How Cyber Extortion Could Cost You Everything

Over the past twenty years, the number of cyber extortion incidents has risen sharply. This increase has led to the creation of specific designations for various types of cybercrimes, as authorities and cybersecurity experts work to address the growing complexity and variety of these offenses. These attacks target both large corporations and individuals, and their tactics for attacking these victims differ drastically.

Companies in the private sector and individual victims have developed an expanding need for assistance in working against these cybercriminals. As such, there has been a growing need for cyber security and digital forensics agencies to help formulate a plan to prevent and combat these acts of digital fraud and extortion.

How Does Cyber Extortion Work?

Cyber extortion is a crime in which the perpetrator carries out or threatens an undesired action against an individual or group unless the victim complies with their demands. Oftentimes, the extortionist has access to valuable data that they use as leverage to blackmail the victim. There are numerous ways in which the cybercriminal can come into possession of this data.

Some attackers may hack into databases and steal valuable data while others may trick the victim into volunteering the information by impersonating a person the victim may trust in an act known as catfishing. The strategy used by criminal obtains this data is often determined based on the target of their attack, with more technical tactics being reserved to penetrate the security of different businesses and more personal techniques primarily being used to target sole individuals.

Hacking Tactics

A cyber extortionist who opts to take the route of hacking will gain access to data in a much more technical manner. Rather than trying to get the victim to offer up information, they take the information by force working around the organization’s digital security. They bypass security measures through tactics including malicious software or stolen credentials that enable the criminal to extract records.

This could be done by sending an email containing malware or gaining access through a brute force attack using credential stuffing. They may also post an advertisement on a legitimate website that lures victims into clicking on to a page that contains malicious software that can infect their device and give the hacker access to private data.

Impersonation or Fraud Tactics

Impersonation or fraud scams intend to lure the victim into willingly passing along their data to the cyber extortionist. This is done by giving off the façade of being someone else. This can be done in numerous ways, but the two most popular methods are spoofing and catfishing.

Spoofing – An impersonation tactic where the criminal poses as a trusted connection to trick the victim into confiding in the extortionist. The extortionist may claim to be a bank or a member of the victims friend group, someone the victim believes in or trusts.
Catfishing – This is the process of creating a fake identity that appeals to the victim’s desires. Catfishes often pose as potential romantic partner which is why the tactic is most commonly associated with romance scams.

Social engineering is the process of manipulating a victim psychologically as a means of gaining access to the data required to extort them. A cyber extortionist may be inclined to use this strategy against an individual, as it does not require the technical knowledge of hacking tactics. There are many types of social engineering, but some of the more popular tactics are listed below.

Phishing – Similar to spoofing, phishing involves sending an email to an individual that appears to have come from a trusted and legitimate entity. Through this, the cyber extortionist will attempt to gain access to credentials and other private information from the victim.
Vishing and Smishing – Much like phishing, Vishing and Smishing are social engineering tactics that send messages to potential victims that appear to come from an established source via voice calls and SMS messages.
Baiting – A cyber extortionist may leave a storage device in public location in hopes that a curious passerby may pick it up and plug it into their device. From there, the device will be infected with malicious software that can give the perpetrator access to the victim’s data.

don't let cybercriminals win. Get help today.

Common Types of Cyber Extortion

The avenues in which a perpetrator will commit cyber extortion vary depending on the intended target. These cyber criminals will take a more complex and technical approach to attacking a business versus a more personal and manipulative one against an individual. Knowing the differences between these strategies and who they target is paramount in protecting yourself from potential attacks.

Cyber Extortion Targeting Businesses

Ransomware – The perpetrator utilizes malicious software to lock the victim’s files and “hold them ransom”. They will proceed to hold this data hostage as a means of leverage in their attempt to extort the victim. For additional resources, click here.
Distributed Denial of Service (DDoS) – The extortionists, either manually or more commonly through the use of bot users, overloads the server of a website to block potential visitors from access. They will threaten to continue to flood the server until the victim succumbs to the extortion. For additional resources, click here.
Sensitive Information Blackmail – The cybercriminal comes into access of some form of confidential data through one of the tactics previously discussed. They then use their knowledge of this information as capital to virtually blackmail the victim with the threat of doxing or misusing the stolen content. For additional resources, click here.

