Urgent Notification about TNAS being Attacked by Ransomware

[DS73]

juanmel wrote:
> Hello. I am one more affected by malware. This morning while I was working
> I suddenly saw how files began to change their extension and update their
> modification date. I immediately knew what it was and turned off the NAS by
> pressing the button, disconnected the LAN cable of the NAS from the
> internet and also from the power. I think that not all the files have been
> encrypted, but I also think that if I restart the NAS it will still be
> encrypted. Has anyone had the same experience and tried turning it back on?
> We expect a miracle from Terramaster.

I turned mine back on, have a lot of files encrypted with deadbolt extension, stayed on for a few hours and no more files were encrypted stayed at the same number of files.

[juanmel]

DS73 wrote:
> juanmel wrote:
> > Hello. I am one more affected by malware. This morning while I was working
> > I suddenly saw how files began to change their extension and update their
> > modification date. I immediately knew what it was and turned off the NAS by
> > pressing the button, disconnected the LAN cable of the NAS from the
> > internet and also from the power. I think that not all the files have been
> > encrypted, but I also think that if I restart the NAS it will still be
> > encrypted. Has anyone had the same experience and tried turning it back on?
> > We expect a miracle from Terramaster.
>
> I turned mine back on, have a lot of files encrypted with deadbolt extension, stayed
> on for a few hours and no more files were encrypted stayed at the same number of
> files.

Well! Thank you very much for your answer. How did you turn the device back on? Did you connect the NAS with USB cable to the computer? Did you disconnect the router/modem from the internet? Could you please list the steps? Thank you very much.

[DS73]

juanmel wrote:
> DS73 wrote:
> > juanmel wrote:
> > > Hello. I am one more affected by malware. This morning while I was working
> > > I suddenly saw how files began to change their extension and update their
> > > modification date. I immediately knew what it was and turned off the NAS by
> > > pressing the button, disconnected the LAN cable of the NAS from the
> > > internet and also from the power. I think that not all the files have been
> > > encrypted, but I also think that if I restart the NAS it will still be
> > > encrypted. Has anyone had the same experience and tried turning it back on?
> > > We expect a miracle from Terramaster.
> >
> > I turned mine back on, have a lot of files encrypted with deadbolt extension,
> stayed
> > on for a few hours and no more files were encrypted stayed at the same number of
> > files.
>
> Well! Thank you very much for your answer. How did you turn the device back on? Did
> you connect the NAS with USB cable to the computer? Did you disconnect the
> router/modem from the internet? Could you please list the steps? Thank you very much.

I connected everything again as normal, Lan cable and power, I figured the damage was done anyway. I have my NAS mapped as a local network drive so i can access it from my laptop. I can still see and access all my files, and see which ones are encrypted with the deadbolt extension, and could see whether or not the encrytion was still running, which it didnt seem to be.

[juanmel]

DS73 wrote:
> I connected everything again as normal, Lan cable and power, I figured the damage
> was done anyway. I have my NAS mapped as a local network drive so i can access it
> from my laptop. I can still see and access all my files, and see which ones are
> encrypted with the deadbolt extension, and could see whether or not the encrytion was
> still running, which it didnt seem to be.


OK. Thanks. Do you have any antivirus installed on the NAS? It seems strange to me that being connected to the LAN network and with an internet connection as usual, it has stopped encrypting files. Thanks for your help. All the best.

[DS73]

>
> OK. Thanks. Do you have any antivirus installed on the NAS? It seems strange to me
> that being connected to the LAN network and with an internet connection as usual, it
> has stopped encrypting files. Thanks for your help. All the best.

Only if there was one preinstalled, I am using a TPlink Deco as my router which has antivirus installed, and it has blocked a numerous attempts in the past. Cant really say why it stopped encrypting but it stayed at 704 files encrypted.

[juanmel]

DS73 wrote:
> >
> > OK. Thanks. Do you have any antivirus installed on the NAS? It seems strange to
> me
> > that being connected to the LAN network and with an internet connection as
> usual, it
> > has stopped encrypting files. Thanks for your help. All the best.
>
> Only if there was one preinstalled, I am using a TPlink Deco as my router which has
> antivirus installed, and it has blocked a numerous attempts in the past. Cant really
> say why it stopped encrypting but it stayed at 704 files encrypted.

Well, Thank you very much. Maybe I'll try tomorrow to turn on the NAS if Terramaster doesn't give us news to help us. I wish good luck to all those affected to be able to recover their files.

[plannerface]

We also fell victim to the ransomware in the early hours of this morning. For some reason, one particular file extension which makes up approx 1/2 of my files was not targeted meaning I haven't lost everything, but my common file extensions were all deadbolted by the time we realised so we were not able to turn the NAS off mid-encryption. We unplugged ethernet and powered off the NAS once we realised and were able to gain access to view the drives by installing Linux and plugging them into a PC. Our 2 drives were RAID1 and we used this guide to gain access: https://thearchitect.wordpress.com/2022 ... ustor-nas/

We were then able to make a copy to an external harddrive. I still have half deadbolted files but the ones that were missed are luckily working perfectly. Hope this helps anyone.

[jani7]

I too was affected by Deadbolt.
The majority of my files on my Terramaster (but not all) were locked from about 2200 - 2300 EST yesterday the 27th. I was watching TV then and didn't notice this until today. I've left everything connected as nothing has changed all day.
What can be done?
Is there a fix from Terramaster yet?
Or will I have to reformat and lose everything?
I'd like to know how did the hacker get in? My NAS isn't accessable from outside my home network, my router and PC AV SW don't have anything about this. SSH isn't enabled so I can't get in. I just see the Deadlock screen when trying to login, but I can see the files from my PC via the mapping.

Since this happened, is there a threat to my PC?

[djacobson]

I got hit with Deadbolt as well last night. Some of my files are deadbolted but most are not. (They are renamed with deadbolt extension. They are encrypted.) I think the volume of my files proved to be too much for the worm to encrypt much of it.

I powered down my NAS. Luckily I have all my files backed up. When I powered back up, I still had the ransomware screen when it came back up. I no longer had access to the server as a file share. And Plex is no longer running on it. I had to power it down again. Also, when I had powered it up, I tried to use TNAS PC to establish contact with the unit and it was not visible.

I pulled all the drive and powered it back up. The setup software found it. I popped in the first drive (out of 4) and it did a check on the drive but didn't start the install because it couldn't download the software. Gonna try from a different PC possibly.

What should we be doing? I really don't want to rebuild terrabytes of files from scratch again. I'd rather just delete the infected files and that's it. What's the course of action?

[sound]

Same problem with Deadbolt.
This afternoon it hit my F4-210
Luckily I have backed up the files he encrypted and now I'm backing up the unencrypted ones, even if it will take me more than a day ....
I hope a cure for this virus is found quickly.