Category Archives: Ransom

Ransomware Attacks

Ransomware is malware (malicious software) that utilizes encryption to hold a victim’s data ransom. Important data is encrypted to block the owner’s access to files, databases, or software. To gain access, a ransom is then demanded. The most dangerous aspect of ransomware is how rapidly it can spread across a network and affect all of an organization’s databases and servers.

Cybercriminals make billions of dollars from ransomware, and businesses and governments pay a high cost in ransom, expenses and lost data.

Recent Ransomware Attacks

Companies like the Colonial Pipeline, Steamship Authority of Massachusetts, JBS (the world’s largest meatpacker), and the Metropolitan Police Department of Washington, DC were attacked in 2021. The ransom payments to the hackers caused the shutdown of critical infrastructure and subsequent deficiencies, enhanced costs of goods/services, the shutdown of operations and financial losses.

Attacks on the healthcare sector

In 2020, ransomware attacks cost the economy $20 billion in impacted revenue, lawsuits, and ransom paid, according to a new report. A total of 92 ransomware attacks hit more than 600 healthcare facilities in 2020.

Colonial Pipeline Attack

In April 2021, due to the pipeline’s critical role in the national infrastructure system, this attack had a significant impact on the US. Major disruption in gas supplies caused an uproar on America’s east coast after system failures halted the flow of gas.

Brenntag Attack  

Brenntag,  a chemical marketing firm, was targeted by DarkSide in May 2021. The hackers stole 150GB of data, for which Brenntag paid $4.4 million (of the $7.5 million demanded).

Quanta Attack

In April 2021, the REvil gang demanded a $50 million ransom from computer manufacturer Quanta. Apple product blueprints obtained from Quanta were leaked, and the hackers threatened to expose more sensitive information and files.

Acer Attack

The REvil hacker group, which also targeted Travelex, a London-based foreign exchange firm, attacked Acer in May 2021. To date, the $50 million ransom is the largest ever recorded.

CNA Attack

A ransomware attack on a large insurance firm occurred in March 2021. The hacker group targeted CNA’s network, encrypting 15,000 devices, many of which belonged to remote workers.

Rockets Attack

In April 2021, the hacker group Babuk was alleged to have compromised 500GB of private documents about the Houston Rockets from the National Basketball Association (NBA).

AXA Attack.

The Avaddon gang struck European insurance company AXA in May, shortly after major alterations to their insurance policy were made public.

How to Avoid Ransomware Attacks

Be prepared to lessen the chances of an attack. Ensure you have anti-ransomware software installed on all of your computers. If a link is not safe, do not click on it.

As a result of malicious websites, software downloads, and spam mail, ransomware infections can spread. To avoid phishing, do not give out personal information. Never open an attachment from an unknown email. Keep your software and operating system current.

Not only should you avoid downloading files from untrusted sources, but avoid using USB drives. When using public WiFi networks, be cautious. Use only a VPN.

What to Do When You Are Attacked?

To begin, never pay a ransom to decrypt your files when you have no way to be sure you’ll get them back. Your Wi-Fi should be turned off and the network disconnected.  Investigate the attack online using a different device to find out the type of ransomware and any other info displayed on your screen. Take a picture as a record. Consult an expert about your system and notify the appropriate authorities about the attack. And to protect others from the attack, please report it to Bitcoin Who’s Who here: Report Bitcoin Ransomware

New CIA Child Porn Bitcoin Ransom EMAIL

The first report of a Central Intelligence Agency officer sending ransom emails demanding bitcoin in exchange for concealing evidence of child porn was received March 16. Since then dozens of similar reports have come in, each demanding $10K USD payment to a different multi-sig address. As of this posting none of the reported addresses have received ransom payments.

Continue reading New CIA Child Porn Bitcoin Ransom EMAIL

Bitcoin Bomb Ransom Fizzled Out: No Payments Made By Deadline

There will be winners and losers in the race to become the best bitcoin extortionist emailer. The latest bitcoin scam email campaign looks like it will be one of the losers.

New Bitcoin Bomb Ransom Email A Fake

Starting this morning, from U.S. sources, BitcoinWhosWho.com began receiving reports of a fake bomb threat demanding $20k in bitcoin or a “mercenary” would blow up their building. So far no one has paid any of the 15 bitcoin addresses that have been identified. But, it would only take a few people falling for this to make it worthwhile for the scammer.

The email typically states the bomb or explosive device is made of “lead azide”, “Tetryl” or “Hexogen” but also “tronitrotoluene” has been reported.

