Threaten email asking for money and claiming that having installed malware and keylogger

Apr 10 20:31:43 baguette sshd\[647\]: Invalid user ntps from 86.36.20.20 port 2644
Apr 10 20:31:43 baguette sshd\[647\]: Invalid user ntps from 86.36.20.20 port 2644
Apr 10 20:32:20 baguette sshd\[649\]: Invalid user synthing from 86.36.20.20 port 13919
Apr 10 20:32:20 baguette sshd\[649\]: Invalid user synthing from 86.36.20.20 port 13919
Apr 10 20:36:49 baguette sshd\[676\]: Invalid user ubnt from 86.36.20.20 port 38105
Apr 10 20:36:49 baguette sshd\[676\]: Invalid user ubnt from 86.36.20.20 port 38105
...

SSH invalid-user multiple login try

Unauthorized connection attempt detected from IP address 110.136.207.150 to port 23 [T]

Invalid user noc from 159.89.123.167 port 57616

Apr 10 20:13:29 srv01 sshd[23588]: Invalid user debian from 181.30.28.201 port 50300
Apr 10 20:13:29 srv01 sshd[23588]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.30.28.201
Apr 10 20:13:29 srv01 sshd[23588]: Invalid user debian from 181.30.28.201 port 50300
Apr 10 20:13:31 srv01 sshd[23588]: Failed password for invalid user debian from 181.30.28.201 port 50300 ssh2
Apr 10 20:18:11 srv01 sshd[23831]: Invalid user ubuntu from 181.30.28.201 port 57344
...

Apr 10 20:29:52 game-panel sshd[19814]: Failed password for root from 172.81.247.185 port 41696 ssh2
Apr 10 20:33:11 game-panel sshd[19987]: Failed password for root from 172.81.247.185 port 40236 ssh2

From: Clim Muir 
Sent: Friday, April 10, 2020 12:22 PM
To: osmon503@msn.com 
Subject: osmon503 : jager503
 
I'mkaware,wjager503,Nisnyourypassword.KYouGmayjnotJknowume,JandAyouwareOmostrlikelyjwonderingYwhyYyou'rergettingLthisimail,dright?O 

Overview: 

IiinstalledmaVmalwarenonZthegadultzvidsz(sexhsites)zsite,wandnthere'sAmore,iyourvisitedUthisIsiteTtoqhaveNfunC(youUknowHwhatFIrmean).fOncebyoutwereptherehonitheXwebsite,TmypmalwareVtookmcontrolBofMyourhbrowser.wItQstartedroperatingsasaaUkeyloggerEandJremoteMdesktopRprotocolqwhichxgaveRmemaccessvtoEyourlwebcam.CImmediatelyYafterWthat,AmyxsoftwarencollectedayourUcompletexcontactsOfromsyourRMessenger,oFB,Handvemail.GWIscreatedxaedouble-screenhvideo.hFirstjparthshowsxtheavideoNyouWweretwatchingh(youEhaveDaGgoodstastenlolG.D.p.),eandLtheHsecondQpartqdisplaysgtheBrecordingQofoyourrwebcam.E 

PreciselyHwhatsshouldQyouxdo? 

Well,nIJbelieve,M$1900ZisJaMfairPpriceKforBourGlittlersecret.pYoucwillmmakexthecpaymentZthroughdBitcoinE(ifJyoufdon'tgknowPthis,qsearchq"howVtolbuyAbitcoin"MinqGoogle).U 

BTCGAddress:g 
bc1q5hlwwkp395vn783g0zettcxxgew0n7u3q757uv 
(ItnisQcaseAsensitive,BsoQcopymandjpasteait) 

Note: 

YouOhaveioneVdayltoemakeCtheJpayment.c(I'vezaOspecificKpixelVwithinuthisOmessage,pandPnowjIgknowzthatsyouWhaveEreadZthroughQthisBemail).kIfFIndoNnotWreceiveCtheEpayment,tIswillgsendLyourKvideorrecordingAtonallXofHyourgcontacts,XincludingHyourdrelatives,Fandfcolleagues.sHowever,wifLITdoegetTpaid,BtheivideokwillObeKdestroyeddimmediately.iIfxyouwneedAevidence,Ireplyxwiths"Yes!"qandIIwdefinitelyawillTsendMyourLvideoirecordingytoYyoura10Lcontacts.iThispisqaonon-negotiableOoffer.fPleaseudon'tZwastezmySpersonalxtimeFandSyoursAbyjreplyingJtocthisqemail. 

Clim

Apr 10 20:22:55 mail1 sshd\[15478\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.232.55.161  user=root
Apr 10 20:22:58 mail1 sshd\[15478\]: Failed password for root from 49.232.55.161 port 51314 ssh2
Apr 10 20:36:44 mail1 sshd\[21245\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.232.55.161  user=root
Apr 10 20:36:45 mail1 sshd\[21245\]: Failed password for root from 49.232.55.161 port 40070 ssh2
Apr 10 20:42:04 mail1 sshd\[23655\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.232.55.161  user=root
...

Unauthorized connection attempt detected from IP address 117.7.184.71 to port 22

Apr 10 22:31:46 markkoudstaal sshd[24525]: Failed password for root from 196.44.236.213 port 34656 ssh2
Apr 10 22:36:52 markkoudstaal sshd[25235]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.44.236.213
Apr 10 22:36:54 markkoudstaal sshd[25235]: Failed password for invalid user user from 196.44.236.213 port 40606 ssh2

Port probing on unauthorized port 41197

Apr 10 19:26:01 localhost sshd\[8708\]: Invalid user admin from 51.178.82.80
Apr 10 19:26:01 localhost sshd\[8708\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.178.82.80
Apr 10 19:26:03 localhost sshd\[8708\]: Failed password for invalid user admin from 51.178.82.80 port 40228 ssh2
Apr 10 19:29:47 localhost sshd\[8936\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.178.82.80  user=root
Apr 10 19:29:49 localhost sshd\[8936\]: Failed password for root from 51.178.82.80 port 48446 ssh2
...

Apr 10 22:29:31 pve sshd[3610]: Failed password for root from 213.35.252.130 port 43836 ssh2
Apr 10 22:33:08 pve sshd[4329]: Failed password for root from 213.35.252.130 port 51856 ssh2

Automatic report - Port Scan Attack