Urgent Notification about TNAS being Attacked by Ransomware

[ChinChillaH]

@TMRoy

i have the latest TOS Update installed. I can't see the version. I have no Loginscreen, i can see only the deadbolt message.
What could happen, if i powerup my nas? My files wasn't encrypted.
I have a complete backup. Can i reset the nas with a new tos installation?

[bobprue]

thank you. How will we know about the updates? Right now I just get the screen asking for bitcoins. I unplugged it from the network and have powered off

[titanrx8]

Were those of you affected by the ransomware using tnas.online for remote access?

[ChinChillaH]

I hope there is solution asap. I need the NAS.

Information:
SSH was not reachable over the internet only in my own network.
FTP was reachable (i've used this in the last few days but i forgot to disable the service) but i just changed the outbound port in my FritzBox and not the port in TOS.

[ChinChillaH]

titanrx8 wrote:
> Were those of you affected by the ransomware using tnas.online for remote access?

i do not use tnas.online for remote access.

[zimmth01]

I’m experiencing the deadbolt Ransomware attack now on my terramaster. I’ve disconnected from the internet and powered down. Looking for guidance from TM on what to do next.

[ChinChillaH]

zimmth01 wrote:
> I’m experiencing the deadbolt Ransomware attack now on my terramaster. I’ve disconnected from the internet and powered down. Looking for guidance from TM on what to do next.

How did you determine that a deadbolt attack is running?

[zimmth01]

I’m not saying it’s currently running. But rather I’m locked out of my files and it’s requesting btc payment in exchange for the encryption keys.

[Charlie_Croker]

zimmth01 wrote:
>

Are you able to access any of your files or are they already encrypted? (Try access via SMB: or AFP:)
If they're all encrypted then you have a choice:
1. Wait for a kind soul or Terramaster to develop/procure a key to decrypt the files
2. Wipe NAS and all drives and reinstall from backups
3. Pay the ransom and hope they send a key and that it works.

Good luck

[juanmel]

Hello. I am one more affected by malware. This morning while I was working I suddenly saw how files began to change their extension and update their modification date. I immediately knew what it was and turned off the NAS by pressing the button, disconnected the LAN cable of the NAS from the internet and also from the power. I think that not all the files have been encrypted, but I also think that if I restart the NAS it will still be encrypted. Has anyone had the same experience and tried turning it back on? We expect a miracle from Terramaster.