Forum

Hoje dia 31 um servidor proxmox de um cliente acabou sofrente um ataque, ele tava com a porta 8006 aberta para uma empresa fazer uma modificação no mk-auth dele, isso ele passou 1 meses mais ou menos com o servidor aberto, quando foi agora o servidor sofreu um ataque onde todos os dados deles foram pego e depois apagado, au recupera o acesso fisicamente achei varios arquivos um deles provando que foi ataque e pedindo dinheiro pra não divulgar os dados, e se não pagasse em 7 dias ia libera os dados pra todo mundo, parte do arquivo pra quem quiser ler, o dono desse proxmox acabou optando por formata e restura o banco de dados do mk-auth que tinha salvo no mega, mas pra quem tem proxmox aberto e bom ter cuidado.

" 

=============================================================
!!! YOUR NETWORK HAS BEEN COMPROMISED !!!
=============================================================

Hi there,

If you are reading this, your company's internal computer
system is down. All your backups — digital and physical —
that we found have been deleted. We also stole a large
amount of your company data before we locked your files.

Let's talk calmly. We know we have caused serious problems
for you. Here is what you need to know:

Self-assess your company size (you tell us, we verify
against the data we stole):

Tier 1 — Personal (solo, single individual):
starting quote: $2,000

Tier 2 — SOHO (1-10 staff, small office / home office):
starting quote: $5,000

Tier 3 — Small business (11-50 staff):
starting quote: $15,000

Tier 4 — Mid-market (51-500 staff):
starting quote: $30,000

Tier 5 — Enterprise (500+ staff):
starting quote: $60,000

Reply with your tier and we will provide a final quote
based on your cyber insurance coverage and the data
volume we have on you.

If you under-report your company size, we will verify
against the stolen data (employee records, internal email
domains, financial documents). Lying will void any
discount we offered.

If we do not hear back in 72 hours, the price increases
50%.

After payment is confirmed, the recovery process is:
- Decryption tool delivery: within 24-48 hours
- Full system recovery: 24-72 hours depending on your
infrastructure size
- Data deletion proof (recorded video): within 48 hours
- Security report: within 7 days "