Asustor NAS drive owners have discovered that data they thought was safe and sound on their network storage devices have been encrypted by ransomware, with attackers demanding a ransom. Affected Asustor consumers have been posting on their support site about how they realized the DeadBolt ransomware had infected their NAS disks.
Most people initially realized anything was wrong when they received a message from the DeadBolt ransomware demanding 0.03 bitcoins (about US $1140 at current exchange rates) in exchange for the promised release of a decryption key. The DeadBolt ransomware’s message alleges that victims were targeted solely because they used Asustor NAS equipment, and it blames the vendor’s “inadequate security.”
Asustor claims it has stopped functionality that allows remote access to its NAS drives: ASUSTOR EZ-Connect, ASUSTOR EZ Sync, and ezconnect.to, while it examines what appears to be a significant problem. Moreover, the firm has issued the following advice to clients on how to protect themselves against the DeadBolt ransomware:
- Change default ports, such as NAS web access ports 8000 and 8001 and remote web access ports 80 and 443.
- Disable EZ Connect.
- Make a backup right away.
- Shut down Terminal/SSH and SFTP services.
Moreover, the organization has provided a link to more information on reducing the dangers of a ransomware attack. According to Asustor, customers affected by the ransomware attack should follow the actions outlined below:
- Remove the Ethernet network cable from the socket.
- Press and hold the power button for three seconds to safely shut down NAS.
- Do not start NAS, as this will wipe data.
- Fill up this online form with their information so that support technicians can contact them for more assistance.
The DeadBolt ransomware attack on Asustor NAS equipment comes barely one month after a similar attack on QNAP users. Unless they are convinced that a security hole allowing access to hackers is not hiding deep inside, NAS owners should guard their equipment behind a firewall, safely out of reach of the internet.
