Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Sign In Register

Quick Links


Shells Virtual Desktop
BMail.ag - Secure Email Service
Server.net
CPLicense.net
VPS Server
Buy VPN
Vultr
VMs for AI
HostDare
ReliableSite White-Label Dedicated Hosting for Resellers
InterServer VPS
BMail.ag - Secure Email Service
Best VPN
High-Performance Bare Metal Server Solutions
Karvl.com
Server Mania Cloud Hosting
DataWagon Hosting
AlphaVPS Hosting
Evoxt.com
Clouvider
VPS Hosting with NVMe
Residential IPs in the US & 4G Mobile Proxies in EU & US with Unlimited Bandwidth
ReliableSite White-Label Dedicated Hosting for Resellers
Rabisu - Hosting Solutions
Shells Virtual Desktop

Categories

In this Discussion

Home › Providers › Outages
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

Junglesec Ransomware - 9 Linux VMs are affected (Backup your data) - Ryzen 7000

13»

Comments

  • ShakibShakib Member, Patron Provider

    @zGato said:

    @shajeeafzal said:
    @Shakib

    I have a node on Ryzen 7000 but I don't think I am affected. Still able to login to KASM. Are there multiple Ryzen 7000 nodes?

    True. May we know the VPS node name(s) that are affected so we can check in the panel on which one we are?
    Haven't received any ticket and VM seems fine.

    ceres, jupiter, saturn, neptune, eris, mercury

    neptune was affected.

  • shajeeafzalshajeeafzal Member
    edited November 2024

    I am on Ceres....phew....

    or is the "one more node", Ceres :o

    Thanked by 1Shakib
  • icelandmanicelandman Member

    @JabJab said: Pay.. who? Because if junglesec iirc it's dead and no one gives a fuck and/or give you keys

    Junglesec replied to my email :D

    Thanked by 1Shakib
  • NeoonNeoon Community Contributor, Veteran
    edited November 2024

    @Shakib said:

    @shajeeafzal said:
    @Shakib

    I have a node on Ryzen 7000 but I don't think I am affected. Still able to login to KASM. Are there multiple Ryzen 7000 nodes?

    Only Neptune node with 9 Linux VM was affected so far.

    I suspect one more IPMI could be compromised. Just monitoring it for now.

    Why don't you disconnect the IPMI?!
    So you risk it that this machine also gets compromised?!

    Thanked by 1Shakib
  • PsyHostPsyHost Member

    @HackedServer said:
    Unfortunately after the filesystem mounted I see the same junglesec files all over, so its toast.

    Name checks out.

    Sorry, had to.

    Thanked by 4Peppery9 Shakib t0m HackedServer
  • ShakibShakib Member, Patron Provider
    edited November 2024

    @Neoon said:

    @Shakib said:

    @shajeeafzal said:
    @Shakib

    I have a node on Ryzen 7000 but I don't think I am affected. Still able to login to KASM. Are there multiple Ryzen 7000 nodes?

    Only Neptune node with 9 Linux VM was affected so far.

    I suspect one more IPMI could be compromised. Just monitoring it for now.

    Why don't you disconnect the IPMI?!
    So you risk it that this machine also gets compromised?!

    We have already pulled all other IPMI Ethernet cables. Only neptune IPMI is online as we will reinstall this soon.

    We have managed to decrypt one client's VM data. The VPS is unusable after decrypting but www and mysql is intact. So that's something.

    Edit: It can boot now but most of the apps aren't running as expected. Probably can be fixed but we will just take data and rebuild.

  • xvpsxvps Member

    @Shakib said:
    ────────────────────────────────────────────────────────────────

    mmm m m mm m mmm m mmmmmm mmmm mmmmmm mmm
    # # # #"m # m" " # # #" " # m" "
    # # # # #m # # mm # #mmmmm "#mmm #mmmmm #
    # # # # # # # # # # "# # #
    "mmm" "mmmm" # ## "mmm" #mmmmm #mmmmm "mmm#" #mmmmm "mmm"

                [email protected]

    ─────────────────────────────────────────────────────────────────

    /* WARNING */ :

    If you do not want to lose the single data, do not attempt to reboot, shutdown or hot kill any working process :

    Doing so could result to a break and make not possible the recovery of one or multiples files.

    /* WARNING */

    I) What happen to my data ?

    Your data are encrypted. If you try to bruteforce, change the path, the name or do anything that can alterate a single byte of a file(s) will most likely corrupt
    it and made the recovery process not possible anymore, meaning your file(s) will be lost for good.

    II) How can I retrieve them ?

