Search — “CVE-2024-10441”

Synology says threat actors exploited a DSM vulnerability patched in December 2024 (advisory SA_24_20, listing CVE-2024-10441, CVE-2024-50629, CVE-2024-10445) to target devices running outdated DSM, with customers reporting C3RB3R ransomware locking files with a .L0CK3D extension. Qihoo 360 links C3RB3R to two DSM flaws (CVE-2026-13684, CVE-2026-13639) it says were fixed in September 2026, and sources report ransom notes named read-me3.txt dropped in encrypted directories. Hunters should look for .L0CK3D file extensions, read-me3.txt files, and unexpected shell or ransomware activity on DSM hosts running outdated versions.

Synology says threat actors are exploiting a DSM vulnerability patched in December 2024 against devices running outdated DSM versions, with attacks aiming to encrypt data and extort ransom. Customers report infections by C3RB3R ransomware, which locks files with a .L0CK3D extension and drops a ransom note named read-me3.txt in each encrypted directory. Qihoo 360 links C3RB3R to exploitation of two DSM flaws (CVE-2026-13684, CVE-2026-13639); Synology did not name the exploited flaw, so hunters should look for .L0CK3D files and read-me3.txt notes and check DSM patch levels.

Synology warned customers that threat actors are exploiting a vulnerability patched in December 2024 to target DSM devices running outdated versions, with attacks aiming to encrypt data and extort ransom. The source links the November 2024 advisory covering CVE-2024-10441, CVE-2024-50629, and CVE-2024-10445 but says Synology has not yet named the exploited flaw. Hunters should look for encrypted files with a .L0CK3D extension, a read-me3.txt ransom note, and DSM management interface exposure to the internet.