Our Blog

Articles, Reviews and Technical Alerts

Cr1ptT0r Ransomware Attacks D-Link NAS (Network-Attached Storage) Devices

Tim Summers
Technology Alert

Members of the BleepingComputer forums began reporting on February 19, 2019 that their D-Link DNS-320 network-attached storage devices were being attacked by the Cr1pT0r Ransomware virus. The attack encrypts the files stored on the NAS device and then demands payment to decrypt the files.

Those hit with the infection will find that the ransomware virus places one or more text files on the storage device named “_FILES_ENCRYPTED_README.txt”. This file instructs the device owner how to purchase the ability to decrypt their files. It is said that the first file can be decrypted for free to prove that the decryption process works.

The most recent firmware for the DNS-320 was 2.05.B10 released on July 18, 2016. BleepingComputer forum users currently believe that this attack is the result of one or more security vulnerabilities in this firmware.

As an I.T. professional, I consider any firmware that is over two years old to be “old” by I.T. standards.  Consequently, I suggest replacing these NAS devices.

EDITED 04/21/2019:  On April 11, 2019 D-Link released a Hot Fix to their firmware version 2.06 which is specifically designed to resolve the security flaw that was exploited by the Cr1pT0r Ransomware virus.  Per D-Link, this patch will NOT recovery encrypted files.  You can download the hot fix by clicking here.


D-Link Downloads For DNS-320

BleepingComputer.com Forum Post

About Tim Summers

Tim Summers is a long-time nerd and the owner of Diversified Computer Solutions, Inc. Tim has built a reputation within the Dayton, Ohio area as an honest and reliable computer consultant who blends sound business principles with quality technical advice and service. Tim spends most of his waking hours in front of a computer and some of his sleeping hours as well. Currently, Tim splits his time between providing I.T. support services, building websites, and trying to train a high energy Dachshund mix named Gizmo.

Virus Infection D-Link Ransomware

Dayton and Miami Valley Better Business Bureau, A+ Rating
Vandalia Ohio Chamber of Commerce Member
DELL Premier Partner, Computer Hardware and Software
Microsoft Partner Logo
Google Workspace Logo
Avast Anti-Virus
Carbonite Registered Partner, Remote Backup
eVault from Carbonite, Remote Backup
Wathguard Firewall Routers and Security Appliances
Sonicwall Firewall Routers and Security Appliances
Business Networking International (BNI), Referral Group