# Nextcry? Encrypted all files through my instance **URL:** \ **Category:** ℹ️ Support\ **Created:** [November 14, 2019, 7:18pm UTC](https://help.nextcloud.com/t/nextcry-encrypted-all-files-through-my-instance/64154 "2019-11-14T19:18:40Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![ialexpw](https://help.nextcloud.com/letter_avatar/ialexpw/32/5_5575768a8748004e209b776fc1b2916d.png) [@ialexpw](https://help.nextcloud.com/u/ialexpw)\ **Post date:** [November 14, 2019, 7:18pm UTC](https://help.nextcloud.com/t/nextcry-encrypted-all-files-through-my-instance/64154/1 "2019-11-14T19:18:40Z")
Just a warning. It seems there’s a vuln somewhere as my instance of NextCloud got taken over today. My server was locked down already, using SSH keys and NextCloud was up to date. Something has gone through and encrypted everything and asking for crypto to unlock. Luckily I have everything backed up, so not a huge deal, but just a warning. The message on the homepage changes to; “YOU HAVE BEEN HACKED YOUR FILES HAVE BEEN ENCRYPTED USING A STRONG AES-256 ALGORITHM - SEND 0.025 BTC TO THE FOLLOWING WALLET _wallet address_ AND AFTER PAY CONTACT _their email_ TO RECOVER THE KEY NECESSARY TO DECRYPT YOUR FILES” It seems I’m not the only one too; > **[Help needed decrypting .NEXTCRY - Ransomware Help & Tech Support](https://www.bleepingcomputer.com/forums/t/707580/help-needed-decrypting-nextcry/)** > > Help needed decrypting .NEXTCRY - posted in Ransomware Help & Tech Support: Hi, > My linuxserver with nextcloud has been hacked and almost all my personal files are decrypted now (nextcloud started syncing the encrypted files). > I know its not smart... Be aware as it seems new. ---
**Author:** ![kesselb](https://help.nextcloud.com/user_avatar/help.nextcloud.com/kesselb/32/74519_2.png) [@kesselb](https://help.nextcloud.com/u/kesselb)\ **Post date:** [November 14, 2019, 7:28pm UTC](https://help.nextcloud.com/t/nextcry-encrypted-all-files-through-my-instance/64154/2 "2019-11-14T19:28:54Z")
~~Please write a email to [security@nextcloud.com](mailto:security@nextcloud.com)~~ cc @rullzer @nickvergessen ---
**Author:** ![ialexpw](https://help.nextcloud.com/letter_avatar/ialexpw/32/5_5575768a8748004e209b776fc1b2916d.png) [@ialexpw](https://help.nextcloud.com/u/ialexpw)\ **Post date:** [November 14, 2019, 7:30pm UTC](https://help.nextcloud.com/t/nextcry-encrypted-all-files-through-my-instance/64154/3 "2019-11-14T19:30:55Z")
I have just done this, and included a link to here also. Cheers for the tip. edit: Seems that inbox isn’t monitored and they want me to sign up to an external website to submit a report. An email would be a lot easier for this. ---
**Author:** ![kesselb](https://help.nextcloud.com/user_avatar/help.nextcloud.com/kesselb/32/74519_2.png) [@kesselb](https://help.nextcloud.com/u/kesselb)\ **Post date:** [November 14, 2019, 7:33pm UTC](https://help.nextcloud.com/t/nextcry-encrypted-all-files-through-my-instance/64154/4 "2019-11-14T19:33:07Z")
Probably a list of installed apps could be helpful. ---
**Author:** ![ialexpw](https://help.nextcloud.com/letter_avatar/ialexpw/32/5_5575768a8748004e209b776fc1b2916d.png) [@ialexpw](https://help.nextcloud.com/u/ialexpw)\ **Post date:** [November 14, 2019, 7:33pm UTC](https://help.nextcloud.com/t/nextcry-encrypted-all-files-through-my-instance/64154/5 "2019-11-14T19:33:59Z")
Mostly standard, but see below; ![image](https://help.nextcloud.com/uploads/default/original/3X/6/6/66621e288f951ac762f760080cc0bd97932bf50f.png) ---
**Author:** ![kesselb](https://help.nextcloud.com/user_avatar/help.nextcloud.com/kesselb/32/74519_2.png) [@kesselb](https://help.nextcloud.com/u/kesselb)\ **Post date:** [November 14, 2019, 7:35pm UTC](https://help.nextcloud.com/t/nextcry-encrypted-all-files-through-my-instance/64154/6 "2019-11-14T19:35:50Z")
> Seems that inbox isn’t monitored and they want me to sign up to an external website to submit a report. An email would be a lot easier for this. Oh. I didn’t know that. I would try [Nextcloud - Contact us now](https://nextcloud.com/contact/). ---
**Author:** ![ialexpw](https://help.nextcloud.com/letter_avatar/ialexpw/32/5_5575768a8748004e209b776fc1b2916d.png) [@ialexpw](https://help.nextcloud.com/u/ialexpw)\ **Post date:** [November 14, 2019, 7:36pm UTC](https://help.nextcloud.com/t/nextcry-encrypted-all-files-through-my-instance/64154/7 "2019-11-14T19:36:24Z")
Will try that also, cheers. ---
