Ransomware Attacks on Synology NAS Users in South Korea Demand Bitcoin

Attacks targeting Synology NAS users in South Korea are demanding Bitcoin (BTC) to decrypt files, with the requested amount set to double after five days. Attackers are using C3RB3R ransomware to encrypt files including photos and documents. The initial demand is 0.036960 BTC for a decryption tool. If victims miss the five-day deadline, the demand rises to 0.073920 BTC. The Korea Internet & Security Agency (KISA) has received reports from multiple victims. Synology confirmed Thursday, Oct. 29, that attackers were exploiting previously patched vulnerabilities in older DSM versions. The company urged users to update.