Author Topic: Notice, New Spyware Developer extorting the wrong group!  (Read 940 times)

0 Members and 1 Guest are viewing this topic.

Offline Rick

  • Hero Member
  • *****
  • Join Date: May 2013
  • Posts: 825
  • Karma: 2
    • View Profile
Notice, New Spyware Developer extorting the wrong group!
« on: December 21, 2018, 09:12:31 PM »
Hello,

I am a spyware software developer. Your account has been hacked by me in the summer of 2018.

I understand that it is hard to believe, but here is my evidence (I sent you this email from your account).

The hacking was carried out using a hardware vulnerability through which you went online (Cisco router, vulnerability CVE-2018-0296).

I went around the security system in the router, installed an exploit there. When you went online, my exploit downloaded my malicious code (rootkit) to your device. This is driver software, I constantly updated it, so your antivirus is silent all time.

Since then I have been following you (I can connect to your device via the VNC protocol). That is, I can see absolutely everything that you do, view and download your files and any data to yourself. I also have access to the camera on your device, and I periodically take photos and videos with you.

At the moment, I have harvested a solid dirt... on you... I saved all your email and chats from your messangers. I also saved the entire history of the sites you visit.

I note that it is useless to change the passwords. My malware update passwords from your accounts every times.

I know what you like hard funs (adult sites). Oh, yes .. I'm know your secret life, which you are hiding from everyone. Oh my God, what are your like... I saw THIS ... Oh, you dirty naughty person ... :)

I took photos and videos of your most passionate funs with adult content, and synchronized them in real time with the image of your camera. Believe it turned out very high quality!

So, to the business! I'm sure you don't want to show these files and visiting history to all your contacts.

Transfer $970 to my Bitcoin cryptocurrency wallet: 1A7nmeXMjFd8unyg9hopifwBRpWu5MpqQw

My system automatically recognizes the translation. As soon as the specified amount is received, all your data will be destroyed from my server, and the rootkit will be automatically removed from your system. Do not worry, I really will delete everything, since I am 'working' with many people who have fallen into your position. You will only have to inform your provider about the vulnerabilities in the router so that other hackers will not use it.

Since opening this letter you have 48 hours. If funds not will be received, after the specified time has elapsed, the disk of your device will be formatted, and from my server will automatically send email and sms to all your contacts with compromising material.

I advise you to remain prudent and not engage in nonsense (all files on my server).

Good luck!

Offline Samson

  • Hero Member
  • *****
  • Join Date: Nov 2011
  • Posts: 909
  • Location: London
  • Karma: 38
    • View Profile
Re: Notice, New Spyware Developer extorting the wrong group!
« Reply #1 on: December 22, 2018, 08:41:46 AM »
Just a phishing email.

I'd say targeting the right group, ie those who open and read spam.

I don't even open my spam folder, let alone open spam emails  :wink:

Offline Rick

  • Hero Member
  • *****
  • Join Date: May 2013
  • Posts: 825
  • Karma: 2
    • View Profile
Re: Notice, New Spyware Developer extorting the wrong group!
« Reply #2 on: December 23, 2018, 04:17:01 AM »
Nope; and, sorry... were not that easy over here!
Program related! at a minimum...

I use a Tencent mailbox:
China will find them...

X-KK-mid:bizmxp3t1545373829twsb700oo
Received: from mx03.listsystemsf.net [59.27.15.197] by mtu23.bigping.com with SMTP; Thu, 20 Dec 2018 22:12:15 -0800
Received: from [84.203.199.79] by snmp.otwaloow.com with SMTP; Thu, 20 Dec 2018 21:55:35 -0800
Received: from unknown (HELO snmp.otwaloow.com) (Thu, 20 Dec 2018 21:43:02 -0800)
   by mailout.endmonthnow.com with ESMTP; Thu, 20 Dec 2018 21:43:02 -0800
Message-ID: <D67F5CCB.FBFD54CD@Smith432.edu>
Date: Thu, 20 Dec 2018 21:43:02 -0800
Reply-To: "Rick mccoy" <Aaron@Smith432.edu>
From: rick.mccoy@baymedicalcompany.cn
X-Accept-Language: en-us
MIME-Version: 1.0
To: <rick.mccoy@baymedicalcompany.cn>
Subject: rick.mccoy
Content-Type: text/html;
   charset="us-ascii"
Content-Transfer-Encoding: base64

Offline Boggin

  • Global Moderator
  • Hero Member
  • *****
  • Join Date: Jul 2014
  • Posts: 8429
  • Location: UK
  • Karma: 114
    • View Profile
Re: Notice, New Spyware Developer extorting the wrong group!
« Reply #3 on: December 23, 2018, 04:42:35 AM »
Have you logged into your router to see its logs - these will tell of any recent attacks.

A factory reset of that probably wouldn't go amiss, but if your router has been hacked then you should contact your ISP.

Also I would boot into Safe Mode with Networking and download and run a rootkit scan with the free version of MBAM.

You'll find that option in Settings/Protection - https://www.malwarebytes.com/mwb-download/

Any change of email passwords is best done from another computer.
Tom.

Offline Rick

  • Hero Member
  • *****
  • Join Date: May 2013
  • Posts: 825
  • Karma: 2
    • View Profile
Re: Notice, New Spyware Developer extorting the wrong group!
« Reply #4 on: December 23, 2018, 05:37:08 AM »
Makes senses now;
Looking at the router log, it allows a sent from and then Sent too;
Thanks boggin for helping point that out

You other instructions will be carried out ASAP


Offline Boggin

  • Global Moderator
  • Hero Member
  • *****
  • Join Date: Jul 2014
  • Posts: 8429
  • Location: UK
  • Karma: 114
    • View Profile
Re: Notice, New Spyware Developer extorting the wrong group!
« Reply #5 on: December 23, 2018, 05:50:18 AM »
Let us know what the ISP says to mitigate such attacks.
Tom.

Offline Samson

  • Hero Member
  • *****
  • Join Date: Nov 2011
  • Posts: 909
  • Location: London
  • Karma: 38
    • View Profile