**Author:** ![alfred](https://help.nextcloud.com/letter_avatar/alfred/32/5_5575768a8748004e209b776fc1b2916d.png) [@alfred](https://help.nextcloud.com/u/alfred)\ **Post date:** [November 14, 2019, 9:32pm UTC](https://help.nextcloud.com/t/nextcry-encrypted-all-files-through-my-instance/64154/8 "2019-11-14T21:32:54Z")
How did they manage to get into your server? ---
**Author:** ![ialexpw](https://help.nextcloud.com/letter_avatar/ialexpw/32/5_5575768a8748004e209b776fc1b2916d.png) [@ialexpw](https://help.nextcloud.com/u/ialexpw)\ **Post date:** [November 14, 2019, 9:47pm UTC](https://help.nextcloud.com/t/nextcry-encrypted-all-files-through-my-instance/64154/9 "2019-11-14T21:47:41Z")
Through NextCloud I presume… no other files were touched and my account via SSH wasn’t logged into as far as I can see (still checking). It seems it’s happened a couple of times the last week or so. ---
**Author:** ![kesselb](https://help.nextcloud.com/user_avatar/help.nextcloud.com/kesselb/32/74519_2.png) [@kesselb](https://help.nextcloud.com/u/kesselb)\ **Post date:** [November 14, 2019, 10:17pm UTC](https://help.nextcloud.com/t/nextcry-encrypted-all-files-through-my-instance/64154/10 "2019-11-14T22:17:27Z")
Are you using Nginx with PHP-FPM perhaps? [Urgent security issue in NGINX/php-fpm](https://help.nextcloud.com/t/urgent-security-issue-in-nginx-php-fpm/62665) ---
**Author:** ![nickvergessen](https://help.nextcloud.com/user_avatar/help.nextcloud.com/nickvergessen/32/66965_2.png) [@nickvergessen](https://help.nextcloud.com/u/nickvergessen)\ **Post date:** [November 15, 2019, 12:05am UTC](https://help.nextcloud.com/t/nextcry-encrypted-all-files-through-my-instance/64154/11 "2019-11-15T00:05:49Z")
Well sorry to hear, but I don’t think that this happened through Nextcloud. Reading up on Nextcry, it seems to be a ransomware mostly affecting windows systems. So it reached your server when someone logged into it via a windows computer that was affected. ---
**Author:** ![nickvergessen](https://help.nextcloud.com/user_avatar/help.nextcloud.com/nickvergessen/32/66965_2.png) [@nickvergessen](https://help.nextcloud.com/u/nickvergessen)\ **Post date:** [November 15, 2019, 12:07am UTC](https://help.nextcloud.com/t/nextcry-encrypted-all-files-through-my-instance/64154/12 "2019-11-15T00:07:14Z")
No, the contact form is not the correct place. As per the autoreply: > You have sent an email to [security@nextcloud.com](mailto:security@nextcloud.com). This mailbox is not being monitored and mails are being dropped. > If you have discovered a security issue, please get into contact with us at [https://hackerone.com/nextcloud](https://hackerone.com/nextcloud). > To learn more about our security policies and processes, please visit [Security in Nextcloud](https://nextcloud.com/security/). > > Kind regards Nextcloud Security Team ---
**Author:** ![ialexpw](https://help.nextcloud.com/letter_avatar/ialexpw/32/5_5575768a8748004e209b776fc1b2916d.png) [@ialexpw](https://help.nextcloud.com/u/ialexpw)\ **Post date:** [November 15, 2019, 12:20am UTC](https://help.nextcloud.com/t/nextcry-encrypted-all-files-through-my-instance/64154/13 "2019-11-15T00:20:23Z")
I’ll check into this, but I’ll have to boot the server back up, pretty sure I patched this when I heard about it, but it’s worth a check - thanks 🙂 ---
**Author:** ![ialexpw](https://help.nextcloud.com/letter_avatar/ialexpw/32/5_5575768a8748004e209b776fc1b2916d.png) [@ialexpw](https://help.nextcloud.com/u/ialexpw)\ **Post date:** [November 15, 2019, 12:22am UTC](https://help.nextcloud.com/t/nextcry-encrypted-all-files-through-my-instance/64154/14 "2019-11-15T00:22:35Z")
Apologies, but this is not caused from a Windows PC. I have not had one connected to it (only at the beginning a while back, at least 5-6 months, to seed the files). From reading into the other thread it seems to be based on a Python script, meaning that it couldn’t have gone through my Windows PC back then also. You could be thinking of Wannacry? Which was well known to spread through Windows systems. ---
