You may have heard of a recent surge in sextortion-based phishing campaigns. These campaigns seek to extort victims by threatening to publicly embarrass them for engaging in a sexually-explicit act, using previously-exposed passwords as proof of compromise.

This is not new; users have reported these intermittently since late 2017. However, the recent scale and persistence of this campaign has led to some success. As part of this campaign, we collected and analyzed a sample of emails sent over a two-month period, in which 8,497 email addresses were bombarded with over 60,000 emails. So how did they do it, why did they do it, and was it worth their time?

Old passwords; new ways to make money

Of the emails we detected, they all followed a similar pattern to that shown below in Figure 1. The extortionist would:

1. Provide the user with a known password as “proof” of compromise.
2. Use the suspicion of compromise as a platform to extort the user.
3. Claim to have video footage of the victim watching adult content online.
4. Urge victim to pay ransom to Bitcoin address.

Figure 1: A screenshot of one sextortion-based phishing attempt

The “proof”, of course, is flimsy. These known passwords are relatively easy to obtain for cybercriminals. Breaches often consist of rows of username, email, password hash, userid and so on, but the passwords are very rarely in plain-text. However, some services store passwords with weak hashing algorithms, making the identification of user passwords possible, given enough time and resources.

The cracked passwords and email combinations are normally combined into lists and sold on through forums. These lists are initially sold online, but inevitably end up being made public. Across our sample, the most popular breaches for these passwords were the Anti Public and the Exploit[.]in leaks. 5585 (66%) of the credentials listed in this campaign matched the Anti Public breach list, compared to 4907 (58%) across Exploit[.]in breach. (Note that the total exceeds 100% as a number of credential sets appear in multiple breaches).

Different capabilities running different campaigns

Some of the campaigns were clearly well-coordinated. For example, many of the emails were sent from newly created outlook.com email addresses. When we investigated some of the sender email addresses, we found that, in certain cases, the local-part of the email address of the sender/attacker ([email protected]) appeared to be randomly generated, and that the email had not appeared in previous public breaches, indicating that some of the sending addresses may have been specifically created for the purpose of distribution rather than via compromised accounts.

On the other hand, a great deal appeared to be opportunists who have little understanding around crafting and distributing emails on scale, and are sending out malformed emails that would never make it past a mail server or spam filter. Some had attempted to send emails through open relays with missing or malformed fields.

Persistence pays off

These sextortion phishing campaigns seem easy enough to detect and dismiss, so it may seem unlikely that victims will pay the ransom. Over a period of two months, we detected more than 60,000 emails sent using this approach. If you send out enough emails, you’re more likely to get the attention of a recipient that:

1. Reuses their passwords
2. Has recently watched adult content on their computer
3. Has a webcam

With 8,497 victims targeted by over 60,000 emails in our sample, it’s no surprise we identified some success. Of all the Bitcoin addresses detected in this sample, 26 transactions matching the demands were made, totaling $28,000.

The attackers experimented with different methods to maximize their return. For example, by tracking one Bitcoin address, we can see the same one targeted 49 email addresses with demands ranging from $1,100 to $11,000. Eventually the attacker got lucky with a payment of $1,100 (0.1512 BTC).

Summary

While this sample set represents a small percentage of the total recipients of these sextortion campaigns, it’s clear that attackers are turning to new ways to monetize breached credentials. In reality, if an attacker had access to your computer and were able to get hold of your password and record your actions, it’s unlikely that sextortion would be the most profitable tactic. Instead, we might expect attackers to monitor your online activity for banking and other services, where financial details or Personally Identifiable Information (PII) can be harvested and sold.

We talk about this a lot in the industry, but credential hygiene is a must. If you receive an email and it contains your one and only password, then you are a prime target. Strong unique passwords for each service, with multifactor authentication where possible, is a must these days.