Confluence server restore after crypto attack

[Tommy]

Hi all our company got hit by a crypto attack and our pages were left with broken attachments and link towards the dark web(in order to pay the ransom).

The database seems intact and we have an 1mo backup of plugins and attachments.

We have created an new clean server with the same version as the infected one the connection twoards the db is created and the attachments from the backup were copied to their respective place "/var/atlassian/application-data/confluence/attachments/"

The problem lies that there are no attachments(they appear as broken links)

Any thoughts?

[Tommy · Accepted solution]

Because we had some folder structure and an intact database the method in the link provided a solution for us.

https://bitbucket.org/atlassianlabs/confluence-support-fix-missing-attachments/src/master/

[Bastian Stehmann]

Hi @Tommy ,

welcome to the Community.

This might have several causes:

Could you check, if the file permissions for the Confluence home directory and the attachments are set correct? https://confluence.atlassian.com/confkb/how-to-set-file-system-permissions-for-confluence-986879252.html

Is the Confluence home set correct? https://confluence.atlassian.com/confkb/startup-check-setting-your-confluence-home-935907597.html

If you switch from Windows to Linux or vice versa, check this also: https://confluence.atlassian.com/confkb/attachments-and-profile-pictures-are-missing-after-server-migration-830284218.html

You can also try Reindex the contents of Confluence: https://confluence.atlassian.com/doc/content-index-administration-148844.html

[Tommy]

Thank you for the quick answer, we have tried all of the above steps but the problem remains.