**Author:** ![Paradox55](https://help.nextcloud.com/user_avatar/help.nextcloud.com/paradox55/32/18391_2.png) [@Paradox55](https://help.nextcloud.com/u/Paradox55)\ **Post date:** [November 15, 2019, 3:20am UTC](https://help.nextcloud.com/t/nextcry-encrypted-all-files-through-my-instance/64154/15 "2019-11-15T03:20:05Z")
And you know this is a nextcloud issue how? Do you have logs that show it was through nextcloud? ---
**Author:** ![rullzer](https://help.nextcloud.com/user_avatar/help.nextcloud.com/rullzer/32/840_2.png) [@rullzer](https://help.nextcloud.com/u/rullzer)\ **Post date:** [November 15, 2019, 6:11pm UTC](https://help.nextcloud.com/t/nextcry-encrypted-all-files-through-my-instance/64154/16 "2019-11-15T18:11:19Z")
So. First of all. This kind of stuff is exactly why you have a backup. Good for you. We have not heard of this before. However, we are unaware of any exploits in Nextcloud to have remote code execution. So if you could go trough your access logs to find out what was going on please do. Someting that comes to mind. Are you by any chance running NGINX with our outdated config and an outdate php-fpm? ---
**Author:** ![anon9582441](https://help.nextcloud.com/letter_avatar/anon9582441/32/5_5575768a8748004e209b776fc1b2916d.png) [@anon9582441](https://help.nextcloud.com/u/anon9582441)\ **Post date:** [November 15, 2019, 6:19pm UTC](https://help.nextcloud.com/t/nextcry-encrypted-all-files-through-my-instance/64154/17 "2019-11-15T18:19:52Z")
Would be very interesting to know how it got in… ---
**Author:** ![rullzer](https://help.nextcloud.com/user_avatar/help.nextcloud.com/rullzer/32/840_2.png) [@rullzer](https://help.nextcloud.com/u/rullzer)\ **Post date:** [November 15, 2019, 6:30pm UTC](https://help.nextcloud.com/t/nextcry-encrypted-all-files-through-my-instance/64154/18 "2019-11-15T18:30:09Z")
To add to this. Can you send me (in private) your - access logs - nextcloud version - php version - webserver and version Then we can dive into it more. ---
**Author:** ![ialexpw](https://help.nextcloud.com/letter_avatar/ialexpw/32/5_5575768a8748004e209b776fc1b2916d.png) [@ialexpw](https://help.nextcloud.com/u/ialexpw)\ **Post date:** [November 15, 2019, 10:21pm UTC](https://help.nextcloud.com/t/nextcry-encrypted-all-files-through-my-instance/64154/19 "2019-11-15T22:21:51Z")
I’ll grab this for you this weekend, as I’m away from home currently until tomorrow. Just for info, this has now been posted below with more info also; > **[New NextCry Ransomware Encrypts Data on NextCloud Linux Servers](https://www.bleepingcomputer.com/news/security/new-nextcry-ransomware-encrypts-data-on-nextcloud-linux-servers/)** > > A new ransomware has been found in the wild that is currently undetected by antivirus engines on public scanning platforms. Its name is NextCry due to the extension appended to encrypted files and that it targets clients of the... It’s possible that @kesselb is correct - will confirm versions once I’m back. ---
**Author:** ![KarlF12](https://help.nextcloud.com/user_avatar/help.nextcloud.com/karlf12/32/46873_2.png) [@KarlF12](https://help.nextcloud.com/u/KarlF12)\ **Post date:** [November 16, 2019, 4:05am UTC](https://help.nextcloud.com/t/nextcry-encrypted-all-files-through-my-instance/64154/20 "2019-11-16T04:05:57Z")
That article on Bleeping Computer sounds as though the ransomware targets client computers running the sync client, rather than the server itself. However having the server “locked via SSH” (meaning server OS user passwords changed?) would suggest otherwise. Is the nginx vulnerability being involved just speculative at this point, or does that seem like a likely culprit? In the interest of attack surface reduction, I’ll share a couple other things I’ve done to harden my system. I run a dummy site that’s returned if the wrong/no SNI is used so random scans are less likely to ever reveal the Nextcloud instance. I also block all connections to it from non-ARIN addresses. That in particular drastically reduced the amount of random access I get. Also, it probably goes without saying, but there is no outside SSH access Or any other sort of remote control to the system. If you must have remote console access, strictly use a VPN. If the infiltration point really is on the server, those measures will go a long way to help reduce potential exposure. [Next page](https://help.nextcloud.com/t/nextcry-encrypted-all-files-through-my-instance/64154.md?page=2)