thecomputerguy
Well-Known Member
- Reaction score
- 1,368
I have a rather larger client who over the weekend had all of their data on their mapped drives encrypted with the usual text file with a contact email for bitcoin.
Thankfully we do have backups and I am working on restoring about 2TB of data which is taking quite awhile because I want to make sure the encrypted bad data is backed up before I erase it in case I need it.
So my plan is to backup all of the bad encrypted data onto an external, then restore from backup to another external then copy it back into place, the whole process I'm expecting to take about 24hrs.
The worst part about this is that I have not located the culprit and I am afraid of the data getting re-encrypted once it's back in place. I've manually checked all PC's and Surface's. I've done full scans on all computers most of which came up with nothing or just some bad chrome extensions. All PC's had AV specifically Emsisoft (full scans clean). Usually it's easy to spot the culprit because the offending PC would have it's local contents encrypted but none of the PC's local data was encrypted. They do have people remoting in through RDS but I've checked all of those logins and everything looks fine. Ran through the task manager on all PC's and saw no strange looking processes.
It's literally just the mapped drives whose data was encrypted. Luckily their ACT database and the QB database weren't affected, but I don't think they usually get targeted anyways.
It looks like the encryption began around 6PM yesterday, but no one claims to have been in the office, then there is a burst of files encrypted this morning around 8AM. So maybe this thing was sitting dormant for days/weeks?
I explained this is usually from a fake Fedex or UPS email that someone clicks on and downloads an executable but of course no one would fess up to that.
Any tips here?
Thankfully we do have backups and I am working on restoring about 2TB of data which is taking quite awhile because I want to make sure the encrypted bad data is backed up before I erase it in case I need it.
So my plan is to backup all of the bad encrypted data onto an external, then restore from backup to another external then copy it back into place, the whole process I'm expecting to take about 24hrs.
The worst part about this is that I have not located the culprit and I am afraid of the data getting re-encrypted once it's back in place. I've manually checked all PC's and Surface's. I've done full scans on all computers most of which came up with nothing or just some bad chrome extensions. All PC's had AV specifically Emsisoft (full scans clean). Usually it's easy to spot the culprit because the offending PC would have it's local contents encrypted but none of the PC's local data was encrypted. They do have people remoting in through RDS but I've checked all of those logins and everything looks fine. Ran through the task manager on all PC's and saw no strange looking processes.
It's literally just the mapped drives whose data was encrypted. Luckily their ACT database and the QB database weren't affected, but I don't think they usually get targeted anyways.
It looks like the encryption began around 6PM yesterday, but no one claims to have been in the office, then there is a burst of files encrypted this morning around 8AM. So maybe this thing was sitting dormant for days/weeks?
I explained this is usually from a fake Fedex or UPS email that someone clicks on and downloads an executable but of course no one would fess up to that.
Any tips here?