Notably, the author really wants to be clear that everything is proceeding “according to my guide”. Oh, and BTW, the bomb will go off by the end of the day if you don’t pay.

Continue reading Bitcoin Bomb Ransom Fizzled Out: No Payments Made By Deadline

The Future of Bitcoin KYC

The addition of two Iranian SamSam ransomware bitcoin addresses to the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) list ushered in a new era in Know Your Customer, Counter Terrorist Financing and Anti-Money Laundering (KYC/CTF/AML) regulation compliance for bitcoin transactions. From now on, no one is allowed to transact with these two bitcoin addresses:

1AjZPMsnmpdK2Rv9KQNfMurTXinscVro9V
149w62rY42aZBox8fGcmqNsXUzSStKeq8C

It’s a significant first. For responsible crypto exchanges and bitcoin ATMs operating in this wild west legal environment there are very few FREE KYC/CTF/AML compliance tools available. BitcoinWhosWho.com provides open-source data necessary to adhere to burgeoning global KYC/CTF/AML procedures involving bitcoin transactions.

  • Monitor OFAC List
    Prevent scam addresses from registering at an exchange.
  • Bitcoin Transaction Profiling
    Warn customers before they send bitcoin to an accused scammer.
  • Wallet Risk Assessment
    Mark wallets which have transacted with “scam” wallets to a higher degree of risk.

Continue reading The Future of Bitcoin KYC

Sextortion With Password Email Scam Variant Makes 22.67BTC Over First 3 Weeks

Don’t pay it! No matter how convincing inclusion of that old password you used to use makes it seem, they don’t have video of you doing that. Don’t be embarrassed, if you considered paying the ransom email you’re not alone. So far 101 victims have sent 22.67 BTC to 37 of the 176 bitcoin addresses so far reported to be related to the new sextortion with/password scam email variation that first appeared July 10. Reports of previous versions of the same sextortion tactic without the password portion have been reaching us since October 2017. Inclusion of a password is unique over the last three weeks. Continue reading Sextortion With Password Email Scam Variant Makes 22.67BTC Over First 3 Weeks

I Know Your Password #Bitcoin Extortion Email Variant

A new twist on an old trick emerged this week. The porn ransom email claiming to have incriminating video of the recipient which will be released to contacts if not paid in bitcoin, has now included an old compromised password of the recipients in an attempt to add credibility to the scam. Gotta appreciate that dark web creativity. Where did they get all those passwords? The first report of this new variant was received July 10. Since then dozens more reports have come in relating to just over 2 dozen bitcoin addresses as of Friday. This address has been reported 9 times and also has the most total received at 2.83 BTC:

1JHwenDp9A98XdjfYkHKyiE3R99Q72K9X4

Continue reading I Know Your Password #Bitcoin Extortion Email Variant

Bitcoin Porn Blackmail Scam Moved to Poloniex Wallet

When reports of this email scam first started appearing last September the perpetrators were discovered to be using a Matbea wallet. That appears to have changed. On May 30 every output transaction from hundreds of reported blackmail scam addresses went to a Poloniex wallet address.

These bitcoin addresses were reported as scams related to the porn blackmail email:

12UCMcAseQK2syjQWRpnbc8tUtzxzZG9kS
15LKRRYM2k2CCSGT76rNbQmciLZJSxKXAx
18aVwkFAadCvwGBHN8vagouWBWrNEpZAaV

Each of them shows an output to 1E2J2DAFGToqmTxK5H8fG6V3Tp3xqSiAm4 on May 30, 2018.

A quick investigation shows 1E2J2DAFGToqmTxK5H8fG6V3Tp3xqSiAm4 is among the Poloniex wallet cluster.

[tweetshare tweet=”A Poloniex wallet address is being used to run the widespread porn blackmail scam”]

Continue reading Bitcoin Porn Blackmail Scam Moved to Poloniex Wallet

Bitcoin Hitman Email

Bitcoin Hitman Sample Email
BitcoinWhosWho received multiple independent reports of a new bitcoin ransom email threatening people with “I’ve got an order to remove you” circulating.

The addresses we know so far:
1GtWsHzvxuwFkKyhH1m8dHznE8iSdfaR7
12gzbLuWWQHHSvRkUfHUygSU9zRP8aAbKq
1GZGRKGkpdZm195aQpRHciyfPxyciT8duW

However, no blockchain transactions yet.

These are the reports as of Dec 11 2017: Continue reading Bitcoin Hitman Email