SophosLabs Report is First to Trace Sextortion Bitcoin Haul

OXFORD, U.K. — avril 22, 2020 —

 Sophos, a global leader in next-generation cybersecurity, today published a SophosLabs article, Following the Money in a Massive “Sextortion” Spam Scheme, that shows how the funds extracted from victims led to an underbelly of cybercriminal activity. Researchers traced the origin of millions of sextortion spam emails launched between September 2019 and February 2020 and then analysed what happened to the money deposited by victims in attackers’ bitcoin wallets. The bitcoin extorted from the scams totalled approximately $500,000. SophosLabs believes this report is the first to trace a bitcoin haul from sextortion.

Sextortion-Spam

 

Sextortion is a widely used form of spam attack that accuses the recipient of visiting a pornographic website and threatens to share video evidence with their friends and family unless the recipient pays. In the examples analysed, recipients were asked to pay up to $800 in bitcoin into designated wallet addresses.

SophosLabs researchers worked with CipherTrace to track the flow of the money from these wallets. They found that the extorted funds were used to support subsequent illicit activity, such as transacting with dark web marketplaces and buying stolen credit card data. Other funds were quickly moved through a series of wallet addresses to be consolidated, put through “mixers” in an attempt to launder the transactions or converted to cash.

“The cybercriminal underworld is an intricate web and SophosLabs’ research shows how attackers used the money raised in one operation to invest in another,” said Tamás Kocsír, a security researcher at SophosLabs who led the research. “Sextortion scams prey on fear and this makes them an effective way of making quick money. Across the five months of our investigation we saw wave after wave of attacks, often taking place over the weekend and sometimes accounting for up to a fifth of all spam tracked at SophosLabs. And while most recipients either didn’t open the email or didn’t pay, enough of them did to net the attackers around 50.9 bitcoin, equivalent to nearly $500,000.”

The scams exploited global botnets on compromised PCs to dispatch millions of spam emails to recipients around the world. Vietnam, Brazil, Argentina, the Republic of Korea, India, Italy, Mexico, Poland, Colombia, and Peru are the top 10 countries where these compromised computers were used to dispatch the spam messages, of which 81% were in English, 10% were in Italian, 4% were in German, 3.5% were in French, and 1.2% were in Chinese.

“Spam campaigns are relatively cheap and easy to implement, but the assumption that this means they are launched only by low-skilled, opportunistic attackers could be inaccurate,” said Kocsír. “Our research found that some of the scam emails featured innovative obfuscation techniques designed to bypass anti-spam filters. Examples of this include breaking up the words with invisible random strings, inserting blocks of white garbage text, or adding words in the Cyrillic alphabet to confuse machine scanning. These are not beginner techniques and they are a good reminder that spam attacks of any kind should be taken seriously. A robust approach to cybersecurity is essential. If you are worried about becoming the target of a sextortion scam, disable or cover the camera on your computer.”

For additional information, please reference the SophosLabs Uncut article.

For additional perspective on this story go to Naked Security.

À propos de Sophos

Sophos est un leader mondial et un innovateur dans le domaine des solutions de cybersécurité avancées, qui comprend des services managés de détection et réponse (MDR) et de réponse aux incidents, ainsi qu’un vaste portefeuille de technologies de sécurité qui protègent les systèmes endpoint, les réseaux, les messageries et le Cloud contre les cyberattaques. Sophos est l’un des plus grands fournisseurs de cybersécurité et protège aujourd’hui plus de 500 000 entreprises et plus de 100 millions d’utilisateurs dans le monde contre les adversaires actifs, les ransomwares, le phishing, les malwares, etc. Les services et produits de Sophos sont connectés à travers sa console d’administration Sophos Central basée dans le Cloud et sont alimentés par Sophos X-Ops, l’unité de renseignement sur les menaces transversale de la société. L’intelligence de Sophos X-Ops optimise l’ensemble de l’écosystème de cybersécurité adaptatif (ACE) de Sophos, qui comprend un datalake centralisé exploitant un ensemble riche d’API ouvertes à destination des clients, des partenaires, des développeurs et des autres fournisseurs de cybersécurité et de technologies de l’information. Sophos fournit des services de cybersécurité aux entreprises qui ont besoin de solutions de sécurité clés en main et entièrement gérées. Les clients peuvent également gérer leur cybersécurité directement avec la plateforme d’opérations de sécurité de Sophos ou utiliser une approche hybride en complétant leurs équipes internes avec les services de Sophos, notamment la chasse aux menaces et la remédiation. Sophos vend ses produits par l’intermédiaire d’un réseau mondial de partenaires et de fournisseurs de services gérés (MSP : Managed Service Provider). Le siège de l’entreprise est basé à Oxford, au Royaume-Uni. Plus d’informations sont disponibles sur www.sophos.fr.