Reported to the Internet Storm Center (https://isc.sans.edu) as a blackmail campaign

Hello my nickname in darknet is P4nd3r0 Ill begin by saying that I hacked this mailbox (please look on from in your header) more than six months ago, through it I infected your operating system with a virus (trojan) created by me and have been monitoring you for a long time._x000D_ Send the above amount on my bitcoin wallet: 13VQu3vDixov5jV1zi4GCJgfrzsuwD29hK

Alleged ransomware email came in to two company accounts. Said he had their passwords and had recorded users browsing the web as well as screen capture. _x000D_ Sender spoofed the email to make it look like it came from us. Review of MS Exchange audit showed no such thing. Verified that there has been no unauthorized access to this account._x000D_ _x000D_ Also - no webcam. So... yeah..._x000D_ _x000D_ Demand was $800.

Same as other comments. Threatens that s/he hacked my computer and has access to passwords to all accounts, social networks, email, etc. Need to pay $800 so that s/he doesnt release dirt on me. I have 24 hours.

Ill begin by saying that I hacked this mailbox (please look on from in your header) more than six months ago, through it I infected your operating system with a virus (trojan) created by me and have been monitoring you for a long time. _x000D_ <...>_x000D_ _x000D_ I think that you do not want all your contacts to get these files, right?_x000D_ If you are of the same opinion, then I think that $800 is quite a fair price to destroy the dirt I created._x000D_ _x000D_ Send the above amount on my bitcoin wallet: 13VQu3vDixov5jV1zi4GCJgfrzsuwD29hK _x000D_ As soon as the above amount is received, I guarantee that the data will be deleted, I do not need it._x000D_ _x000D_ Since reading this letter you have 24 hours!_x000D_ After your reading this message, Ill receive an automatic notification that you have seen the letter._x000D_ _x000D_ I hope I taught you a good lesson._x000D_ Do not be so nonchalant, please visit only to proven resources, and dont enter your passwords anywhere!_x000D_ _x000D_ Police or friends wont help you for sure ..._x000D_ _x000D_ Good luck!

$800 - hacked my account and has access to all your accounts, social networks, email, browsing history

... Even if you changed the password after that - it does not matter, my virus intercepted all the caching data on your computer and automatically saved access for me._x000D_ _x000D_ I have access to all your accounts, social networks, email, browsing history. Accordingly, I have the data of all your contacts, files from your computer, photos and videos._x000D_ _x000D_ I was most struck by the intimate content sites that you occasionally visit. You have a very wild imagination, I tell you!_x000D_ _x000D_ During your pastime and entertainment there, I took screenshot through the camera of your device, synchronizing with what you are watching. Oh my god! You are so funny and excited!_x000D_ _x000D_ I think that you do not want all your contacts to get these files, right?_x000D_ If you are of the same opinion, then I think that $800 is quite a fair price to destroy the dirt I created._x000D_ _x000D_ Send the above amount on my bitcoin wallet: 13VQu3vDixov5jV1zi4GCJgfrzsuwD29hK _x000D_ ...

Concur with all comments below.

Hello my nickname in darknet is P4nd3r0 Ill begin by saying that I hacked this mailbox (please look on from in your header) more than six months ago, through it I infected your operating system with a virus (trojan) created by me and have been monitoring you for a long time.

Hello my nickname in darknet is P4nd3r0 Ill begin by saying that I hacked this mailbox (please look on from in your header) more than six months ago, through it I infected your operating system with a virus (trojan) created by me and have been monitoring you for a long time_x000D_ _x000D_ Send the above amount on my bitcoin wallet: 13VQu3vDixov5jV1zi4GCJgfrzsuwD29hK

P4nd3r0 probably got into 5.158.69.181s network and is using their SMTP server to relay these emails. _x000D_ https://www.shodan.io/host/5.158.69.181#443

The email came from IP address: 5.158.69.181. This is what I consider the bluff/blackmail variety of ransomeware.

Same for me, ive got the email. How are you sure that he didnt get your data ?

Wanted $800 to some bitcoin wallet.

Ransomeware hit our corporate email.