Urgent Notification about TNAS being Attacked by Ransomware

[DS73]

HI All,

Same thing happened to me today, deadbolt ransomware, turned NAS off and back on and i am still able to access files, although quite a few now have the filenames changed to deadbolt at the end.

[TMroy]

{L_BUTTON_AT}ChinChillaH

May I know which TOS version is running on your device?

[TMroy]

{L_BUTTON_AT}DS73

It is recommended to power off your device to stop the encryption before you have a solution to the ransomware.

[TMroy]

We did receive the report from some users, their TNAS devices were attacked by deadbolt ransomware. We are studying the issue at the moment, will keep you be updated.

[DS73]

I'm not sure which TOS version was running, but it recently updated, is there a way to find out via SSH ?

[Roccia7]

I was also attacked by deadbolt. I had already made the changes recommended in the first post, but it didn't help. Now I have the encrypted disk. The latest version of tos was installed, 4.2.28 if I'm not mistaken. Is there a way to save the data?

This is a screenshot of the message
https://ibb.co/p4Gs25B

[TMroy]

[DS73]

Unfortunately I cant see that screen, all I have at login is the deadbolt ransomware screen

[TMroy]

I see. so now please keep your device power off, and wait for our news.

[DS73]

i had restarted my device, and I still have access via SMB share on my laptop. The encryption seems to have stopped, I have 704 files which have been renamed to a deadbolt file extension, this number has not changed in the last few hours. When this extension is removed the file is still not usable. I will turn the device back off.