Owners of various models of Asustor Network Attached Storage (NAS)have warned on Reddit and the company's official forum of an active ransomware attack that locks media libraries and other stored data. Initially, it was suspected that users using EZConnect were vulnerable, but according to accounts from some affected Reddit users, they had disabled the service on their NAS.
See also: Ransomware: Victims pay but hackers come back for more
The r/asustor has been monitoring the available information and after cross-referencing the services on the affected devices, they now suspect that Plex is one of the possible attack vectors.
Asustor is actively investigating the ransomware attack, known as Deadbolt , and has published a blog on its website stating that the myasustor.com Dynamic Domain Name (DDNS) has been temporarily disabled for security reasons. The company advises those who have not yet been affected by Deadbolt to take the following precautionary measures:
- Change the default ports, including the default NAS web access ports 8000 and 8001, as well as the remote web access ports 80 and 443.
- Turn off EZ Connect.
- Create a backup immediately.
- Disable Terminal/SSH and SFTP services.
See also: FBI: BlackByte ransomware has targeted critical US infrastructure
But for those who were unlucky enough to protect themselves and have received a ransomware message on their Asustor NAS GUI, the company advises taking it offline completely by taking the following steps:
- Disconnect the Ethernet network cable
- Safely shut down your NAS by pressing and holding the power button for three seconds.
- Do not initialize your NAS, as this will erase your data.
- Fill out the form. Our technicians will contact you as soon as possible.
Ransomware attacks have been on the rise, affecting large numbers of people, including last year's attack on the Colonial Pipeline that caused gas shortages and panic along the southeast coast, as well as last Christmas' attack on Kronos that could leave many people without paychecks.
See also: Sports brand Mizuno falls victim to ransomware attack
Ransomware attacks targeting a niche consumer networking product like Asustor NAS aren't as high-profile, but they serve as a reminder that you should always keep your data backed up. In this case, people could lose a ton of their media and lose their Plex servers, which have already suffered enough in 2022.
