Monday 30 April 2018

Nightmare-RAT taking over my network/Apple devices

I am desperate for some answers so hoping someone can help. I hope I can have this make sense. This is my best explanation on what is going on but I could be missing something bc this is not my area and I only put the pieces together in past few days.

I believe we clicked on something on one of my MacBooks that started this nightmare. We started noticing internet issues about a month ago. Devices were getting kicked off, things were running SLOW. My husband did a factory reset with a paperclip with our router one day while I was gone. I came home and needed to change logins to WiFi. I used the IP address and standard login on router to change admin settings. Did so on a computer that I now believe has spyware:adware. Later that day, I tried to login again and password had changed. I’ve literally had this happen 100plus times now. I will change every setting but it doesn’t matter bc they change it back and have all remote access settings turned on. Spectrum was useless just giving us a new router tag was the same as old one.

But I guess I wanted to believe new router took care of it. It seemed to but the past few days I realized it’s still going on. This is where things get crazy.

I started not being able to login to things I login to daily. Most concerning, my external savings accounts. Friday night I was on my laptop messing around and noticed one of processes (or from opening that utility) was Apple keychain. I checked logs and noticed someone or some process on there. I can’t even remember what I did but was trying to do something when they added a passcode to my own keychain and suddenly couldn’t access it when I had prior. This was just the start. I’ve barely slept dealing with this. Also weird is in my finder an icon by folders was saying “searching this Mac) with a spinning circle. This was never there. When I clicked on it, it was my sons phone or stuff on there. Our apple ids are closely linked bc he’s young but he’s never been on this computer and that shouldn’t be there.

When I looked at his phone, under GENERAL-VPN it said an app called TeTHER ME was managing his device or something like that (took screenshots but since lost a lot with resets). I’ve never added that and he can’t add anything (he’s 8) without me approving. I don’t know how they connected his phone to my stuff but may have had his iCloud login from me entering it on that computer. So his phone has been restored but that icon on computer still not going away. I don’t believe his phone is free and clear. His passwords were changed with 2-factor added. For reference he had iPhone 6s and hadn’t had latest update bc space (and time)but does now.

Now my phone. My phone is brand new iPhone 10x. I realized this weekend apps were being downloaded. I was seeing updates on file master update that I didn’t do. The app CLOUDAPP was on there that I never downloaded. Other things on there were fake versions of real apple apps. Mh phone was unlocking itself in front of me. Good way to feel like you are losing your mind. They locked me out of my account and changed security questions and password. I went through on phone with Apple 2 hours resetting everything. They still could change my router admin login right behind me. I don’t know what else to do. They have now locked me out of my MacBook. They were booting up a iOS that wasn’t my normal one and so anything I do is their version snf going right to them. I can’t even do a system reboot so this may be going to Apple bc I am out of options with that device.

My questions- how do I know my phones are clear of this? I have a new router and modem and talked to tech support so know a path to take but I really need to get this figured out ASAP. I can’t pay bills or do anything bc they go in and get a login to any site I visit (if it’s important enough-I’m sure my reddit will be ok).

And I don’t know if this has affected more than just those 3 devices. I did a reset on my oldest sons phone, his is connected to his dads account and not mine but changing IP login from his phone did nothing. Same result. I can’t put this new router in until I know they won’t go after that too but I am going to be looking at a lot of money if I have to bring 3 laptops, 5 iPhones, and other Apple devices to get cleared. I have a list a mile long now and 20 min I can call my external banks and pray they haven’t wiped us out.

Apple said (phone tech support) “I can assure you no one is in your phone” and half the stuff I’ve read people fight with anyone claiming they can’t do that. I know they have 2 of our apple ids so I realize that probably helped them do this. But even changing my Passwords, is that going to kick them off my phone for good? I haven’t seen it do what it was when they locked me out of my Apple ID but even with all computers off, someone is still changing my router login after me. So I have wasted hours at this point.

Side note, our ring doorbell was inside and I never got it back on WiFi a month ago, we heard it clicking a lot and I guess I just thought it picked motion up either way. Until I noticed it was doing this with no motion at all. And we heard breathing heavy for about 15 seconds Friday night. I tried to get on and change those settings but they again, changed password and couldn’t get on right after. I’m guessing it’s connected but not sure who is doing this. But ring doorbell has no secure connection option so I’m not messing with that until I get this figured out.

Sorry for long post but any experience with any part of this would help st this point. I’ve read logs on my Mac and 100% positive someone or some people are in there. Some of it was just standard process stuff snd mixed in was what appeared to maybe be conversations. They had a file scanning all my surrounding WiFi’s and had info I stumbled upon for pretty detailed info about my neighbors connections too

We are all offline for time being but I need to figure this out. Complete nightmare.



Submitted April 30, 2018 at 06:21PM by Cyndarely https://ift.tt/2rb24JO

No comments:

Post a Comment