Urgent Notification about TNAS being Attacked by Ransomware

[V8Triker]

I love how many times it is stated not to click on links that you do not know.

@LaMosca says come click my links and people do :D

[Charlie_Croker]

V8Triker wrote:
> I love how many times it is stated not to click on links that you do not
> know.
>
> @LaMosca says come click my links and people do :D

That’s what VMs are for :) lol

[V8Triker]

Charlie_Croker wrote:
> V8Triker wrote:
> > I love how many times it is stated not to click on links that you do not
> > know.
> >
> > @LaMosca says come click my links and people do :D
>
> That’s what VMs are for :) lol


LOL, indeed.
I also run an Ubuntu micro server, as well as a few VMs, running on vmware player.
The VM's are for "test and trash" purposes :D

My signature hints at my backup regime :)
The USB drive is hanging off an laptop running Ubuntu, which is in my garage/workshop that is detached from the house.
I should still have my data even in the event of a total loss of the house :)

[iano]

I think mine must have been encrypting for a considerable period, every file is locked.

A couple of questions while I start moving data, deciding whether it's worth keeping the locked stuff.

Are TM actively working on a decrypt?
Has any other NAS company managed to sort a decrypt?

[Charlie_Croker]

iano wrote:
>

You could try the links here, although how successful you will be is anyone's guess.


https://www.bugsfighter.com/remove-dead ... olt-files/

[Charlie_Croker]

iano wrote:
>
Some say this worked, I think its relies on a brute force attempt to crack password. https://www.techspot.com/downloads/6229 ... yptor.html

[Charlie_Croker]

Interesting thread here (QNAP and ASUSTOR owners, guess we can join in )

https://www.bleepingcomputer.com/forums ... on/page-22

[Charlie_Croker]

`And if you read the post at the bottom of the linked page it gets interestinghttps://www.bleepingcomputer.com/forums/t/76760 ... on/page-22

"Posted 25 February 2022 - 10:20 AM
Guess who is back with another recovery script

We are close to having a final solution on how to get some of your data back.
(If you do not know, we are the guys who created a recovery method for a previous QNAP ransomware attack.)

We need to do some final testing and we need to create a new tutorial for the new recovery script called "bolt-recover".
It will be very similar to our old tutorial, only the script has changed.

Until we release the new script and tutorial, you can do steps 1 - 14 from this tutorial, as it will be the same in the new one.
https://www.ikarussecurity.com/wp-conte ... -final.pdf

If you do this you can use the script immediately as it gets available.

This will work for both QNAP and ASUSTOR devices.

Make sure to NOT write any data to your devices, as it will lower any chances of recovery."

[jani7]

Charlie_Croker wrote:
> `And if you read the post at the bottom of the linked page it gets
> interestinghttps://www.bleepingcomputer.com/forums/t/76760 ... on/page-22
>
>
> "Posted 25 February 2022 - 10:20 AM
> Guess who is back with another recovery script
>
> We are close to having a final solution on how to get some of your data
> back.
> (If you do not know, we are the guys who created a recovery method for a
> previous QNAP ransomware attack.)
>
> We need to do some final testing and we need to create a new tutorial for
> the new recovery script called "bolt-recover".
> It will be very similar to our old tutorial, only the script has changed.
>
> Until we release the new script and tutorial, you can do steps 1 - 14 from
> this tutorial, as it will be the same in the new one.
>
> https://www.ikarussecurity.com/wp-conte ... -final.pdf
>
> If you do this you can use the script immediately as it gets available.
>
> This will work for both QNAP and ASUSTOR devices.
>
> Make sure to NOT write any data to your devices, as it will lower any
> chances of recovery."

I would venture to say that many people don't have a spare HD lying around "at least equal to your NAS size".

[Charlie_Croker]

"I would venture to say that many people don't have a spare HD lying around "at least equal to your NAS size".

Lets just say you had a lot of valuable data on your NAS, and had a choice between paying £1000 for a decryption key that might work or £300 for a 14TB drive you can then use as a backup that also might work.
Its probably worth the investment.