Overview:

The Michigan Cyber Command Center (MC3) has become aware of threatening phishing emails circulating recently. Hundreds of slight variations of the email were found and reported. The emails begin with the adversary claiming to have access to your email credentials, contact list, internet search history, or embarrassing webcam footage. The adversary then threatens to release your embarrassing info on the internet, unless you pay a ransom in Bitcoin. Below is an example of one of the emails received:

[img src=”/wp-content/uploads/sites/1097/2018/08/MC3-Cyber-Situational-Awareness-Message.jpg” class=”aligncenter”]

Analysis:

The MC3 has assessed these threats, and found that these emails aren’t valid. The adversaries’ claims are not true, and should be ignored. The credentials used by the adversary to prove they have access to the user’s device are typically incorrect or come from an old data breach. The MC3 does not recommend paying the ransom or taking the threat seriously. However, we recommend a few password protection methods.

To stay secure, experts suggest updating your passwords frequently. Organizations often require passwords be reset every 90 days, but individuals sometimes fail to follow this advice. Regularly updating your passwords to new, strong, random alphanumeric strings stored in an encrypted password locker is the best strategy for keeping your passwords secure. At a bare minimum, you should reset your password upon notification of an unintended disclosure.

If possible, you should also be using multifactor-authentication. This type of security adds an extra method of verification to the login process, requiring both a password, and an additional item to verify your identity, such as a one-time security code or token. We recommend using all available login security features, and staying informed about new threats to your security.