Ukraine War: Email with Blackmail Attempts

If you receive an email like this, don't let it panic. The names and addresses contained in the email were most likely stolen. The fact that photos, videos and chat histories are also in the hands of criminals is very likely a lie. What you should definitely not do is respond to these emails or click on a link or generally comply with the requests. Instead, file a police report.

The email verbatim(sic!)

Hello (first name),
you are probably wondering what the subject of this email means. I would like to briefly explain it to you.
When the war started here in Ukraine, we started infecting a very large number of devices with our RAT (virus).
As you can probably imagine, your devices have also been infected by us. This gives us full access to all your devices, we can see everything you see, we also see everything you do.
So we have collected a lot of information about you over the past few months.
A small excerpt of our information, your name is (FIRST NAME LAST NAME), you live in (ZIP CITY) and your address is: (ADDRESS) We have all the information we could find, such as:
B. Chat histories, messages, photos, images, documents, etc. are saved, and we have also saved all of your contacts. Our virus is designed to automatically detect if the device is being used to visit a porn site, and once it does, it will automatically start video recording, screen recording and audio recording.
You know best how often you have masturbated, so we have a bunch of videos of you, in all the videos you can see how you masturbate, you can see everything, you can hear everything.
You can also see which video you have watched. I think you don't want us to send all these videos to your friends and acquaintances. Imagine what would happen if everyone you know saw all these videos.
If you do not respond to our request, this is exactly what will happen, we will forward the many videos we have to all the contacts we have saved for you.
We will publish all videos on every porn site we know of, and we will publish all the information we have collected from you on the dark web so that your data can be used for fraud, identity theft, etc. When this email was opened, a timer started. From now on you have exactly 96 hours to send €1500 in Bitcoins to my Bitcoin wallet. If that doesn't happen, everything will be published.
We will forward all video recordings of you to all your contacts, family, friends etc.
In addition, all videos will be published on all prono sites and all stored data will be published on the darknet. My Bitcoin wallet is: 19…………………………..
If you don't know how to buy Bitcoins, just go to Google and search for How to Buy Bitcoins or How to Buy Bitcoins.
Alexandra, if you think the police can help you, then you are mistaken, we live in a war zone, nobody here is interested in what we do.
Don't forget that we have full access to all your devices. So we know that if you go to the police or try something else, everything will be published straight away.
We need the money very urgently here in the war zone, so transfer the Bitcoins so we can both move on with our lives. As soon as we have received the money, the virus will be deleted from your devices, we will delete all information and the many videos and you will never hear from us again.
It is known that we Ukrainians are a proud people, so you can be sure that we will always keep our word. So if you pay, you have nothing to fear and you will never be asked higher by us again. If you don't pay, we will make your life a living hell.

Where does this personal data come from?

consumer advice center has already asked itself this question, but cannot answer it exactly. But there are a few conceivable possibilities:

• The data was collected from address books by malicious apps. Such apps are currently often distributed via smishing: dubious SMS messages in which, for example, a package is announced, which informs about an alleged new voice message or reports alleged problems with online banking.
• The data comes from hacked company databases.
• The data was purchased from address traders on the dark web.
• The data was collected from public sources (e.g. social media profiles). We generally recommend that you do not provide publicly visible information such as email address, telephone number and date of birth on social media.

If you have received such an email, please respond as follows:

• Under no circumstances should you pay for such digital blackmail attempts!
• You should also not respond to such an email. This would show that you are actively using your email address. As a result, more spam and phishing emails usually come.
• Do not tap or click on a link! This also applies to the term “unsubscribe” at the bottom of the email, which gives the impression that you can unsubscribe from a mailing list. This would also primarily confirm the active use of your email address. In addition, such links often lead to a fraudulent website whose source code could contain a malicious program.
• Report it to the police, because even if the allegations are unfounded, this is an attempt at blackmail. You can, for example, file a report via the online police station in your federal state.

Please also read:
“Your account has been hacked”: Warning about blackmail attempts by email