"Belarus Phishing Expedition"

[UKGuy]

Hi All,

I recently received the following email,

Camera ready,Notification: 27-11-2017
Status: Waiting for Reply 83xuXaQy5A7f74wHnDmAkL8CrA2Oy92Yu3_Priority: Normal
=-=--=-=-=--=-=-=-=-=-=-=-=--=-=-=--=-=-=-=-=-


Good day.

I do not want to judge you, but consequently of few occasions, we have touchpoint from now. I do not think that caress oneself is very ill, but when all your acquaintances see it- its definitely bad.

So, closer to the point. You visited the website with роrn, which I’ve placed with the deleterious soft. After you clicked on a video, virus started working and your device became working as dedicated desktop since that moment. Obviously, all cams and screen started recording immediately and then my virus collected all contacts from your device.

I text you on this e-mail address, because I got it it with my soft, and I guess you for sure check this work address.

The most interesting point that I created video, on one side it shows your screen record, on another side your cams record. Its very funny. But it wasn’t so easy ,so I proud of it.

All in all- if you want me to delete all this compromising evidence, here is my Bitcoin wallet address- 18PS7u7ykNBy8CKifHF7E2ZdxwQbTPqRke (it must be without «spaces» or «=»,check it). If you do not know how to use it, you can ask google or youtube for advice- its very easy. It seems to me, that 330 usd will finish our problem and will destroy our point of contact in perpetuity. You have thirty hours after opening this message(I put tracking pixel in it, ill know when you read it). If you wont pay me, ill share the compromising with all contacts I’ve collected from you.

I do not think that cops can find me for only one day(not even 10 days), so think twice, you can lose your honor. Sorry for misprints, I am foreign.

from geraldine@hostzone.biz
:------------------------------------

From online research it seems to suggest this is a phishing email and I haven't actually been recorded.
However, after receiving the email I did a scan of my computer and found a Trojan horse in the system.

I didn't pay anything and I have blocked the email address.
I'm now at 50 hours since I read the email and nothing has happened and I have had no further contact. If the scammer realised their email was blocked would they not just create a new one to keep hounding me?
I have set up search notifications on Google and nothing has come up but if the scammer has my address book I would assume they would email a video directly to my contacts and not need to upload it to youtube!?

This whole thing has made me ill. I can't express how bad I feel. My family and work contacts are in my address book.

I stay awake at night constantly checking my emails and searching my name on Google.

[SlapHappy]

No need to worry. The scammer has nothing. We have a topic here on this very scam called "Belarus Phishing Expedition." viewtopic.php?f=20&t=60846&hilit=Belarus

Ignore the email, if you did get malware, make sure it has been removed. I suggest a full reformat and install of your operating system, be it windows, mac, linux, just to be sure.

If the scammer realised their email was blocked would they not just create a new one to keep hounding me?

No. They are just trying to pickup fast cash on the first email.
You may want to warn your contacts about the fake email being sent out to thousands of people from mailing lists, none having anything to do with what the scammer suggests happened. You can point them to this topic, and make sure they do not click on the attached file.

[UKGuy]

Thank you for the quick reply.

When you say to email all my contacts to warn them not to open any attachments is that so they don't see anything of me in a compromising situation or so they don't fall for the scam?

I kind of feel that by emailing everyone it tells them that I've been w*nking whilst watching porn and worried that I might have been caught.

[SlapHappy]

The attachment does not have any video of you, it has a malware payload, that could be used to steal your personal details or do other nasty things, maybe even use your pc to send more emails like this one.

The email addresses are taken from email mailing lists, not porn sites, and being spammed out to everyone, man woman and child. Anyone could get these emails.
If you feel uncomfortable telling all, tell the ones you are ok with, but if they all get them, then warn the rest, as this will mean the trojan has swiped your contact list and all contacts could be getting them, endangering them with the trojan as well. .

How would you feel, if the roles were reversed, and one of your contacts got this email, infected with malware?
And they were told that their contact list could have been stolen, and YOU were not warned, and you got an infected email too?

[Wayne]

I kind of feel that by emailing everyone it tells them that I've been m***urbating whilst watching porn and worried that I might have been caught.

What it tells them is that you received an email because your email address is on a list that's been scraped from various sites. You're not the only person that got it as it's likely sent out to thousands at the same time in a scattergun approach in the hopes someone will pay out. That's all you're guilty of - having your email address in the same kind of lists that spammers use to send you their crap.

[UKGuy]

Hi,

Apologies if I sound naive on this.

So, I need to send an email to all my contacts warning them not to open any email from this Geraldine person or should it be not open any email from me? If the latter then I would now, after sending the email, create a new email address and close/delete my current one.
I would assume that I also don’t need to disclose what the email was about that I received that has made me believe my address book has been hacked!?

