BianLian Ransomware Decryption

In our recovery lab today at Lockbit Decryptor, we analyzed a custom-built ELF ransomware targeting TerraMaster and Synology NAS devices. The binary, tos-encrypt, is a Rust-based encryptor using a .locked extension and a “TOSG” magic header. Our forensic analysis confirms this is a BianLian-affiliate operation, leveraging a custom Linux toolset distinct from their primary Windows…