Help - RansomWare Attack Notification Received

The extortion email received today (3 Dec. 2018) Spoofed my email address and emailed me through my email account (i.e. my email account sent an email to itself)


The e-mail stated: Quote

I have very bad news for you. 09/08/2018 - on this day I hacked your OS and got full access to your e-mail account.

In the software of the router, through which you went online, was a vulnerability. I just hacked this router and placed my malicious code on it.

When you went online, my trojan was installed on the OS of your device.


After that, I made a full dump of your disk (I have all your address book, history of viewing sites, all files, phone numbers and addresses of all your contacts).


The email went onto ask for $750 in Bitcoins, with 48 hours to make the payment. While stating

If I do not receive from you the specified amount, then your device will be locked.”

End Quote



What I did

I did a HD scan using the protection online server of the software I use and that showed no threats were found during the scan.


I changed the Router name and password. I was unable to change the admin password at this stage.

The I.P. is sending an engineer tomorrow as they couldn’t access the Router remotely.


I cleaned the Mac DNS cashe.


I found that although the sender e-mail address was my own, the Received IP address and dynamic IP in the e-mail source code shows Saratov, Saratovskaya Oblast, Russia.


I am unsure whether this is actually just a spoofed e-mail or an actual attack on the router and my Mac.I am also unsure whether any attempt to make a
Time Machine backup would infect the external HD as well as the backup.


Any ideas for action I can take would be welcome.


MacBook Pro with Retina display, MacBook 2010 and original iPad

Posted on Dec 3, 2018 1:36 PM

Reply

Similar questions

16 replies

Dec 3, 2018 2:22 PM in response to Memoire

Memoire wrote:


One further worry I had was that since I opened the phishing e-mail I have had trouble accessing Google Translate


When I try to Access Google translate I get an error page.

https://translate.google.com/

This site can’t provide a secure connection

translate.google.com sent an invalid response.


ERR_SSL_PROTOCOL_ERROR


I have cleared the browser cashe and the computers DNS cashe but get the same result.

I am using Google Chrome Version 70.0.3538.110 (Official Build) (64-bit)

The same result was obtained in Safari and Opera.


Would welcome any advice or feedback on what this issue could be, I have been concerned if this was related to the phishing e-mail as it seems unlikely Google would be unable to make a secure connection.



That error can arise if various anti-virus and anti-malware packages have been installed. Those packages intercept and sometimes even compromise network connections. That error can also arise if you're running an old version of macOS, though that Chrome 70.0.3538.110 version implies you're probably running a fairly recent version of macOS.


If you have anti-malware or anti-virus or an ad-blocker installed, disable that per the vendor instructions, reboot, and try again.

Dec 3, 2018 2:05 PM in response to stedman1

One further worry I had was that since I opened the phishing e-mail I have had trouble accessing Google Translate


When I try to Access Google translate I get an error page.

https://translate.google.com/

This site can’t provide a secure connection

translate.google.com sent an invalid response.


ERR_SSL_PROTOCOL_ERROR


I have cleared the browser cashe and the computers DNS cashe but get the same result.

I am using Google Chrome Version 70.0.3538.110 (Official Build) (64-bit)

The same result was obtained in Safari and Opera.


Would welcome any advice or feedback on what this issue could be, I have been concerned if this was related to the phishing e-mail as it seems unlikely Google would be unable to make a secure connection.






Dec 3, 2018 2:28 PM in response to MrHoffman

Thank you for your reply MrHoffman, much appreciated.

I haven't changed anything with the anti-virus or an ad-blocker and Google Translate worked well before, all other websites seem to be fine such a Bing Translate. It kind of jingled my nerves since this issue with Google Translate only occurred after receiving the ransomware e-mail.
I will follow your advice and see if that can resolve the issue - thank you.

Dec 3, 2018 2:38 PM in response to MrHoffman

Thank you very much for the reply regarding the ransomware e-mail.

The e-mail was deleted immediately after copying the source code.

I cleared the DNS cashe in relation to the issue with Google Translate, I had also read online today this is the action relates to a ransomware attack.


I was wondering what you meant by:

MrHoffman wrote:

Your response has caused a larger problem here, unfortunately.

as I wondered if I have made some mistake?

Dec 3, 2018 1:50 PM in response to Cåts

Thank you for the verification Cats, grateful for your reply.


What I am still keen on doing is changing the admin password for the Router, which seems to be locked by the IP, I guess they keep it locked so that they can update software - something else I will ask the Tech guy when he visits tomorrow is if the software is up-to-date.


I had no intention of paying as this would only motivate whoever to continue giving people a boost in heart rate.

Dec 3, 2018 2:13 PM in response to Memoire

Delete the message. It's an empty threat.


Deleting a DNS cache only slows down translations, and it'll get repopulated.


Changing an SSID is unnecessary, as those are readily scanned for if somebody in the area cares to find one, and the SSID is not relevant for remote access. WPA2 with a long password is recommended, but that's a general comment and not related to this mail message.


It's trivial to spoof the source address of a mail message. Pretty much anything in an arriving mail message is suspect, and it's common for folks to try to gain access through attachments or through social engineering. Such as this message.


The originating mail server may or may not be related to this. It's routine for spammers to use what are called open-relay mail servers, and to use compromised mail clients, and to use compromised mail server credentials, to send out spam.


Various folks shilling anti-malware, anti-virus, cache-cleaners, network monitoring firewalls or other add-on packages use similar tactics; scaring folks into installing stuff that's often unnecessary, and sometimes scaring folks into installing the actual malware.


Your response has caused a larger problem here, unfortunately.

Dec 3, 2018 2:39 PM in response to Memoire

If you made the backup before you received the email, then no, the external will be fine. You can restore whatever you need. Erase and reinstall is really not necessary, but it will wipe out everything (good and bad). However, I would consider changing my email address since yours appears to have been stolen/bought/hacked into.


And, there is really no need for an antivirus app - they can cause problems and false positives. I'd uninstall it. I also stay away from anything Google since I do not agree with their corporate policies of selling customers' information.

Dec 3, 2018 2:43 PM in response to Memoire

Remove the anti-virus, anti-malware and ad-blocking tools as a test, reboot, and try your access.


Various of these packages have a long history of causing problems and instabilities and crashes, and of actually introducing security vulnerabilities, and of not particularly solving its intended purpose.


Some of these add-on security packages are poorly designed and coded, and insecure. Some are outright scams.


But in any case, please remove the packages as a test, reboot, and try accessing Google Translate again.


Network connection security downgrades are a very common problem with some of these add-on packages.


Here's a short write-up on macOS security that might be helpful here:


https://discussions.apple.com/docs/DOC-8841


As discussed in that security write-up and elsewhere, backups are one of the more important parts of system integrity and security, too. Your backups are your path to recovery from a breach, as well as recoveries from equipment loss, equipment damage, and from the inevitable hardware failures.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Help - RansomWare Attack Notification Received

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.