[UKGuy]

Just read Slaphappy response again.
The Trojan Horse didn’t come with the blackmail email.
I have a computer (I’ll call Personal) that I use for personal stuff but I picked the email up on a different computer (I’ll call Mac)
So, Mac received the email and has no Trojan.
Personal has never downloaded, viewed or received the email but had a Trojan on it.
So, I must have picked the Trojan up whilst visiting a web site.

[SlapHappy]

not to open any email from this Geraldine person

This will work. And it might make sense to change your email account anyway, as you may get more attempts of other scams later, since it is on a mailing list somewhere.

I would assume that I also don’t need to disclose what the email was about that I received that has made me believe my address book has been hacked!?

No you don't have to get into exact details. "I was sent a phishing email that might have been infected," will do. Everyone has heard of email hacks and attempted hacks before.

Ok, so whatever that trojan was came from somewhere else, it sounds like. Happens to everyone sooner or later.
Sometimes you do not even have to click on anything.

[UKGuy]

Thank you for your help and replies. I'm slowly starting to feel better now, although I'm still monitoring things. My surfing habits will certainly be changing looking into the future.

[simonkozmik]

Hi, I got 2 emails from which I think is SCAM, I did nothing, I won't do anything at all, but anyway it could be useful for other people to know how to manage it and to add it to a database of scammers. Thanx a lot.

Text of the 1st email:
Тicкet Detаils
Email: my business email was here (I hide it for privacy)
Camera ready,Notification: 04/12/2017
Status: Waiting for Reply 04xuGaMy7A9f69wNnQmMkG1JrI2My00Eu5_Priority: Normal
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Whats up.

I do not presume to judge anyone, but as a result of few occasions, we have touchpoint since now. I do not think that caress oneself is very bad, but when all your acquaintances see it- its definitely bad.

So, closer to the point. You surfed the internet with роrn, which I’ve seized with the virus. After you chose video, virus started working and your device became working as dedicated desktop immediately. Naturally, all cams and screen started recording instantly and then my virus collected all contacts from your device.

I message you on this e-mail address, cuz I’ve collected it from your device, and I make no doubt you for sure control this work address.

The most interesting point that I edited video, on one side it shows your screen record, on second your cams record. Its very amusingly. But it wasn’t so easy .

All in all- if you want me to delete all this compromising evidence, here is my BTC wallet address- 1MH9MZsv83NJNBgfTfnc4EUxjedQaxxEVy (it must be without «spaces» or «=»,check it). If you do not know how to make btc transactions, you can ask google or youtube for tips- its very easy. It seems to me, that 290 usd will solve our problem and will destroy our point of contact forever. You have one day after reading this message(I put tracking pixel in it, ill know when you read it). If you do not able to finish transaction, ill share the compromising with all contacts I’ve collected from you.

Finally, you can ask police for help, but, obviously, they will not find me for 1 day, so you will be shamed at all. Sorry for misprints, I am foreign.

Text of the 2nd one:

Тiсkеt Dеtails
Email: my business email was here (I hide it for privacy)
Camera ready,Notification: 04/12/2017
Status: Waiting for Reply 18xuDaWy4A5f84wZnNmXkW5ZrL0Ay14Nu7_Priority: Normal
**********************************************


Whats up.

I do not want to judge you, but eventually of few cases, we have touchpoint since now. I do not think that caress oneself is very amiss, but when all your acquaintances see it- its definitely bad.

So, closer to the point. You visited the internet with роrn, which I’ve placed with the virus. After you chose video, virus started working and your device became working as rdp since that moment. Naturally, all cams and screen started recording instantly and then my soft collected all contacts from your device.

I message you on this e-mail address, because I’ve collected it from your device, and I guess you for sure control this work e-mail.

The most interesting point that I created video, on one side it shows your screen record, on another side your cams record. Its very funny. But it was sophisticated .

As a conclusion- if you want me to erase all this compromising evidence, here is my Bitcoin account address- 1GWyRit5hJGHSgkWP6xnqSm5CVKq4wt6bw (it must be without «spaces» or «=»,check it). If you do not know how to use it, you can ask google or youtube for advice- its very easy. It seems to me, that 350 usd will finish our problem and will destroy our touchpoint till kingdom come. You have one day after opening this letter(I put tracking pixel in it, ill know when you open it). If you will not pay me, ill share the compromising with all contacts I’ve collected from you.

I do not think that cops can find me for only one day(not even 10 days), so think twice, you can lose your honor. Sorry for misprints, I am foreign.