Urgent Notification about TNAS being Attacked by Ransomware

[billbo2020]

OK so i'm able to recover about 70/80% of my files from a Shortcut on my pc , of the 10 folders i have on my first nas only 2 are dead.bolted , i can only do this by the Shortcut , so now moving my files to a usb harddrive

[mapawluk]

Whelp, no paying the ransom tonight. Coinbase is limiting withdrawals/transfers until the bank transaction clears. Will update as soon as I am able to actually send the $BTC. I always wanted to learn about crypto, but never did I imagine that I would be doing it because of this. For being so decentralized and, there are an awful lot of restrictions around acquiring and transferring $BTC.

I will still be documenting my steps to fulfill the payment. In the mean time, if anyone else will be paying, please email [email protected] and follow his instructions. https://www.bleepingcomputer.com/forums ... on/page-21

"Can you please share your decryption key and some .deadbolt files with me so I can understand how the hackers encrypted your data?
I might be able to create a tool to decrypt the files of all other victims! "

I will be doing the same.

[mapawluk]

Can confirm that RakhniDecryptor does not work on our version of deadbolt encryption. My process was to copy a file from the NAS, place on desktop and point the decryptor to the specific file. Result was encryption not recognized.

[R-JayGee]

I find myself in the same boat as many having been locked out by the Ransomware on my F5. Fortunately in my situation I have a recent separate backup from a week ago and have only lost a few media files. I am thinking I will redo my NAS in this instance from scratch. As I can't get to and past the login screen is the best and safest way to re-format my drives to plug the drives into my PC one by one and format them there?

[Bellcorp]

terramaster me envio un correo de como hacer los pasos de restauracion del inicio pero me parece demasiado generico


Hello,

Thanks for contacting TerraMaster!



Sorry to hear about this.

We've been receiving reports recently that some users' TNAS devices are being attacked by the Deadbolt ransomware. According to our study of these cases, once the device was attacked by the Deadbolt ransomware virus, the user's data was encrypted. The virus will mutate and launch attacks according to different NAS devices. NAS of other brands have been attacked before. Unfortunately, TNAS has also become the target of this attack.



If your device has been attacked by Deadbolt ransomware, Please:



1. Shut down the TNAS device immediately to reduce losses due to continuous encryption by hackers;

x.86 model: short press the power switch;

ARM model: long press the power switch for 3 seconds;



2. It is recommended that you reinstall the latest version of the TOS system to completely remove viruses and strengthen weak vulnerabilities.



How to reinstall TOS : viewtopic.php?f=76&t=423



TOS Installation Package: https://download2.terra-master.com/TOS_ ... 281736.ins



3. Please refer to the guidelines to set up your TNAS to improve the security level:



viewtopic.php?f=6&t=2877



Best regards,

TerraMaster Support Team

[juanmel]

Well, Terramaster has left us alone to be able to decrypt our files due to its security flaw.

They say in the mail:

"Hi, Only the hackers know how to decrypt files encrypted by the hackers, sorry we can't do anything about it."

Fortunately my encrypted files are not very important. But it is very sad that they don't take care of their users by fixing the encryption. We will continue to seek a solution to the problem on our own.

[ChinChillaH]

It is really very sad that we are left alone. I would have at least expected to get a good solution.

Too bad TerraMaster has no way to solve the problem except by reinstalling TOS.

[Bellcorp]

I just saw that the server of a friend who is signology looks like the same thing has happened to him and that when it happened to me I told him so but it seems that they have also been attacked

[chuckrush]

I have a F4-210 that has been attached by Deadbolt. I followed the instructions to reset the system and reload the software. The process just seems stuck in a loop. After the initialization and software install I can access the unit via the PC app but when I try to login it restarts the process.

[chuckrush]

If I can get access again I can probably restore the greater portion of my affected files. When I mail support I continue to just get a copy og the document that outlines the reload issue. Noone actually seems to be looking at issues.