Cyber Extortion Targeting Individuals

While there are hundreds of different cyber scams currently targeting individuals across the globe, the top three are as follows:

Sextortion – This form of extortion specifically utilizes identifiable explicit photos of an individual as a tool to blackmail and coerce the victim into paying the perpetrator to avoid the leak of their intimate data. Sextortion is one of the fastest growing online crimes with thousands of Americans being sextorted each year. For more information on sextortion, click here.
Email-Based Blackmail – With 92% of people in the United States using email as form of communication^(2), it is a highly sought after means of gaining access to an individual’s information. With access to your email, extortionist can access your data, steal your identity, or threaten to leak incriminating content. To learn more, cli c k here.
Romance Scams – With reported cases of romance scams in the United States more than quadrupling⁽³⁾ from 2017 to 2022, romance scams have become a major problem in recent years. With unique strategies from different countries around the world, extortionists will build a romantic cyber-relationship with an individual before requesting funds for various reasons, such as a medical emergency or to build a home for the “couple” to eventually live together. For more information, click here.

Resources for Victims of Cyber Extortion

Every major law enforcement agency has resources and special units for bringing cybercriminals to justice. Below are the resources of victims that reside in the USA.

National Law Enforcement Agency (FBI) – The FBI provides information on cybercrime in addition to their Internet Crime Complaint Center (IC3)⁽⁴⁾, which takes reports of internet crimes committed against the public.
Regulatory & Enforcement Agency (FTC) – The FTC provides informational pages and quizzes on their website to help educate corporations on prevention and defense against cybercrimes.
Resources for Minors (NCMEC) – NCMEC provides information on the proper course of action in the case of Minor Sextortion as well as the CyberTipline⁽⁵⁾ to report cases of online exploitation of children.

Other Organizations That Help with Cyber Extortion

There are a multitude of organizations available to assist the private sector in both the security of data and handling of cases of cyber extortion. It is important to understand the differences between the services that these organizations provide when determining where to look for assistance with such online crimes.

Cyber Security – This field of protection revolves around the prevention of cybercrimes. A sector would want to reach out to a cyber security provider before the event of a security breech as a precautionary measure.
Cybersecurity firms that specialize in digital forensics investigate and combat a cybercrime after it has occurred. They will help you remove the data from the hands of the perpetrators and assist you in taking the appropriate legal action.

Contact Digital Forensics Corp. We Can Help

Regardless of whether you are looking for assistance with cyber security or digital forensics, Digital Forensics Corp. can provide you with the service necessary to both prevent and handle cases of cyber extortion. With our team of experts and proprietary technology, we have the tools necessary to help secure your data both before and after a breech.

DFC’s experience with handling cybercrimes enables us to detect security flaws in your network to help mitigate the chances of your private information being leaked. We offer consulting and support to help organizations and individuals prevent, predict, and detect potential network attacks.

In the event of a security breech, our experts are ready to assist you in the necessary steps to regain control of your data. Our digital forensics investigators have the expertise necessary to confirm the event of a security breech, detect what led to the data being accessible to cyber criminals, collect the necessary evidence to take legal action, and develop a plan to prevent such attacks from occurring in the future.

If you believe you are at risk of cyber extortion or are already a victim, it is important to act fast. The quicker you respond to this type of threat, the higher your chances are of limiting the damages.

Resources:

DISCLAIMER: THIS POST IS FOR INFORMATIONAL PURPOSES ONLY AND IS NOT TO BE CONSIDERED LEGAL ADVICE ON ANY SUBJECT MATTER. DIGITAL FORENSICS CORP. IS NOT A LAWFIRM AND DOES NOT PROVIDE LEGAL ADVICE OR SERVICES. By viewing posts, the reader understands there is no attorney-client relationship, the post should not be used as a substitute for legal advice from a licensed professional attorney, and readers are urged to consult their own legal counsel on any specific legal questions concerning a specific situation.

The information presented in this article is based on sources that are not readily available to the public and may be subject to restrictions or confidentiality. It is intended for informational purposes only.

What are You Looking for?

How Cyber Extortion Could Cost You Everything