As a follow-up to one of our June 2017 diaries asking people to forward us any DDoS threats, we received yet another example:
Since 2017-09-19, at least 4 people have tweeted about the same type of emails, supposedly from Phantom Squad:
This feels like a scam using the notariety of Phantom Squad's name, because the group has gotten some fairly high-profile press coverage in recent years. In December 2015, Phantom Squad claimed responsibility for a DDoS attack against Xbox Live. A year later in December 2016, Phantom Squad was apparently involved in a DDoS attack against Steam. However, I haven't found any evidence yet this group is involved in small business extortion.
Wheter or not this email is legitimate or fake, they all use notariety of the group's name to make the threat sound plausible.
In our June 2017 diary about fake DDoS extortion emails, Johannes Ullrich provides some guidance for people that receive these types of messages. Tips include:
Thanks to everyone who already forwarded examples to us. As Johannes previously asked in June 2017, please continue to forward us any similar emails. We can always use the additional data.
Sep 21st 2017
|Thread locked Subscribe||
Sep 21st 2017
3 years ago
Possibly related? Seems whaling-like, as only 1 person in our organization of over 60000 received an email from this sender, or from the sending IP address.
From: Blаckseo [mailto:firstname.lastname@example.org] client IP: 193.124.xxx.xxx
Sent: Tuesday, September 26, 2017 1:15 PM
Subject: Nеgаtivе sео wаrning
Wе аre XMR SQUAD.You сorроrаtion is chosеn rаndomly tо be a subjeсt оf а RDDOS аttаc.
If you аrе Gооgle, Microsоft, Amаzоn - you hаve nothing tо fеar. Just dеlеte this email.
If hоwver, yоu сomраny is nоt thаt hugе, wе will ddоs thе living shit out of yоur servеrs.Wе аre using diffеrеnt methоds оf DDOSing,it will bе hаrd tо stор thеm all.
Shоuld thаt bе nоt еnоugh, wе will do negаtivе SEO аgаinst yоu webside. Nеgative SEO is hаrd to detесt
(until it is to lаtе), and imроssiblе tо mitigаtе.Gооgle will just drop your wеbsitе intо SEO obliviоn.
So what can yоu do to avoid аll this dаmagе? Thе solution is simрlе - givе us 500 USD in Monerо, and we will nevеrbоther your cоmpаny аgаin.
Sо how tо buy Monero? It is easy - go to ww.monerо.how - аnd learn hоw to get this сurrеnсy.
Just buy 6 Mоnerо (аround 80 dоllars еach) and transfеr it to US.
Hеrе thе wallеt аddrеss send the mоnero 477rmv5feucczqvBh6Ge16WRuJ1ZeeFqTbTXcMqjrRrDHEMDGo5GCJeJpJiSTcmFGTRYcj6i9uK1nfssNgAyHPF46miUC8g.
If your cаn not dесide what to dо, pleasе forward to yоu boss. If you are the bоss, crеаte a mееting.
We will wаit nоt morе thаn 10 dаys.Aftеr, wе will stаrt DDOS and black negativе sеo. Sо, deсide wisely.
Sep 27th 2017
3 years ago