All files in Azure volume corrupted, with .00000001 appended to the end of the filename

Question

Two days ago, a network storage disk appeared to be infected in an unusual fashion.

All of the files (thousands) on our backup volume in Azure have been corrupted, with ".00000001" appended to the end of the file;

e.g. Monday.log has become Monday.log.00000001

They are all corrupt, even text files have become illegible, even though they seem to have retained exactly the same file size.

Has anyone ever encountered this kind of thing? Is there any way to decrypt the files?

EDIT This seems to be the El Dorado ransomware virus. Any advice welcome

Sadly, I can only recommend to restore from a backup, and most of all, find the problem before restoring to not re-do the job .. — yagmoth555, Commented Aug 12 at 13:21
This seems to be the El Dorado ransomware virus. Any advice welcome - Contact your cyber insurance carrier, get them involved, and ask them how to proceed. — joeqwerty, Commented Aug 12 at 14:06
Azure and other cloud providers generally don't know about filesystems on block devices - that's what the OS on your virtual instance sees. I'd suggest removing the azure tag because its not relevant to your problem — Criggie, Commented Aug 12 at 21:57
@Criggie It can be relevant somehow, as sadly not sure if the data was backed up.. as It bring the discussion that a lot of MS customers don’t think to save the cloud data, so he could have to call Microsoft to restore — yagmoth555, Commented Aug 13 at 2:34

Athen-SysAdmin · Accepted Answer · 2024-08-12 14:23:26Z

1

Not sure about this specific flavour of ransomware but worth a check

Good luck!

answered Aug 12 at 14:23

Athen-SysAdmin

112 bronze badges

Add a comment |

1 Answer 1