[jdcollins]

Somehow, I'm still trying to figure out how, some a*% h#!% got into my PC and Ransomware(d) me today while I was at work. Every picture, music recording, video recording, as well as access to most of my apps have been encrypted with a .xls format. I can no longer get into Discord, TS3, or STO, and others I have yet to discover.

What's even worse (yes it does) is that they managed to get into my Amazon account (I had my bank card linked to it) and made about $700 in digital and gift card purchases before I could cut them off. I was notified about the first 2 purchases by my bank's notifications alert. By the time I could contact my bank and cancel any further purchases, 5 more had gone through. It was when I got home to start working on the bank issue that I discovered what had happened to my PC.

Now have my bank making me a new card, plugged that hole. Changed passwords to my email accounts (did NOT autosave) done. Still trying to figure out what's next. I know they still have access as long as I'm connected to the internet, which leaves me 2 options.
1. Hope I can find some kind of help cutting their access and decrypting everything they got ahold of...
or
2. Do a complete wipe of my drives and reinstall my OS and lose everything (some of which I've had for years, in as far as music videos and pictures).


I'm still so mad I can hardly think straight.
I could use some help.
Anyone with suggestions on what I should do next, with advice or ideas I could try to fix any of this
(sure as hell ain't paying them, average price I found out is @ .02 bitcoin or almost $1,200 USD...and no guarantee on decryption)
would be most appreciated.
Also
If anyone notices my character (@jdciollins) in the game
before I post that I will be in game
notify Fleet Command immediately! So they can contact me.
Thanks for letting me rant.

[Palechimera]

if you have a back up system restore from before your system got infected with a ransomware file restoring your system to that earlier point could possibly remove the infection, If you have no system restore point from before the infection the only thing you can do is a do a full wipe and system reinstall which will get rid of the ransomware, however unfortunately all your files are gone even if you got rid of the ransomware there is little chance of you being able to unlock those files

[jdcollins]

They wiped my system restore clean of restore points and disabled my ability to restore in the windows Advanced Boot Options.
Sooo....ya. If I had been smarter about it I should have created a system image on a disk or USB drive.

[Sunfire]

Basics of cyber security:

1. Use unique passwords for every service/account you have
2. Use strong passwords (at least 10 digits, at least 3 out of 4 characteristics (capital letters, letters, numbers, special characters). Do NOT use personal info in passwords, not of you, your family, spouse, pets or anything that can be traced back to you
3. Use a password manager to store passwords, if you follow 1. and 2. above it can randomly generate passwords for you
4. Use multi-factor authentication (MFA) as much as possible and everywhere you can. Prefer authentication apps over SMS when possible
5. Never EVER give your passwords away. This includes to support staff from services or businesses as well as IT personnel
6. Verify emails you receive are legit by double-.checking the sender address. The REAL sender address, not what your mail program shows at first glance
7. Do NOT click links out of emails
8. If you get emails with links copy the link into your browser and verify the link is "legit" by checking the top-level domain of the URL
9. Do NOT open attachments from emails if you are not 100% certain it's legit and you know and trust the sender. Especially when the file extension is of an Microsoft office file format
10. Do not click on website ads. Even if you see something interesting type the URL into your browser to manually visit a website
11. When you sign up on a website make sure it is a legitimate service and not a fake (double-check URL and do NOT use links out of mails, see above)

This is basically part of what I teach at my company.
Encryption trojans are almost always delivered via email (link or attachment) and usually try and manipulate the user by doing something (like entering their credentials on a fake website or opening an attachment). The public opinion that someone is trying to "guess" your password and hack into your computer is almost never right, it's way too difficult. Why try and hack a service or system when you can just manipulate the user to do it for you?
Always consider cyber security like physical security: you wouldn't give the keys to your house or car away to a stranger or use a key that is easy to replace or fake. Why do so with a password?

An additional advice: create backups of your most important data and keep it OFFLINE. That means not attached to a computer, network, LAN or the cloud. Most encryption trojans are able to encrypt backups stored in a network, NAS or the cloud. So use a external harddrive and keep it unplugged to keep it safe.

[Taku]

I would start here:
• Bleeping Computer Forum for Ransomware
What they're going to ask you to do is to submit examples of your ransom note and a few encrypted files to:

> ID Ransomware <
(You probably want to do this no matter what. Identifying what you're dealing with is the first step in maybe getting your stuff back.)

I wish you luck.

[jdcollins]

Says it is GlobeImposter 2.0 and "This ransomware has no known way of decrypting data at this time."
So...ya. I've tried everything I can think of. Just gonna bite the 'bullet' and wipe my drives and do a clean install and reset my modem to 'factory defaults'.
Probably unnecessary, but better to err on the side of caution.
See you guys soon.

