13 Jul 21

Bogus Bomb Threats Demand Bitcoin Disrupt Businesses - Malware News - Malware Analysis, News and Indicators

Bogus bomb threats created a scare across the country. A quick note here that I'll dive into more deeply next week. The big question at this time -- with MANY of the IP addresses found in email headers originating fro…

7 Jan 19

Bogus Bomb Threats Demand Bitcoin Disrupt Businesses - Security Boulevard

Bogus bomb threats created a scare across the country. A quick note here that I'll dive into more deeply next week. The big question at this time -- with MANY of the IP addresses found in email headers originating from Moscow, Russia, is this "Russian influence" designed to disrupt American commerce? or is this just a spammer looking for a new way to make money? IF YOU HAVE SAMPLES OF THE EMAIL, PLEASE REPORT THEMThe more emails we have to analyze, the better our understanding of this threat will be.  While reporting to the FBI's IC3.gov is a great idea, and highly encouraged, that hides the details from security researchers such as myself.  One great place to report any type of fraudulent bitcoin activity is "BitCoinAbuse.com".  If you decide to report there, please extract the sending IP address and the email Subject from your spam and include them as part of the report.  We can cluster on both of those things. (Including the bitcoin address used is a given.)Extracts taken from BitCoinAbuse.com follow below. You can read the original reports yourselves here:https://www.bitcoinabuse.com/reports/15qH84uLC49CmC6jRE958Qjcf9WRZ2rMuMhttps://www.bitcoinabuse.com/reports/1CF9VQhwjJutPxwVq5QLFA7j7baq4RDb3whttps://www.bitcoinabuse.com/reports/1BTuxsCpAGtCzcszvFV2g4beqAZ2AUnyFhhttps://www.bitcoinabuse.com/reports/1Hov6Xo2Bss7K3p56gGKfy7UGY37TfXG2khttps://www.bitcoinabuse.com/reports/1AgKqK3LHyJuLKzbK2wd4nuxAJ2GJ84maZhttps://www.bitcoinabuse.com/reports/1LrZorkdqzPsg8JaGLwjLwg35viiH1Sv9vhttps://www.bitcoinabuse.com/reports/1893DMwnrq9vA6JmQBdyWRKecArDAUTcGRhttps://www.bitcoinabuse.com/reports/14Rz7W71sXwmnwqZHLvXSf5s1vmpp9viFbhttps://www.bitcoinabuse.com/reports/1PcFPuZeEfuCCbdPu69nzUCvzsqu967xNmhttps://www.bitcoinabuse.com/reports/1CDs3JXUU6wNmndAF7EFcrJ6GGSYRKXd7whttps://www.bitcoinabuse.com/reports/19nShJMkTbP6VCVaoAjzzTQuXLPzXH1Qb7https://www.bitcoinabuse.com/reports/161JE4rHfvygXUVLya8N2WFptjwon2172t(If you have a sample of one of these emails, please consider filling out a BitCoinAbuse.com/report - but please make sure to include the SENDING IP ADDRESS from the email headers!) Email Bodies contain Spam-template randomizationHere are extracts from many of the spam messages. Note for example the and substitutions. Or the or the . This is very characteristic spam behavior.Subjects reported by the NCFTA include:Subject: Better listen to meSubject: Bomb is in your buildingSubject: Do not panicSubject: Do not waste your timeSubject: Dont get on my nervesSubject: I advise you not to call the policeSubject: I've collected some very interesting content about youSubject: keep calmSubject: My device is inside your buildingSubject: Think about how they can help youSubject: Think twiceSubject: We can make a dealSubject: You are my victimSubject: You are responsible for peopleSubject: Your building is under my controlSubject: Your life is in your handsSubject: Your life can be ruined, concentrateSubject: You're my victim(If you have examples of other Subjects, please share them in the comments section)Hello. There is the bomb (tronitrotoluene) in the building where your company is located. It is constructed under my direction. It has small dimensions and it is hidden very carefully, it is not able to damage the supporting building structure, but you will get many wounded people if it detonates. My recruited person is controlling the situation around the building. If he notices any strange activity or policemen the device will be blown up. I want to propose you a deal. $20'000 is the value for your safety. Pay it to me in BTC and I assure that I have to withdraw my recruited person and the bomb will not explode. But do not try to deceive me- my assurance will become actual only after 3 confirms in blockchain. It is my btc address : 15qH84uLC49CmC6jRE958Qjcf9WRZ2rMuMGood day. My mercenary hid an explosive device (Hexogen) in the building where your business