Hi,
Same problem here on MyCloud EX2 Ultra.
In my case, it may only have been a direct attack to the NAS, since it was the only device connected to the network for more than a week.
The only port I had opened was 32400 for the Plex Media Server, with forward on the router.
I found all the files in the Public folder encrypted with a .kupid extension, and in each folder a .txt file that informed me of the attack and asked for a ransom of $ 300 via Bitcoin at a link to be opened with the Tor browser.
Since these were files of which I had scattered backup copies, I decided to format the NAS hard disks and factory reset, but I am afraid that the event may happen again.
Carlo
WD My Cloud EX Ultra
FW ver. 2.31.204