[Chris Wilkinson]

Says it is GlobeImposter 2.0 and "This ransomware has no known way of decrypting data at this time."
So...ya. I've tried everything I can think of. Just gonna bite the 'bullet' and wipe my drives and do a clean install and reset my modem to 'factory defaults'.
Probably unnecessary, but better to err on the side of caution.
See you guys soon.

One thing I'd suggest would be to try and keep regular backups of photos etc. on places like Google Drive. That way, if something like this does hit you in future, it's less of an overall hit.

[Sunfire]

One thing I'd suggest would be to try and keep regular backups of photos etc. on places like Google Drive. That way, if something like this does hit you in future, it's less of an overall hit.

That is not a good idea, at least not as an only backup. Modern ransomware is smart enough to find backups and encrypt them too, especially if it's not a "fire and forget" software but one that can be directed remotely. People are lazy and usually keep their backup accounts logged in permanently so the malware is able to encrypt backups as well. Same goes for backups on a NAS or elsewhere in a local network.

I would suggest to keep at least one backup offline, usually an external harddrive is used for that and it's NOT PLUGGED IN until you need to create another generation of backup. Keep at least two or three generations independently from each other (on multiple drives if need be). Obviously this is all dependant on how much you value your data compared to prices and work you need to invest, I just present how it's done securely. What you do in the end is your choice

[Chris Wilkinson]

That is not a good idea, at least not as an only backup. Modern ransomware is smart enough to find backups and encrypt them too, especially if it's not a "fire and forget" software but one that can be directed remotely. People are lazy and usually keep their backup accounts logged in permanently so the malware is able to encrypt backups as well. Same goes for backups on a NAS or elsewhere in a local network.

I would suggest to keep at least one backup offline, usually an external harddrive is used for that and it's NOT PLUGGED IN until you need to create another generation of backup. Keep at least two or three generations independently from each other (on multiple drives if need be). Obviously this is all dependant on how much you value your data compared to prices and work you need to invest, I just present how it's done securely. What you do in the end is your choice

I didn't mean just keeping a single backup I just used Google Drive as an example as there are quite a few places you could use. The only drawback to physical backups is the actual cost of the initial hardware, whereas places such as Dropbox, Google Drive, Onedrive to name but a few, could be used but not actively logged in, nor the passwords left on the device.

That way, even if ransomware was to take control of the device, it wouldn't be able to access those backups, and if 2FA was being used, they'd be even more secure.

[Jestersmith]

Funny enough JD i got a PM from you on discord other day offering me a free nitro month curious now if it was you or linked to your issues at present been busy and not had chance to reply

[Petrarch]

Look at the link, there's an E on the end of Discord - maybe that's right, but that immediately would make me suspicious of it.

[Chris Wilkinson]

Look at the link, there's an E on the end of Discord - maybe that's right, but that immediately would make me suspicious of it.

We had something similar come up on the UFP discord earlier in the week, I admit I did click it but it looked fishy when I was on the site, made sure to check the SSL certificate and everything. Ran a AV scan as well just in case.

[Jestersmith]

Look at the link, there's an E on the end of Discord - maybe that's right, but that immediately would make me suspicious of it.

Did not even notice that though i have Nitro so never paid to much attention to it when i seen.

[Taku]

Look at the link, there's an E on the end of Discord - maybe that's right, but that immediately would make me suspicious of it.

ICANN says it's a Russian site. Hosted on .ru servers. This is not, in itself, damning. . . But I would be wary.

• Created: 2021-10-28 09:50:13 UTC
• Nameservers:

○ ns2.reg.ru
○ ns1.reg.ru

• Updated: 2021-10-28 15:25:37 UTC
• Name: discorde.gift
• Internationalized Domain Name: discorde.gift
• Registry Domain ID: DO_6ceb62f09926d5fa32dbf7c4b216869b-UR

And as is typical. . .
Registrar Information
• Name: Tucows Domains Inc.

○ Abuse contact email: domainabuse@tucows.com
○ Abuse contact phone: tel:+1.4165350123

• Registrant:

○ Organization: Data Protected
○ Mailing Address: ON, CA

Redacted for privacy:
some of the data in this object has been removed

I'm just surprised it wasn't godaddy.

There IS good news of a sort. The site has been placed on clientHold. That's a good thing:
"This status code tells your domain's registry to not activate your domain in the DNS and as a consequence, it will not resolve. It is an uncommon status that is usually enacted during legal disputes, non-payment, or when your domain is subject to deletion."
"Often, this status indicates an issue with your domain that needs resolution. If so, you should contact your registrar to resolve the issue. If your domain does not have any issues, but you need it to resolve, you must first contact your registrar and request that they remove this status code."

[jdcollins]

Ok, I'm back up (partially). Still got a lot to do but wanted to get on here and see what was up.
Sounds like them ♥♥♥♥♥♥♥s decided to get on my Discord...hopefully resetting my password will keep them out. I just hope I won't have to get a new account or anything. Will resetting password be enough?