A remarkably small number of cybercriminals are reportedly responsible for all the world’s email extortion attempts, new research has claimed.
Security firm Barracuda Networks, in partnership with Columbia University, looked at over 300,000 emails in a one-year period that the company’s AI detectors had flagged as extortion attacks, and found that the vast majority were the work of only a few attackers, relatively speaking.
The findings were estimated by checking the addresses of the bitcoin wallets written in the emails, as this is the preferred way cybercriminals wish to be paid by their victims, since there are no questions asked about the identities or legality of transactions in the realm of cryptocurrency.
Bitcoin payments
The research found that only 100 bitcoin addresses appeared in about 80% of all the emails.
The report’s author, Columbia Master’s student Zixi (Claire) Wang, noted that the number of Bitcoin addresses doesn’t necessarily equate to the number of attackers; the real figure is likely, “fewer than 100 attackers, and probably an even smaller number than that, assuming attackers use multiple bitcoin addresses.”
The money requested in these attacks was also quite low, with a quarter of emails asking for less than $1,000 and over 90% less than $2,000. Wang speculated that this is because victims are more likely to payout lower amounts and less likely to investigate the legitimacy of the compromise (often attackers merely talk a good game without hacking anything). The low amounts would also not “raise alarms with the victim’s bank or tax authorities.”
Bitcoin was the only cryptocurrency used by the attackers in the dataset, and Wang reckoned that this was because “Bitcoin is largely anonymous, transactions use wallet addresses, and anyone can generate as many wallet addresses as they would like.”
The types of scams that the attackers run involve claims that they have ascertained compromising photos or videos of their target, via the hacking of their device’s camera, and threaten to release them unless their demands are met. But as aforementioned, the majority are lying and have no such content or infected the target system with any malware.
Wang believes that the small number of perpetrators worldwide is a positive sign, because “if law enforcement is able to track down even a small number of these attackers, they can significantly disrupt this threat.”
Also, “since extortion attackers seem to be copying each other and following very similar templates, email security vendors should be able to block a large percentage of these attacks with relatively simple detectors.”