    • To known the process, you must first send 0.037 bitcoin to the following address : 12SGy4N4f18KA9oSMSMgSSkPwWu8Fj3Wvq

    • Once the payment made, send your email address to [email protected], do not forget to mention the IP of server/computer

    III) Will you send the process recovery once payment is made ?

    • We have zero interest to not send you the recovery process if payment is made.

    • We can if requested, decrypt one file to prove that the recovery process is working. The file must not exceed 5MB

    • Once the payment is made, you should receive the recovery process to decrypt your data in less 24 hours,

    IV) Will you leak any data on internet ?

    • If payment is made, your data will not be leaked, as this never happened. Otherwise your data(s) could be leak, sell or exploited.

    V) Can you tell us how this hack happened ?

    • In case you are in the dark on how this security problem did happen, you may ask for details, we will provide you the step by step what we did.
      No supplementary bitcoin is required (this is only available if you have paid the ransom).

    VI) What can I expect afterwards ?

    • If you have been ransom and payment was made, you won't get another pwn by us. All the communication between us and all data regarding this security breach will be removed, as this never happened

    VII) Where can I contact you ?

    At [email protected]

    Alternatively at [email protected]

    By Jungle_Sec

    0.037 bitcoin = 25,000 Chinese Yuan.

  • ShakibShakib Member, Patron Provider

    And the attacker told me that he will not attack HostCram servers anymore. :*

  • NeoonNeoon Community Contributor, Veteran

    @Shakib said:

    @Neoon said:

    @Shakib said:

    @shajeeafzal said:
    @Shakib

    I have a node on Ryzen 7000 but I don't think I am affected. Still able to login to KASM. Are there multiple Ryzen 7000 nodes?

    Only Neptune node with 9 Linux VM was affected so far.

    I suspect one more IPMI could be compromised. Just monitoring it for now.

    Why don't you disconnect the IPMI?!
    So you risk it that this machine also gets compromised?!

    We have already pulled all other IPMI Ethernet cables. Only neptune IPMI is online as we will reinstall this soon.

    We have managed to decrypt one client's VM data. The VPS is unusable after decrypting but www and mysql is intact. So that's something.

    Edit: It can boot now but most of the apps aren't running as expected. Probably can be fixed but we will just take data and rebuild.

    Okay, I take back what I said then before.
    I thought by you words, your IPMI would be still at risk and connected.

    Thanked by 1Shakib
  • ailiceailice Member

    @Shakib said:
    And the attacker told me that he will not attack HostCram servers anymore. :*

    The first "bulletproof" junglesec ransomware provider :o

    Thanked by 3Shakib SLMob Warkos
  • MumblyMumbly Member

    As if they know what belongs to whom unless they get IP subnets from the host to whitelist them.

    Thanked by 1Shakib
  • ShakibShakib Member, Patron Provider

    @Mumbly said:
    As if they know what belongs to whom unless they get IP subnets from the host to whitelist them.

    That's right. Already checked our subnet against his logs.

  • suyadi92suyadi92 Member

    @Shakib said:
    And the attacker told me that he will not attack HostCram servers anymore. :*

    What about the other group? I mean are they the only one doing this?

    Thanked by 1Shakib
  • jaimedelanojaimedelano Member

    One of my servers at TempestHosting, which doesn't have public access to IPMI, has been hacked, so I'm not sure if the issue is really an IPMI flaw that's being exploited.

    Thanked by 1Shakib
  • MumblyMumbly Member

    @jaimedelano said: I'm not sure if the issue is really an IPMI flaw that's being exploited.

    It is not. In your case. Obviously.

    Thanked by 1Shakib
  • ShakibShakib Member, Patron Provider

    We have assigned everyone affected a new VPS with 6 months free service as compensation.

    Also helping with restoring their data on their new VPS.

    Thanked by 5plumberg zGato FrankCastle HackedServer PsyHost
  • adiegowebadiegoweb Member

    Hello, im in one of the unnafected nodes, but I cant access my server, and its not showing on the panel.

    Thanked by 1Shakib
  • ShakibShakib Member, Patron Provider

    @adiegoweb said:
    Hello, im in one of the unnafected nodes, but I cant access my server, and its not showing on the panel.

    Is that ceres? We did a complete sweep, added some new codes and secured it properly.

    Reboots are necessary. Should be up in a few minutes.

  • adiegowebadiegoweb Member

    Now is all working.

    Thanks Shakib, sorry this happened to you, I think you have been the best provider, the few times I needed support is always on point.

    Thanked by 2Shakib dev_vps
  • ShakibShakib Member, Patron Provider

    @adiegoweb said:

    Now is all working.

    Thanks Shakib, sorry this happened to you, I think you have been the best provider, the few times I needed support is always on point.

    <3 <3 <3

Sign In or Register to comment.