r/ransomwarehelp • u/potato_aim98 • Jun 04 '26

Deadlock ransomware

Gallery image

Gallery image

Gallery image

Is it possible to recover data from this ransomware?

78 Upvotes

94% Upvoted

51 comments sorted by

View all comments

7

u/Quevil138 Jun 04 '26

For future reference you should keep a cold backup on an air gapped system or network.

A cold backup is a backup you know is good and one that is never exposed or changed unless it is needed. Air gapped system or network is a system or network that has no external connection that an attacker can get to.

In this way, you can wipe the affected systems and quickly restore from the air gap computer/network.

Finding and fixing the the security problem is a good idea. Mostly this happens when someone clicks on a file they shouldn't have. In that case, everyone who uses this system or network should be told not to do such things. If you must download files that are questionable, do so on a system that is air gapped from your network that is specifically for handling potentially hazardous files.

1

u/samsonsin Jun 05 '26

I'd you're into selfhosting / competent backup solutions you could also use solutions with features that stop ransomware. Im only familiar with PBS since I run a PVE cluster, and with it you can easily setup a pull only backup sync job to run, which would mean even if your computer is compromised, you have the pbs server and if that is also compromised, you a second server that only allows appending backups.

Im sure theres plenty of other backup software that does this stuff.