is conducted. It was assembled according to my instructions. It is compact and it is hidden very carefully, it is impossible to damage the structure of the building by this bomb, but in case of its explosion you will get many victims.My mercenary is watching the situation around the building. If he notices any suspicious behavior, panic or cops he will blow up the bomb.I want to propose you a bargain. You transfer me 20'000 usd in BTC and the bomb will not explode, but don't try to deceive me -I guarantee you that I have to withdraw my man only after 3 confirmations in blockchain network. It is my Bitcoin address : 1LrZorkdqzPsg8JaGLwjLwg35viiH1Sv9v You must send bitcoins by the end of the working day.My mercenary has carried an explosive device (Tetryl) into the building where your company is located. It was assembled under my direction. It can be hidden anywhere because of its small size, it is impossible to destroy the building structure by this explosive device, but if it detonates there will be many victims. My recruited person is watching the situation around the building. If he sees any unusual behavior or policemen he will power the device. I would like to propose you a deal. 20.000 dollars is the cost for your life. Tansfer it to me in BTC and I ensure that I will call off my man and the bomb will not explode. But do not try to fool me- my warranty will become valid only after 3 confirms in blockchain network. Here is my BTC address - 15qH84uLC49CmC6jRE958Qjcf9WRZ2rMuM You have to pay me by the end of the working day, if you are late with the payment the device will explode.Good day. I write you to inform you that my mercenary hid an explosive device (lead azide) in the building where your company is located. My recruited person constructed a bomb under my direction. It can be hidden anywhere because of its small size, it can not damage the supporting building structure, but you will get many victims in case of its explosion. My mercenary keeps the territory under the control. If he notices any unnatural behavior or emergency he will power the bomb. I can call off my man if you make a transfer. 20'000 usd is the price for your safety. Pay it to me in Bitcoin and I guarantee that I will call off my mercenary and the device will not detonate. But do not try to cheat- my assurance will become valid only after 3 confirmations in blockchain.Good day. There is a bomb (tronitrotoluene) in the building where your company is conducted. My recruited person constructed the explosive device according to my instructions. It can be hidden anywhere because of its small size, it is impossible to destroy the structure of the building by my explosive device, but in case of its explosion you will get many victims. My man keeps the territory under the control. If any unnatural behavior, panic or emergency is noticed the device will be blown up. I can call off my recruited person if you make a transfer. 20'000 usd is the price for your safety. Tansfer it to me in Bitcoin and I ensure that I will withdraw my mercenary and the bomb won't explode. But do not try to deceive me- my warranty will become valid only after 3 confirms in blockchain network. My payment details (Bitcoin address): 1CDs3JXUU6wNmndAF7EFcrJ6GGSYRKXd7wMy man hid a bomb (lead azide) in the building where your business is conducted. It was constructed according to my guide. It is small and it is hidden very well, it is impossible to destroy the supporting building structure by this explosive device, but you will get many victims in the case of its detonation. My mercenary keeps the territory under the control. If any unnatural activityor emergency is noticed the bomb will be blown up. I would like to propose you a deal. You transfer me $20'000 in Bitcoin and explosive will not explode, but do not try to cheat -I warrant you that I will call off my man solely after 3 confirmations in blockchain network.Hello. There is the bomb (lead azide) in the building where your business is conducted. My man built the explosive device according to my instructions. It is compact and it is hidden very carefully, it is impossible to damage the structure of the building by

13 Dec 18

Email Bomb Threat Potential Spam? : sysadmin

r/sysadmin: A reddit dedicated to the profession of Computer System Administration.