Sign in to follow this  
Davidmac

Amnesia Ransomware problem

Recommended Posts

Hello guys,

Our servers have been hit with ransomware and we are in desperate need of help. Id ransomware told us it was Amnesia. All the files are .amnesia  We tried to the amnesia decrypter but it won't work for us. We paid to have our files returned but the decoder key decrypted a lot but it did not decrypt some of our .dll files and exchange files. We desperately need though files. Can anyone help?

 

Share this post


Link to post
Share on other sites

If their decrypter worked on most of the files, but not all of them, then it's entirely possible that the files that couldn't be decrypted had been corrupted during the encryption process.

Sadly ransomware is not always bug-free, and there are plenty of cases where files are not recoverable even after paying the ransom simply due to mistakes that the criminals made when they created the ransomware. Amnesia for instance has been known in the past to corrupt large files.

 

Since Amnesia is spread by an attacker who brute forces the RDP account for an Administrator, then here are some basic recommendations for helping to ensure that this doesn't happen again.

First I recommend temporarily disabling all port rules in your firewall (closing all open ports) until you can do a full audit of your firewall configuration and determine which ports need to remain open. There are some basic recommendations below to help get you started with the port audit.

If you are managing a company network, then some form of IPS/IDS is highly recommended to monitor the network for intrusions. If you already have such a system in place, then I recommend a full audit of any rules you have configured to make sure that the device is providing adequate monitoring. It is also recommended to have someone with penetration testing experience verify that the IPS/IDS is properly alerting when there are intrusion attempts.

Also, quickly change all passwords on any workstations and/or servers that are connected to the same network as the compromised system. Also be sure to change passwords on any online accounts, as well as any routers or switches (or other devices that have network-accessible administration functions).

I recommend that every account have a different password, that passwords be no shorter than 25 characters and be made up of a random combination of uppercase letters, lowercase letters, numbers, and symbols. Obviously passwords like that are difficult (if not impossible) to remember, so a password manager may be required in order to aid in managing passwords. KeePass is probably the simplest password manager, and stores password databases locally instead of on some "cloud" server. If something capable of automatically filling in passwords (or sharing passwords between multiple devices/users) is necessary then there are reasonable passwords managers from LastPass, bitwarden, 1Password, Dashlane, etc. Note that unlike KeePass, these password managers work as extensions added to web browsers (or apps on mobile phones), and they store password databases online.

When auditing your firewall configuration and preparing to reopen ports, I recommend never opening ports globally unless absolutely necessary. I also recommend requiring anyone who needs access to sensitive services (RDP, Windows Networking, etc) to connect to the network via a VPN so that you don't have to open ports for those services in the firewall, and then only open the VPN port in the firewall for IP addresses that need access to it. If someone who needs access has a dynamic IP, then many firewalls these days support something like Single Packet Authorization or Port Knocking to dynamically open ports for unknown IP addresses.

Share this post


Link to post
Share on other sites

The decrypters supplied by the criminals to those who paid the ransom will only work on a single computer, due to the fact that different public/private keys are generated for each infected computer. Even if he were to share the decryption tool he was sent, no one else would be able to use it to recover their files.

Share this post


Link to post
Share on other sites

That's understandable.

For now the best course of action is to keep backups of the encrypted files and wait to see if security researchers or law enforcement manage to gain access to the criminal's servers and release the database of private keys so that someone can make a free decryption tool.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

Sign in to follow this  

  • Recently Browsing   0 members

    No registered users viewing this page.