I am trying to explain what happened and asking what could be done after being infected
Yesterday a client called and told me something strange happened to his server and most of the file types are change to "CRYPTED!" and the extension of the file was changed to something like "(.xcvo0n)".
Part I (ATENTION,ATENTION)
ATENTION!!! I am truly sorry to inform you that all your important files are crypted. Atention! I do not offer for free the decrypt key's, for that you have to pay x.xx BITCOIN. You can get bitcoin very easy on this site: www.xyz.com You have to create an account and to buy x.xx BITCOIN from a seller located in your city. Then you have to send the amount at this BTC adress: abcadsdfsdfsfsdfsdf After that, contact me at this email adress: email@example.com With this subject: acv23-123123 After the payment you will receive the key's to decrypt your files and a tutorial Here is another list where you can buy bitcoin: https://xcv.com/en/ex
Part II (SAD BU TRUE)
It was easy to guess, he was the victim of "Ransomware".
Part III (WHAT HE DID BUT WAS NOT GOOD ENOUGH)
After a deep looking at his server I find out that:
- There was an AV but that AV had no Anti Ransomware module.
- The server OS was Windows server 2016 and was up to date and patched and the windows Defender was enabled.
- There was some old backup from DB and source-codes.
Part IV (WHAT HE DOES TO DO)
The data is unique and valuable and he had to do something to save his ***.
- Pay the Ransome!
But as Norton mentioned in the first tip in Ransomware – what can you do about it
Do not pay the ransom. It only encourages and funds these attackers. Even if the ransom is paid, there is no guarantee that you will be able to regain access to your files.
- Remove it!
Files are encrypted and the backups are not worth to restore.
I could not find a practical solution to "how to recover ransomware encrypted files".
- Forget everything and start from scratch!
Part V (YOUR OPINION)
- What are incident response and disaster recovery plan for facing ransomware in case we ware not reday and had no plan had no backup from DATA?