Page 15 of 34
Re: Urgent Notification about TNAS being Attacked by Ransomware
Posted: 28 Feb 2022, 21:19
by DS73
HI All,
Same thing happened to me today, deadbolt ransomware, turned NAS off and back on and i am still able to access files, although quite a few now have the filenames changed to deadbolt at the end.
Re: Urgent Notification about TNAS being Attacked by Ransomware
Posted: 28 Feb 2022, 22:31
by TMroy
May I know which TOS version is running on your device?
Re: Urgent Notification about TNAS being Attacked by Ransomware
Posted: 28 Feb 2022, 22:32
by TMroy
It is recommended to power off your device to stop the encryption before you have a solution to the ransomware.
Re: Urgent Notification about TNAS being Attacked by Ransomware
Posted: 28 Feb 2022, 22:35
by TMroy
We did receive the report from some users, their TNAS devices were attacked by deadbolt ransomware. We are studying the issue at the moment, will keep you be updated.
Re: Urgent Notification about TNAS being Attacked by Ransomware
Posted: 28 Feb 2022, 22:38
by DS73
I'm not sure which TOS version was running, but it recently updated, is there a way to find out via SSH ?
Re: Urgent Notification about TNAS being Attacked by Ransomware
Posted: 28 Feb 2022, 22:52
by Roccia7
I was also attacked by deadbolt. I had already made the changes recommended in the first post, but it didn't help. Now I have the encrypted disk. The latest version of tos was installed, 4.2.28 if I'm not mistaken. Is there a way to save the data?
This is a screenshot of the message
https://ibb.co/p4Gs25B
Re: Urgent Notification about TNAS being Attacked by Ransomware
Posted: 28 Feb 2022, 22:53
by TMroy
Re: Urgent Notification about TNAS being Attacked by Ransomware
Posted: 28 Feb 2022, 22:56
by DS73
Unfortunately I cant see that screen, all I have at login is the deadbolt ransomware screen
Re: Urgent Notification about TNAS being Attacked by Ransomware
Posted: 28 Feb 2022, 22:57
by TMroy
I see. so now please keep your device power off, and wait for our news.
Re: Urgent Notification about TNAS being Attacked by Ransomware
Posted: 28 Feb 2022, 23:04
by DS73
i had restarted my device, and I still have access via SMB share on my laptop. The encryption seems to have stopped, I have 704 files which have been renamed to a deadbolt file extension, this number has not changed in the last few hours. When this extension is removed the file is still not usable. I will turn the device back off.