- A company’s executives received an extortion letter in the mail
- It claims to have come from ransomware operators BianLian
- The senders warned about stealing the company’s sensitive files
The security world appears to have come full circle, as spam mail has once again gotten physical with scammers sending their victims snail mail.
Cybersecurity outlet GuidePoint recently came across a couple of these letters sent to members of the target organization’s executive team.
The letters are not your typical extinct spam, either – but claim to have been sent by the BianLian ransomware group.
There is no ransomware
“I regret to inform you that we have gained access to [REDACTED] systems and over the past several weeks have exported thousands of data files, including customer order and contact information, employee information with IDs, SSNs, payroll reports, and other sensitive HR documents, company financial documents, legal documents, investor and shareholder information, invoices, and tax documents,” the letter reads.
“Your network is insecure and we were able to gain access and intercept your network traffic, leverage your personal email address, passwords, online accounts and other information to social engineer our way into [REDACTED] systems via your home network with the help of another employee.”
The researchers said that the attacks are as fake as the letters. There is no evidence of any compromise whatsoever, and the letter’s contents bear no resemblance to the BianLian ransomware operation. Even the wording of the message is inconsistent with ransom notes BianLian was seen sending in the past, they said.
In any case, the scammers were demanding $250,000 to $350,000, to be paid in Bitcoin, within ten days. The letter also included a QR code leading to the Bitcoin address, but it’s freshly generated so it’s impossible to determine if it really belongs to BianLian or not.
The return address for the letters is in Boston, USA, and according to The Register, points to a real address for an office building.
Via The Register
Leave a comment