aapanel is hacked

aaP_cybersasu

My aapanel is got hacked. That MF is left a massage and encrypted all of files.

######################################################################################

Encryptions ID : b31253bbf8517385

You have been hacked by PSAUX

All your files have been encrypted.

To restore access, you can contact us in two ways:

1. Telegram: @pxxxxxxxec

2. Session: Download the Session application and contact us with

3. Session ID: xxxxxxxxx.

Payment must be made in cryptocurrency.

The price for decryption is 800 dollars.

If our Telegram account is banned, please use Session to contact us.

After payment, you will receive a key to run the decrypter script

on your system to restore your files.

Download Session: http://xxx.org/download/

Ransomware made by @kernei

######################################################################################

How can I decrypt?

aaPanel_Kern

Hello, I do not recommend you to trust its recovery information.
Did you back up your data before being hacked? Is there any important data?
Where is this information displayed? Displayed using ssh?

aaP_cybersasu

aaPanel_Kern After login to SSH This information is displaying.

Data is important spacially database. I got the daatabase but it encrypted. I have the key and dec too but not working.

aaPanel_Kern

Are there backups?

aaP_cybersasu

aaPanel_Kern No.

aaPanel_Kern

It is recommended that you find a data recovery company to solve the problem? Otherwise, you can only contact the hacker shown in the file.
Or contact cybersecurity personnel in your area

aaP_cybersasu

Any other way to recover mysql file? Atleast open aapanel

aaPanel_Kern

This is because the hacker has encrypted the files in the server and cannot read the files normally, so the program cannot run normally.

aaP_cybersasu

Any way to make the aapanel run?

aaPanel_Kern

aaP_cybersasu
Check whether the files in this directory are normal? If it's not working properly, it won't work.
/www/server/
/www/server/panel

aaP_cybersasu

Directory are normal

aaPanel_Kern

aaP_cybersasu
Manual start

bt start 
bt status

mergehez

my panel was hacked today as well. Should we now consider switching to another Panel?

Encryptions ID : ****

You have been hacked by PSAUX

All your files have been encrypted.

To restore access, you can contact us in two ways:

1. Telegram: @psauxsec

2. Session: Download the Session application and contact us with

3. Session ID: telegram.

Payment must be made in cryptocurrency.

The price for decryption is 400 dollars.

If our Telegram account is banned, please use Session to contact us.

After payment, you will receive a key to run the decrypter script

on your system to restore your files.

All your database is downloaded and if you are not going to pay in next 3 days

its going to be published in darknet. Best Regards!

Download Session: http://getsession.org/download/

Ransomware Made by Cat

######################################################################################

Changing password for root.
Current password:

aaPanel_Kern

Hello, this is usually caused by a vulnerability in the system that causes root privileges to be exploited by hackers.

mergehez