Are Sextortion Spammers Making Money?

Summary of a research that uncovers the sextortion spamming scheme

This week, our cybersecurity researcher presents the Spams meet Cryptocurrencies: Sextortion in the Bitcoin Ecosystem research results, at the Advances in Financial Technologies (AFT) academic conference in Zürich. This research, also covered by the MIT technology review, is extensive: it involves an analysis of over 4 million sextortion spams and their associated payments in the Bitcoin ecosystem, to estimate the lower-bound revenue of this new extortion scheme. The research was completed in collaboration with Matteo Romiti and Bernhard Haslhofer from the Austrian Institute of Technology and Tomáš Charvát from VirusFree. The blog post below is a quick review of the main research findings.

Credit: teguhjatipras & mohamed_hassan from Pixabay

Basically, sextortion spams aim at extorting money from spam recipients with the threat that compromising photos or videos will be sent to the recipients’ contacts if an amount, asked in Bitcoin, is not paid. An example of such a spam is presented below (reproduced “as is”, mistakes and wording kept for authenticity) :

I know *** one of your pass word. […] Well, I actually installed a malware on the adult videos (porno) site and do you know what, you visited this web site to have fun (you know what I mean). When you were watching video clips, your browser started out working as a Remote control Desktop that has a key logger which provided me access to your display and web cam. after that, my software gathered all of your contacts from your Messenger, Facebook, and email . […] You get two different choices. […]: 1st solution is to dismiss this message. In this instance, I will send your actual video recording to just about all of your personal contacts […]  Number two solution should be to compensate me $1000. […]  You will make the payment via Bitcoin (if you do not know this, search for « how to buy bitcoin » in Google). BTC Address to send to: 1GYfPNat1uQzrBBKTzftMtZ5TgzNdNmTL9

Classifying over 4 million of these spams into 35 specific campaigns and tracing their transactions in the bitcoin ecosystem, the main conclusions are that spam sextortion is not quite sophisticated, yet it represents a lucrative and cost-effective business.

Not Quite Sophisticated

Spammers sent the emails via the Necurs botnet. To find emails and their related passwords, they obtained data leaks and pastes already available online. Indeed, with a list of 632,688 unique cleartext passwords found only once in the email dataset (to avoid passwords such as 12345), 25% of them were randomly selected to see if they could be found in 21 publicly available data breaches (e.g., MySpace, Linkedin, Twitter, Yahoo, 665KK). More than half (51%) of the passwords in the dataset were found within these existing breaches.

The basic structures of sextortion spams are always very similar, with little variations in the phrasing or the threat. Indeed, using clustering heuristics out of the four million spams investigated, 35 specific campaigns were found (all sent in various languages). The distinctive features of the first 15 are presented in Table 1 below.

Table 1 – Key Distinctive Features for Each Campaign

For example, Campaign D’s distinctive feature is that the attacker is a member of an international hacking group, while campaign G states that the attacker is known on the « DarkNet ». Beyond these features, the threat is always the same: pay a certain amount in bitcoin or compromising information will be sent to your contacts. The spam messages are always filled with English spelling mistakes and syntax issues.

The spammers do not seem to attempt to refine their deceptive scheme: they reuse bitcoin addresses across spamming campaigns and regardless of the language in which the spam is sent. By reusing these addresses, they cannot assess which campaign is most successful or which language yields most payments. Moreover, in terms of pricing strategy, they do not ask for higher ransoms for spams in which a password or a phone number was mentioned (usually provided in data leaks or pastes). This is surprising: such information could be considered valued and worthy enough for asking higher amounts.

The only sophistication found in the scheme is related to the pricing strategy regarding the language in which the spams are sent. Spammers ask for higher ransom amounts (based on pairwise t-tests) for spams sent in English, Slovenian and Korean and for lower amounts for spams sent in Polish, Italian and Spanish, regardless of the campaign, as shown in Figure 1.

Figure 1 – Average amounts asked per Language and per Campaign

lucrative and cost-effective business

Although not quite sophisticated, sextortion spams seem to be a lucrative business. Indeed, filtering out unrelated transactions, the research shows that sextortion spammers generated a lower-bound revenue of $1,300,620 for an 11-month period, representing approximately a minimum revenue of $122,933 per month. Revenues from traditional spams (i.e. dating sites, pharmaceutical or counterfeit products), on the other hand, were found to range from $3.5 million to $12 million per year. Sextortion spam may thus, at first, seem less profitable than traditional spam campaigns.

Yet, traditional spamming requires far more logistics, in terms of operations: once a spam has reached an inbox, traditional spammers usually have to orchestrate and plan an elaborated operation to avoid URL and domain blacklisting, as well as Website take downs by Internet Service Providers (ISPs) and registrars. Moreover, they have to provide reliable payment processes and banks that will accept to receive such payments (for more details on the operations that traditional spammers have to go through, see Levenchenko et al., 2011).

Sextortion spammers, on the other hand, are involved in a much simpler scheme: they only have to send spams that are somewhat convincing and hope that email recipients will pay the ransom. The process requires the use of a botnet, a credible threat and some bitcoin addresses. Sextortion spammers do not have to face the costs associated to the upper-end of the spam supply chain. Avoiding these intrinsic costs make their business simple, cost-effective and thus, lucrative.

Unlikely to stop

Considering how cost effective the business is, the threat is unlikely to stop. Instead, those behind these schemes will evolve and develop new strategies and potentially try new cryptocurrencies that are less traceable. The anti-spam community should focus on preventing these spams reaching users’ inboxes, by tagging messages that include cryptocurrency addresses, sextortion wording, and that come from IP addresses that are known to be part of botnets.

To read the entire story, see the Spams meet Cryptocurrencies: Sextortion in the Bitcoin Ecosystem paper.