HI All,
Same thing happened to me today, deadbolt ransomware, turned NAS off and back on and i am still able to access files, although quite a few now have the filenames changed to deadbolt at the end.
Urgent Notification about TNAS being Attacked by Ransomware
Re: Urgent Notification about TNAS being Attacked by Ransomware
{L_BUTTON_AT}ChinChillaH
May I know which TOS version is running on your device?
To contact our team, please send email to following addresses, remember to replace (at) with @:
Support team: support(at)terra-master.com (for technical support only)
Service team: service(at)terra-master.com (for purchasing, return, replacement, RMA service)
Support team: support(at)terra-master.com (for technical support only)
Service team: service(at)terra-master.com (for purchasing, return, replacement, RMA service)
Re: Urgent Notification about TNAS being Attacked by Ransomware
{L_BUTTON_AT}DS73
It is recommended to power off your device to stop the encryption before you have a solution to the ransomware.
To contact our team, please send email to following addresses, remember to replace (at) with @:
Support team: support(at)terra-master.com (for technical support only)
Service team: service(at)terra-master.com (for purchasing, return, replacement, RMA service)
Support team: support(at)terra-master.com (for technical support only)
Service team: service(at)terra-master.com (for purchasing, return, replacement, RMA service)
Re: Urgent Notification about TNAS being Attacked by Ransomware
We did receive the report from some users, their TNAS devices were attacked by deadbolt ransomware. We are studying the issue at the moment, will keep you be updated.
To contact our team, please send email to following addresses, remember to replace (at) with @:
Support team: support(at)terra-master.com (for technical support only)
Service team: service(at)terra-master.com (for purchasing, return, replacement, RMA service)
Support team: support(at)terra-master.com (for technical support only)
Service team: service(at)terra-master.com (for purchasing, return, replacement, RMA service)
Re: Urgent Notification about TNAS being Attacked by Ransomware
I'm not sure which TOS version was running, but it recently updated, is there a way to find out via SSH ?
Re: Urgent Notification about TNAS being Attacked by Ransomware
I was also attacked by deadbolt. I had already made the changes recommended in the first post, but it didn't help. Now I have the encrypted disk. The latest version of tos was installed, 4.2.28 if I'm not mistaken. Is there a way to save the data?
This is a screenshot of the message
https://ibb.co/p4Gs25B
This is a screenshot of the message
https://ibb.co/p4Gs25B
Re: Urgent Notification about TNAS being Attacked by Ransomware
To contact our team, please send email to following addresses, remember to replace (at) with @:
Support team: support(at)terra-master.com (for technical support only)
Service team: service(at)terra-master.com (for purchasing, return, replacement, RMA service)
Support team: support(at)terra-master.com (for technical support only)
Service team: service(at)terra-master.com (for purchasing, return, replacement, RMA service)
Re: Urgent Notification about TNAS being Attacked by Ransomware
Unfortunately I cant see that screen, all I have at login is the deadbolt ransomware screen
Re: Urgent Notification about TNAS being Attacked by Ransomware
I see. so now please keep your device power off, and wait for our news.
To contact our team, please send email to following addresses, remember to replace (at) with @:
Support team: support(at)terra-master.com (for technical support only)
Service team: service(at)terra-master.com (for purchasing, return, replacement, RMA service)
Support team: support(at)terra-master.com (for technical support only)
Service team: service(at)terra-master.com (for purchasing, return, replacement, RMA service)
Re: Urgent Notification about TNAS being Attacked by Ransomware
i had restarted my device, and I still have access via SMB share on my laptop. The encryption seems to have stopped, I have 704 files which have been renamed to a deadbolt file extension, this number has not changed in the last few hours. When this extension is removed the file is still not usable. I will turn the device back off.