A new spam campaign is underway that pretends to be from a group called the "WannaCry-Hack-Team" that states the infamous WannaCry Ransomware has returned, the recipients computer is infected, and they need to send some bitcoins or their files will be deleted. This is nothing more than WannaSpam, there is nothing wrong with your computer, and the email should simply be tossed into the trash where it belongs.

WannaSpam Example
WannaSpam Example

These emails started appearing yesterday, June 21st 2018, where I saw it for the first time on Reddit when a poster was concerned it was real. These emails are coming in using different variations of the same subject such as "!!!Attantion WannaCry!!!", !!!WannaCry-Team Attantion!!!", "Attantion WannaCry", "WannaCry Attantion!", or "WannaCry-Team Attantion!!!". Yes, the "Attantion" word is spelled that way in the emails.

These emails state that WannaCry has returned, the recipients devices were infected with malware, and that the recipients data will be deleted June 22, 2018 between 5:00 - 10:00 PM unless they send .1 bitcoins to a listed bitcoin address. After a payment has been made they are told to email support_wc@bitmessage.ch.

The bitcoin addresses that I have seen included in the spam emails are 1Mvz5SVStiE6M7pdvUk9fstDn1vp4fpCEg16Tq8gaad5FJ3c6mrC86e1pmqQ666dYSvv, 13AEiPcnqHRRwbJRUsPLbcgX3roTTPGSMu, 15TxgGK5AMvdeupbcKbk3g36zctnS9ThnU, and 1FXZ9yoagBMnnrkZscQzKnC2hkgX5uDgUR. Thankfully, nobody has fallen for this scam as of yet and sent the scammers any bitcoins.

The full text of this spam email is below:

From: WannaCry-Hack-team [redacted]
Sent: 21 June 2018 10:36
To: [REDACTED]
Subject: WannaCry Attantion!

Hello! WannaCry returned! All your devices were cracked with our program installed on them. We have made improvements for operation of our program, so you will not be able to regain the data after the attack.

All the information will be encrypted and then erased. Antivirus software will not be able to detect our program, while firewalls will be impotent against our one-of-a-kind code.

Should your files be encrypted, you will lose them forever.

Our program also outspreads through the local network, erasing data on all computers connected to the network and remote servers, all cloud-stored data, and freezing website operation. We have already deployed our program on your devices.

Deletion of your data will take place on June 22, 2018, at 5:00 - 10:00 PM. All data stored on your computers, servers, and mobile devices will be destroyed. Devices working on any version of Windows, iOS, macOS, Android, and Linux are subject to data erasion.

In order to ensure against data demolition, you can pay 0.1 BTC (~$650) to the bitcoin wallet:1Mvz5SVStiE6M7pdvUk9fstDn1vp4fpCEg

You must pay in due time and notify us about the payment via email until 5:00 PM on June 22, 2018. After payment confirmation, we will send you instructions on how to avoid data erasion and such situations in future. In case you try to delete our program yourself, data erasion will commence immediately.

To pay with bitcoins, please use localbitcoins.com or other similar services, or just google for other means. After payment write to us: [support_wc@bitmessage.ch](mailto:support_wc@bitmessage.ch)

So if you receive one of these emails just hit the delete button. There is nothing wrong with your computer, WannaCry has not returned, your files will not be deleted, and this is just a scam.

Related Articles:

Fake Elon Musk Twitter Bitcoin Scam Earned 180K in One Day

Necurs Botnet Distributing Sextortion Email Scams

Compression File Formats of the past Come Haunting in Spam Campaigns

Sites Trick Users Into Subscribing to Browser Notification Spam