제로데이 취약점을 이용해 정보 빼갔으니 돈 달라고 메일이 왔는데요.

7월 5, 15일 두 차례에 걸쳐 메일이 왔더라구요.

15일에 온 거 몇 시간 전에 먼저 보고 5일에도 왔다는 걸 메일목록 검색하고 알았습니다.

내용은 아래와 같아요.

I am sorry to inform you that your device was compromised.

I'll explain what led to all of this. I have used a Zero Day vulnerability with a special code to infect your device through a website.

This is a complicated software that requires precise skills that I have. It works as a chain with specially crafted and unique code and that’s why this type of an attack can go undetected.

You only need one not patched vulnerability to be infected, and unfortunately for you – it works that simple.

You were not targeted specifically, but just became one of the quite a few unlucky people who got hacked that day.

All of this happened a few month ago. So I’ve had time to collect information on you.

I think you already know what is going to happen next.

During that time, my software was quietly collecting information about your habits, websites that you visit, searches you do, texts you send.

There is more to it, but I have listed a few reasons for you to understand how serious this is.

For you to clearly understand, my software controlled your camera and microphone as well and it was impossible for you to know about it.

It was just about right timing for me to get you privacy violated.

I’ve been waiting enough and have decided that it’s time to put an end to this.

So here is my offer. I need a consulting fee to delete the media content I have been collecting.

Your privacy stays untouched, if I get paid.

Otherwise, I will leak the most damaging content to your contacts and post it to a public tube for perverts to explore.

I understand how damaging this will be for you, and amount is not that big for you to keep your privacy.

Please dont blame me – we all have different ways of making a living.

I have no intention of destroying your reputation or life, but only if I get paid.

I don’t care about you personally, that's why you can be sure that all files I have and software on your device will be deleted immediately after I receive the transfer.

I only care about getting paid.

My modest consulting fee is 1650 US Dollars transferred in Bitcoin. Exchange rate at the time of the transfer.

You need to send that amount to this wallet: 17z8ACS2tJouyxuoqEBoDDmaEZzFTzQg1Z

The fee is non negotiable, to be transferred within 2 business days.

We use Bitcoin to protect my identity.

Obviously do not try to ask for any help from anybody unless you want your privacy to be violated.

I will monitor your every move until I get paid. If you keep your end of the agreement, you wont hear from me ever again.

Take care.

내용은...

제로데이 취약점을 이용해 웹사이트를 통해 너의 디바이스를 감염시켰다.

노리고 해킹한 건 아닌데 재수없게 걸린 거다.

이미 몇달 전부터 개인정보 빼갔다.

이틀 안에 미화 1650 달러를 비트코인으로 보내라.

안 그럼 치명적인 내용들을 주변 사람들에게 유출하고 및 공개적으로 올릴 것이다.

대충 이런 내용인데요.

처음엔 약간 긴장했는데...

(오피스365 계정 관련해서 알 수 없는 표시가 떠서 비번 변경하고 나서 보는 바람에 같이 연관되어 있는 걸로 잘못 알았네요. 그래서 순간 긴장... 알고 보니 메일 오고 몇 시간 지난 후에 계정 비번 변경한 거라 무관하다는 거 확인했네요.)

https://www.etnews.com/20210216000144?m=1

링크 뉴스 보면 제로데이 취약점 공격이 이메일 보내서 메일 안에 있는 링크 클릭하면 걸려드는 수법인데,

저는 그런 건 아예 쳐다도 안 보기에 더 더욱 호구 얻어 걸리게 할 목적으로 보낸 메일 같다는 생각이 듭니다.

이런 거 받아 보신 분들 있지 않으신가요?

보아하니 얻어 걸리길 바라고 무작위로 보내는 거 같은데...

다음메일인데 유난히 다음메일로 이런 스팸메일이 많이 오더라구요.

네이버메일은 좀 덜한데...

이거 붙잡고 씨름하느라 공부해야 하는데 다 날려  먹었네요.ㅠ