Vietnam case studies
Ticket #1355: what is known and unknown about a NAS case
Read TUNGTEK's public NAS record through its evidence: received devices, attribution limits and missing data.
Tùng TEKNot independently verifiedRecovery Intelligence
Recovery Intelligence: understand the scope of damage and the reliability of a recovery outcome.
Evidence
Measure on data that can be checked
- Sample scope and representativeness.
- File structures, altered regions and overwrite artifacts.
- Application-level integrity.
- Actual usability after extraction.
Technical assessment
RFC is not a guarantee
RFC — Ransomware Fast Check — is a preliminary assessment of samples and available evidence. State its limits; a sample percentage must not be extrapolated to all data.
Recovery also depends on storage structures, available copies, overwrite extent and usability criteria.
- NAS / RAID
- Array structures, filesystems, snapshots and independent copies.
- SQL Server
- MDF/LDF structures, consistency and application-level checks.
- ESXi / Hyper-V
- Virtual disk structures, snapshot/checkpoint chains and bootability.
- Server / file
- Formats, changed regions and whether data can be opened, read and used.
Vietnam case studies
Ransomware .PIZ 2026: comparing eight cases recorded by TUNGTEK
Eight internal tickets: ransom demands, indicators, reference TTPs and attribution limits. The .PIZ extension does not establish a family.
No.Ransomware.VNNot independently verified
Forensic
Forensic timelines: reconstruct incidents from verifiable timestamps
Combine logs, metadata and storage artifacts into a sourced timeline while retaining gaps and clock discrepancies.
Tùng TEKVerified