Email fraudsters using multiple bitcoin wallets to extort money:Barracuda, ETCIO SEA
![](https://cryptonewswire.org/wp-content/uploads/https://etimg.etb2bimg.com/thumb/msid-101810471,imgsize-37067,width-1200,height=765,overlay-etciosea/news/security/email-fraudsters-using-multiple-bitcoin-wallets-to-extort-moneybarracuda.jpg)
Barracuda, a trusted partner and leading provider of cloud-first security solutions, has released a Threat Spotlight revealing email fraudsters trying to extort money by threatening to release embarrassing or illicit material, targeting more than 10 work email accounts at a time and make moderate payment demands – around $1,000 USD in bitcoin from potential victims. Such tactics could help attackers to stay under the radar and avoid alerting potential victims, security teams and payment systems.
The findings are based on the Barracuda Network’s AI-based detectors where a team of researchers at Columbia University analysed 300,000 emails detected as blackmailing scams over a period of 12 months. The overall goal was to understand the financial infrastructure attackers use for extortion emails.
Extortion attacks threaten to expose compromising personal information, such as photos, videos, or details of illicit online activity and blackmail the victim to pay generally in a cryptocurrency such as bitcoin. The research findings are detailed in a new Barracuda Threat Spotlight.
While understanding the attack model, the detection data highlights several points including, the attackers were using 3,000 unique Bitcoin wallet addresses out of which 100 wallets appear in 80% of the extortion emails. This highlights that a relatively small number of attackers were responsible for most of the extortion emails.
The researchers also found that 97% of extortion mail sender accounts sent out fewer than 10 attack emails each and 90% of the attacks demanded payments of less than $2,000 USD in bitcoin.
“Our analysis suggests that extortion scams are implemented by a relatively small number of perpetrators, each firing off multiple small-scale attacks with moderate extortion demands,” said Asaf Cidon, Associate Professor of Electrical Engineering at Columbia University. “These relatively modest sums make it likelier the targets will cooperate with the extortion, and the relatively small number of emails per sender make it easier for attackers to evade detection by traditional security technologies and anti-fraud measures at payment providers and avoid arousing the attention of law enforcement and the media – which would alert potential victims to the scam.”
“Extortion attacks need to be taken seriously by security teams, especially when they are targeting people through their work email accounts,” said Nishant Taneja, Senior Director, Product Marketing, Email Protection at Barracuda. “How did the attacker get hold of the account details, for example – were they exposed or stolen at some point? Or does it mean that the recipient has used their work account and device for inappropriate activity such as visiting questionable websites? Both scenarios have security implications for the company – and for the target. This can be embarrassing and distressing and can potentially make it more likely a victim will pay.”
There are some important steps that security teams can take to keep employees and the wider organisation protected from extortion scams. These include investing in AI-powered email security that can detect and block such emails before they reach the intended recipient and prevent attackers from seizing control of accounts and using the company as a base to launch other attacks. This should be coupled with employee training and security policies that discourage staff from using their work email to access third party sites or to store sensitive, personal material on work devices – but which also provide them with a safe and confidential place to report an incident.