Hey everyone! I recently fell victim to WannaCry ransomware, which has encrypted all the files on my external SSD. The attackers left a ransom note demanding $1800 for the decryption. They instructed me to install qTOX Messenger, find them using a specific Tox ID, and provide three test files to show they can recover my data before they ask for payment. I'm running Debian, and I've noticed abnormal data uploads to suspicious IP addresses, which is concerning for data leaks. Has anyone dealt with this ransomware before? I'm looking for any tips on file recovery or decryption tools, and should I even consider sending the test files? Any advice would be much appreciated! Thanks!
3 Answers
Before doing anything drastic, check if you have any backups that you can restore from. If you don’t, sending test files to the attackers is a huge risk because they could just take your data and still not decrypt it. It's super risky to negotiate with them.
It looks like you're in a tough spot. Given that WannaCry is notorious and has no known public decryptor, you might want to focus on securing your system and preventing further malware infections. It's definitely concerning that your device is sending data to suspicious addresses—best to format the SSD and reload your system from a backup.
I strongly suggest you skip paying the ransom. There are often no guarantees you'll get your files back, and you might just end up giving them more information. Best course of action is to restore from your backups if you have them! If not, consider reformatting the SSD to prevent any further data leakage.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures