关于腾讯云主机遭遇勒索病毒RANSOMWARE（aariz@airmail.cc）的解决办法

最新推荐文章于 2024-02-26 23:21:04 发布

Jia_Li_z

最新推荐文章于 2024-02-26 23:21:04 发布

阅读量5.9k

点赞数

分类专栏：主机安全文章标签：主机安全

本文链接：https://blog.youkuaiyun.com/rochenhack/article/details/85125232

版权

本文介绍了作者如何应对腾讯云主机遭受勒索病毒RANSOMWARE（aariz@airmail.cc）的攻击。内容提到攻击者通过暴露在外网的redis服务获取权限，但并未实际储存文件。解决方案包括检查并加固redis服务的安全配置，防止此类入侵。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

今天上班的时候，腾讯云突然发来一份邮件说我的那台学生机在异地登陆了，我赶紧去连接xshell看了下。

结果就是下面的信息

Hi, please view here: https://pastebin.com/raw/eFDC9giY for information on how to obtain your files!

网址内容如下：

YOU HAVE BEEN INFECTED WITH RANSOMWARE | YOU HAVE BEEN INFECTED WITH RANSOMWARE
You have been hacked.
When you were hacked, your files were sent to a server that we control and removed from you.
You must pay 0.25 BITCOIN to get your files back and prevent them from being leaked to this address:
14z9Rbpw5SozMuMRRrdwcKaSs4PsxiEHRE
We are the only ones in the world that can provide your files for you!
When you have sent payment, send e-mail to aariz@airmail.cc with: 
2) SERVER IP ADDRESS 
3) BTC TRANSACTION ID
FBI SUGGEST TO JUST PAY: https://www.tripwire.com/state-of-security/latest-security-news/ransomware-victims-should-just-pay-the-ransom-says-the-fbi/
When you pay, you will receive an FTP account where you