Deadbolt ransomware

[lmugarte]

Hi

Hello everyone

Same thing happened to me this morning. The HDs of my NAS AS1002T v2 started to fail (red led), I rebooted and then the same message from Deadbolt appeared.
Important: since the last attack I had disabled EZConnect and followed all Asus technical instructions and my firmware was up to date from the last version

Please ASUS we await your urgent pronouncement!!

[JeffBoyd61]

Crap. Me too. This is getting very old.

[JeffBoyd61]

It's time for Asustor to pay off the Deadbolt folks to stop the ransomware attacks. If not, they need to pay damages inflicted on the purchasers of their product.

[sksbir]

Hi
Hello everyone
Same thing happened to me this morning. The HDs of my NAS AS1002T v2 started to fail (red led), I rebooted and then the same message from Deadbolt appeared.
Important: since the last attack I had disabled EZConnect and followed all Asus technical instructions and my firmware was up to date from the last version
Please ASUS we await your urgent pronouncement!!

Hello
I know it's not going to help you much, but if your experience can help others: can we verify that you really did everything right?
- Firmware installed: 4.0.5.RTU2
- Ezconnect deactivated
- ADM port changed
- ssh port changed
- SSH disabled
- user admin disabled, and you have created another account of your choice to administer the NAS
- Autoblacklist enabled + "hard" settings => 3 times in 10mn = 1 week of blocking + ALL protocols checked.

[jcminarro]

I have been attacked as well.
Any option to recover files?

[earthwalkerx]

same here -.-
AS6102T shutdown and diconnected -> waiting for instructions.

Firmware 4.0.5.RTU2
- Ezconnect deactivated
- ADM port wasn't changed
- SSH was activ, but blocked be FW

[ov2rey]

i try to shut down or reboot the nas and it do not enter initialization page.. i am stuck with the deadbolt page...

[core_haza]

I have also been attacked.
Asustor AS6508T.

Where is Asustor support? This is insane. The fact that this has happened a 2nd time after Asustor 'fixed' the problem, showcases that there are vulnerabilities in their hardware/software!
I have a lifetime of work on this NAS (yes I have back-ups, but I have over 120TB+ with a lot of file turn-over, so it's not an easy solution to 'back-up everyday').
Asustor really needs to step up and help users recover their data.

[bravolima]

I was also attacked two days ago.
AS3102T
I haven't used the NAS for a long time, but it was online and with not the latest firmware. EZ-Connect was on.
- I unplugged the LAN, shut the device down and made all the things, I saw on Asustor homepage.
- I could update the firmware to the newest one, but the ransomware remained.
- I changed all deafult ports, blocked all access from outside, but maybe too late.
- Now the situation is:
- If I turn the NAS on, I can enter the ADM, do everything. BUT if I press F5, the deadbolt screen comes up again.

So I did everything after the attack that was adviced by Asustor (in Febr...), but the attack is still there and I guess that the encryption is still going (if not finished already.). So I shut down the system and waiting.

[gianluigi1982]

Same here.
AS-202TE
shutdown and disconnected.
It seems that ASUSTOR and QNAP should pay to keep their customers.
This is very annoying. Always updating, patching...