According to security experts, a new hacking campaign is targeting Iomega NAS devices, which are exposed on the Internet.
Specifically, hackers are deleting files from vulnerable Lenovo Iomega NAS devices.
Researchers believe that hackers are using the Shodan search engine to locate unprotected IOmega NAS devices and gain access via a public web interface.
The hackers delete files from NAS devices and then leave a note demanding a ransom in Bitcoin. Of course, it is not certain whether the attackers will return the stolen files to the victims after payment.
Many users complained that their files had been deleted or hidden and in their place a ransom note was found. The note says that the files have been encrypted and are in a safe place. The hackers gave users until August 1st to pay the ransom.
Specifically, the message was this:
Security researchers have spotted different messages on different victims. The hackers are demanding different amounts of money, ranging between 0.01 and 0.05 Bitcoin.
One of the notes, received by some users , stated that if payment is not made, the stolen files will be put up for sale on the dark web.
Unfortunately, many users are giving in and paying the ransom to get their files back. Analyzing one of the Bitcoin addresses, researchers found that there are at least 10 people who have already paid the ransom.
Researchers discovered that the hackers had deleted the files and hidden them somewhere on the disk , meaning that someone could recover them using software file recovery .
However, some users were unable to use these software on their NAS devices because they use the ext2 file system.
Recently, some security identified and revealed a series of attacks on QNAP NAS devices.
