi ko'plab xabarlardan so'ng e'lon qilindi.
Birinchi xabarlar ikki haftadan ko'proq oldin paydo bo'lgan, ta'sirlangan foydalanuvchilar ransomware to'lov eslatmasini (read-me3.txt) qoldirganini va shifrlangan fayllarga .L0CK3D kengaytmasini qo'shganini aytishgan.
"Barcha muhim fayllaringiz shifrlangan. Fayllaringizni uchinchi tomon dasturlari bilan tiklashga urinishlar fayllaringiz uchun halokatli bo'ladi! Fayllaringizni xavfsiz tarzda shifrdan chiqarishning yagona yo'li — maxsus shifrdan chiqarish dasturi 'C3rb3r Decryptor'ni sotib olish", — deb ogohlantiradi to'lov eslatmasi.
"Ushbu sahifada siz barcha fayllaringizni tiklash uchun shifrdan chiqarish dasturini qanday sotib olish bo'yicha to'liq ko'rsatmalarni olasiz. Shuningdek, ushbu sahifada siz 'C3rb3r Decryptor' sizga yordam berishiga ishonch hosil qilish uchun har qanday bitta faylni bepul tiklashingiz mumkin."
C3RB3R to'lov eslatmasi (BleepingComputer)
Cerber ransomware (shuningdek C3RB3R va CerberImposter nomlari bilan ham tanilgan), endi Synology NAS qurilmalariga qaratilgan hujumlarda qo'llanilmoqda, 2016-yilda paydo bo'lgan va xuddi shu nomdagi mashhur Ransomware-as-a-Service (RaaS) operatsiyasidan o'z nomini olgan.
2019-yil oxirida yo'qolishidan oldin, eski Cerber ransomware operatsiyasi barcha ransomware hujumlarining 80% dan ortig'ini va korporativ endpointlardagi barcha ransomware infektsiyalarining chorak qismini tashkil etgan.
2021-yil dekabr oyida birinchi marta aniqlanganidan beri, C3RB3R Atlassian Confluence va GitLab serverlarida masofadan kod bajarish (CVE-2021-26084 va CVE-2021-22205) va autentifikatsiyani chetlab o'tish (CVE-2023-22518) zaifliklaridan foydalanadigan bir nechta hujum to'lqinlari doirasida ham qo'llanilgan.
Internet tahdid kuzatuvchisi Shadowserver hozirda 380 000 dan ortiq Internetga ochiq Synology NAS qurilmalarini kuzatmoqda, ammo ularning qanchasi ushbu hujumlarga qarshi allaqachon himoyalanganligi yoki honeypot ekanligi haqida ma'lumot bermaydi.
Mavjud himoyalaringiz o'tkazib yuborishi mumkin bo'lgan elektron pochta tahdidlarini aniqlang.
Adaptive Security'ning AI agentlari elektron pochta niyati, konteksti va xatti-harakatlarini tahlil qilib, fishing, biznes elektron pochta buzilishi va hisob-faktura firibgarligini aniqlaydi.
Microsoft 365 yoki Google Workspace'ning 14 kunlik faqat o'qish skaneri bilan nimalar o'tib ketayotganini ko'ring, MX o'zgarishlarsiz.
Bepul elektron pochta xavfsizligi skaneringizni boshlang.
Taiwanese network-attached storage (NAS) appliance maker Synology warned customers to update their devices immediately due to a surge in C3RB3r ransomware attacks.
The company urged users to enable automatic updates and upgrade the DiskStation Manager (DSM) software running on their NAS devices to the latest version to protect their data.
"Synology has identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM. These attacks aim to encrypt data and extort ransom," it said in a Thursday advisory.
"Synology strongly urges all users running vulnerable versions to update DSM immediately to protect their systems. Synology also recommends enabling automatic updates to keep DSM up to date at all times."
A Synology spokesperson was not immediately available when BleepingComputer reached out for more information on these C3RB3r ransomware attacks.
While Synology has yet to share which vulnerability is being exploited in these ongoing attacks, it linked to a November 2024 security advisorywith information about patches released for vulnerabilities allowing attackers to execute arbitrary code (CVE-2024-10441), read files (CVE-2024-50629), and write files (CVE-2024-10445) on unpatched devices.
Synology users are advised to immediately block access to the management web interface from the Internet and update their DSM software to block attackers' attempts to hack and encrypt their devices.
| Product | Severity | Fixed Release Availability |
|---|---|---|
| DSM 7.2.2 | Critical | Upgrade to 7.2.2-72806-1 or above. |
| DSM 7.2.1 | Critical | Upgrade to 7.2.1-69057-6 or above. |
| DSM 7.2 | Critical | Upgrade to 7.2-64570-4 or above. |
| DSM 7.1 | Critical | Upgrade to 7.1.1-42962-7 or above. |
| DSM 6.2 | Moderate | Upgrade to 6.2.4-25556-8 or above. |
Synology rarely issues security advisories warning of attacks targeting its customers' devices, with the last such alert published in August 2019 following large-scale brute-force attacks that led to eCh0raix ransomware infections.
Last week's advisory follows a massive wave of reports from Synology customers whose data was encrypted and who were prompted to buy"C3rb3r Decryptor" tool from a dark web portal for thousands of dollars.
The first reports surfaced more than two weeks ago, with affectedusers saying the ransomware dropped a ransom note (read-me3.txt) and added a .L0CK3D extension to encrypted files.
"All your important files have been encrypted. Any attempts to restore your files with thrid-party software will be fatal for your files! The only way to decrypt your files safely is to buy the special decryption software 'C3rb3r Decryptor'," the ransom note warns.
"At this page you will receive the complete instructions how to buy the decryption software for restoring all your files. Also at this page you will be able to restore any one file for free to be sure 'C3rb3r Decryptor' will help you."
C3RB3R ransom note (BleepingComputer)
The Cerber ransomware (also known as C3RB3R and CerberImposter), now deployed in attacks targeting Synology NAS devices, borrowed its name from a notorious Ransomware-as-a-Service (RaaS) with the same name that emerged in 2016.
Before disappearing at the end of 2019, the old Cerber ransomware operation accounted for more than 80% of all ransomware attacks and a quarter of all ransomware infections on enterprise endpoints.
Starting in December 2021, when it was first spotted, C3RB3R was also deployed on Atlassian Confluence and GitLab servers as part of several attack waves exploiting remote code execution (CVE-2021-26084 and CVE-2021-22205) and authentication bypass (CVE-2023-22518) flaws.
Internet threat watchdog Shadowserver now tracks over 380,000 Internet-exposed Synology NAS devices, but doesn't provide information on how many have already been secured against these attacks or are honeypots.
Uncover email threats your existing defenses may miss.
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
Start your free email security scan.