Security researchers trace bitcoin haul worth $500,000 from sextortion

Mumbai: Security researchers from Britain-based cybersecurity firm Sophos have traced $500,000 worth of bitcoins extorted from people around the world by sending “porn scam” emails during a period spanning about five months.

Around four per cent of these emails originated from India, making it one of the top 10 sextortion mail source countries, the research showed.

Sextortion is a widely used form of spam attack that accuses the recipient of visiting a pornographic website and threatens to share video evidence with their friends and family unless the recipient pays.

In the examples analysed, recipients were asked to pay up to $800 in bitcoin into designated wallet addresses, SophosLabs said on Thursday.

The researchers traced the origin of millions of sextortion spam emails launched between September 2019 and February 2020 and then analysed what happened to the money deposited by victims in attackers’ bitcoin wallets.

SophosLabs researchers worked with CipherTrace, a cryptocurrency research and tracking platform, to track the flow of the money from these wallets.

They found that the extorted funds were used to support subsequent illicit activity, such as transacting with dark web marketplaces and buying stolen credit card data.

Other funds were quickly moved through a series of wallet addresses to be consolidated, put through “mixers” in an attempt to launder the transactions or converted to cash.

“The cybercriminal underworld is an intricate web and SophosLabs’ research shows how attackers used the money raised in one operation to invest in another,” Tamas Kocsir, a security researcher at SophosLabs who led the research said in a statement.

“Sextortion scams prey on fear and this makes them an effective way of making quick money. Across the five months of our investigation we saw wave after wave of attacks, often taking place over the weekend and sometimes accounting for up to a fifth of all spam tracked at SophosLabs.

“And while most recipients either didn’t open the email or didn’t pay, enough of them did to net the attackers around 50.9 bitcoin, equivalent to nearly $500,000,” Kocsir said.

The scams exploited global botnets on compromised PCs to dispatch millions of spam emails to recipients around the world.

Vietnam, Brazil, Argentina, South Korea, India, Italy, Mexico, Poland, Colombia, and Peru are the top 10 countries where these compromised computers were used to dispatch the spam messages, SophosLabs said.

“Spam campaigns are relatively cheap and easy to implement, but the assumption that this means they are launched only by low-skilled, opportunistic attackers could be inaccurate,” said Kocsir.

“Our research found that some of the scam emails featured innovative obfuscation techniques designed to bypass anti-spam filters. Examples of this include breaking up the words with invisible random strings, inserting blocks of white garbage text, or adding words in the Cyrillic alphabet to confuse machine scanning,” Kocsir said.