[求救]DS1821+疑似中咗勒索

komachi

我部DS 1821只有用Quickconnect冇開SSH及Talent，現在所有FILE不見了，只有read me FILE, 我可以點做？

komachi

reread me 內容
Payment deadline: September 2, 2026 - 18:00 UTC

Hello.

This is DiskStation Security.

What happened?

- Your network was not secure.
- Your Network-Attached Storage was compromised.

What does this mean? Where are my files?

- All your data has been encrypted and hidden on a special volume.
- All your important documents have been downloaded.

What can I do to recover my data?

- If you want to recover your data, you have to send 0.07 Bitcoin to this wallet address:

bc1qv5zdacn9ptlfkahyyjgu922m74q4h5y93g5lyf

Always double check the address when copying/pasting it!

- Payment deadline: September 2, 2026 - 18:00 UTC

What should I do after I send the payment?

- Your ID is: xxxxxxxxxx
- Please email us your ID and payment confirmation to:

witold@tutanota.de
diskstation@atomicmail.io

- After we confirm your payment you will receive detailed instructions on how to decrypt all your data. It does not require any technical skills and it is done fast.

Why have my files been downloaded?

- We reserve the right to leak or sell all your important documents, if you don't contact us. Your GDPR regulators and Customers will also be notified about the breach, This will imply heavy fines.

WHAT HAPPENS IF YOU FAIL TO PAY:

- If you represent a company or organization:

- Public Execution of Reputation: We will publish ALL your internal documents: financial reports, client correspondence, employee personal data, trade secrets. This will be posted on open darknet forums and specialized leak channels.

- Official Humiliation: Your regulatory authorities (including GDPR inspectors) and EVERY individual whose data was in your files will receive a detailed, personalized breach notification with examples of the stolen data pertaining specifically to them. Fines will be the least of your problems. Trust will be destroyed forever.

- Your competitors will gain access to your data. We guarantee this.

- If you are a private individual:

- Complete Public Humiliation: Your most intimate photos and videos, passport details, bank statements, medical documents will be compiled into a dedicated folder under your name and distributed.

Can I still use my nas?

- Do not delete any files you find on your NAS.
- Do not try to recover your data using any software as it will result in permanent data loss.
- Do not modify any volumes or storage pools on your NAS.
- Do not write large amounts of data to your disk.

Where can I buy and send bitcoin?

- You can easily buy and send bitcoin from:

https://www.moonpay.com/buy/btc
https://paxful.com/buy-bitcoin
https://localbitcoins.com/buy_bitcoins
https://www.binance.com/en/buy-Bitcoin

You can think of this as a failed security audit.

We are professionals. This is a one time deal.
We will restore your data immediately after the payment.
We will even send you tips on how to strengthen your network security, to prevent any future attacks.

freefdhk

Quickconnect 既用途就係讓hacker 在你無portforward 下都成功 hack你部nas.  
你仲要限制唔到連線IP地區 , 如果佢無將可疑信號阻斷 , 你就會中晒招。

jwong2k04

首先要知道/估計hacker係點攪部NAS
係DSM唔update有漏洞俾佢入到位？
還是有內鬼做咗中轉站？

到最後咪洗機重裝DSM
做返NAS安防設定
restore from bsckup
完～

via HKEPC IR 5.1.14 - iOS(5.1.1F)

MSI_R9_280_Gami

# rm -rf *

全del開始人生新一頁

你冇做data security，即係你都覺得自己數據唔值錢，咁全刪

ToNg.

慘，
自行解開加密檔案的機會極低（接近 0%）

目前你可以做的事:

1.檢查 Btrfs 快照 Snapshot (如果你有開)
2.聯絡 Synology 官方 Support
3.報警備案(被人勒索)
4.比錢 (強烈不建議除非真的好重要)
5.備份加密硬碟，等候日後解密
(日後國際刑警破獲該勒索集團伺服器並公開 Master Key or
等他日科技進步可以重建天日)

zex

平時要避免風險!

HK人咁鬼忙, 有冇需要隨時隨地ACCESS家中幾T / 幾十T DATA?

瞓覺時有冇需要長放NAS出街?

godofcomputer

可能delete哂你啲嘢，再放個readme 落去。

無理由搞加密，你又睇唔到啲file同partition.

godofcomputer

回覆 6# ToNg.


    KK園咪仲係度仲長做長有，日日有炸騙電話打嚟，什麼國際盈警根本係個笑話

godofcomputer

首先要知道/估計hacker係點攪部NAS
係DSM唔update有漏洞俾佢入到位？
還是有內鬼做咗中轉站？

到最後咪洗 ...
jwong2k04 發表於 2026-9-2 23:44

    好可能成為疆屍網其中一部機，最好賣咗佢換個部，免得又畀人hack過