{"id":984,"date":"2019-03-25T10:38:21","date_gmt":"2019-03-25T14:38:21","guid":{"rendered":"https:\/\/www.thexyz.com\/blog\/?p=984"},"modified":"2019-06-13T12:08:02","modified_gmt":"2019-06-13T16:08:02","slug":"extortion-email-phishing-campaign-spoofs-cia","status":"publish","type":"post","link":"https:\/\/www.thexyz.com\/blog\/extortion-email-phishing-campaign-spoofs-cia\/","title":{"rendered":"Extortion email phishing campaign spoofs CIA"},"content":{"rendered":"

\n\t\t\t\t\t\n\t\t\t\t<\/div>
<\/div>Extortion phishing email campaigns have been on the increase of late, often hoping to take advantage of a mix of humiliation and embarrassment to deceive recipients. A recent sextortion spam campaign<\/a> that netted hundreds of thousands of dollars is just another example of this. Thexyz spam filters recently intercepted a particularly large run of such a scam around midday on Sunday, the 24th<\/sup> of March.<\/p>\n

Proclaiming to be from a \u2018technical collection officer\u2019 working in the Central Intelligence Agency (CIA), the spoof email<\/a> actually comes from one of a large number of new domains set up for the purpose of running the scam.<\/p>\n

The body of the email contains a long message advising the recipient that their personal details (including their home and work address) are currently on file under a case regarding the “Distribution and storage of pornographic electronic materials involving underage children.”<\/p>\n

The email advises the recipient that the case is part of a large international operation to arrest individuals suspected of pedophilia. It claims that the data used to acquire their personal information for the case includes recipients\u2019 web browsing history, chat-room logs and social media activity logs, among others. It adds the first arrests regarding the case are scheduled for April 8th 2019.<\/p>\n

The message then details why the particular recipient is being contacted and also provides a way to avoid any prosecution. For a payment of $10,000 USD made via Bitcoin, the sender promises to remove the recipient\u2019s details from the case. We checked the Bitcoin address (3DGPwYTMHU7M6wYJh58M2CRizZQtXVv8CZ) for an evidence of payments made, and at the time of writing this post fortunately nobody has made any payments as the wallet balance is empty without any transactions listed.<\/p>\n

Here is a screenshots of the email:<\/p>\n

\"CIA

The perpetrators have taken care to craft a grammatically sound and well-formatted email<\/p><\/div>\n

\"CIA

An example of the CIA extortion phishing scam<\/p><\/div>\n

The criminals behind this spoof have used several techniques to boost the legitimacy of the email scam. Not only have they included CIA\u2019s logo in the email signature but have also taken care to craft a grammatically correct and well-formatted email that looks like it could well be from a law enforcement or a foreign intelligence agency.<\/p>\n

If in doubt, do nothing
\n<\/strong><\/p>\n

It is important to remember that these scams are all fake, and cybercriminals are likely to be supplying you with false information or threats. By tapping into your fears and paranoia, they are tricking you into supplying them with Bitcoin.<\/p>\n

Thexyz urges the public to not panic and refrain from making any payments. Recipients should report suspicious activities<\/a> that could threaten public safety.<\/p>\n

Take a proactive approach to email security
\n<\/strong><\/p>\n

If your company\u2019s email accounts aren\u2019t protected, emails like the one above are almost certainly being received by your staff via their email address.\u00a0 Cybercriminals know people can be tricked; that\u2019s why they send out millions of scam messages and put so much effort into making them look convincing.<\/p>\n

People are not machines; we’re all capable of making bad judgement calls. Without email filtering protecting your business, it\u2019s just a matter of time before someone in your organization has a momentary lapse of judgement and clicks on the wrong thing.<\/p>\n

For a few dollars per staff member per month, add Thexyz cloud-based email and spam filtering solution to your business security. You\u2019ll significantly reduce the risk of new variants of malicious email from entering your network. Talk to an expert at Thexyz today about your company’s cybersecurity needs.<\/em><\/p>\n

 <\/p>\n<\/span>","protected":false},"excerpt":{"rendered":"

Extortion phishing email campaigns have been on the increase of late, often hoping to take advantage of a mix of humiliation and embarrassment to deceive recipients. A recent sextortion spam campaign that netted hundreds of thousands of dollars is just another example of this. Thexyz spam filters recently intercepted a particularly large run of such […]<\/p>\n","protected":false},"author":3,"featured_media":987,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[3],"tags":[],"class_list":["post-984","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-spam","et-has-post-format-content","et_post_format-et-post-format-standard"],"yoast_head":"\nExtortion email phishing campaign spoofs CIA - Thexyz Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.thexyz.com\/blog\/extortion-email-phishing-campaign-spoofs-cia\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Extortion email phishing campaign spoofs CIA - Thexyz Blog\" \/>\n<meta property=\"og:description\" content=\"Extortion phishing email campaigns have been on the increase of late, often hoping to take advantage of a mix of humiliation and embarrassment to deceive recipients. A recent sextortion spam campaign that netted hundreds of thousands of dollars is just another example of this. Thexyz spam filters recently intercepted a particularly large run of such […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.thexyz.com\/blog\/extortion-email-phishing-campaign-spoofs-cia\/\" \/>\n<meta property=\"og:site_name\" content=\"Thexyz Blog\" \/>\n<meta property=\"article:published_time\" content=\"2019-03-25T14:38:21+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2019-06-13T16:08:02+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.thexyz.com\/blog\/wp-content\/uploads\/thexyz-twitter-card-cia.png\" \/>\n\t<meta property=\"og:image:width\" content=\"612\" \/>\n\t<meta property=\"og:image:height\" content=\"314\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Ryan Woods\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ryan Woods\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.thexyz.com\/blog\/extortion-email-phishing-campaign-spoofs-cia\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.thexyz.com\/blog\/extortion-email-phishing-campaign-spoofs-cia\/\"},\"author\":{\"name\":\"Ryan Woods\",\"@id\":\"https:\/\/www.thexyz.com\/blog\/#\/schema\/person\/fecc09248fed8c409da290b0ff71b280\"},\"headline\":\"Extortion email phishing campaign spoofs CIA\",\"datePublished\":\"2019-03-25T14:38:21+00:00\",\"dateModified\":\"2019-06-13T16:08:02+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.thexyz.com\/blog\/extortion-email-phishing-campaign-spoofs-cia\/\"},\"wordCount\":617,\"commentCount\":2,\"image\":{\"@id\":\"https:\/\/www.thexyz.com\/blog\/extortion-email-phishing-campaign-spoofs-cia\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.thexyz.com\/blog\/wp-content\/uploads\/thexyz-twitter-card-cia.png\",\"articleSection\":[\"Spam\"],\"inLanguage\":\"en-CA\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.thexyz.com\/blog\/extortion-email-phishing-campaign-spoofs-cia\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.thexyz.com\/blog\/extortion-email-phishing-campaign-spoofs-cia\/\",\"url\":\"https:\/\/www.thexyz.com\/blog\/extortion-email-phishing-campaign-spoofs-cia\/\",\"name\":\"Extortion email phishing campaign spoofs CIA - Thexyz Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.thexyz.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.thexyz.com\/blog\/extortion-email-phishing-campaign-spoofs-cia\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.thexyz.com\/blog\/extortion-email-phishing-campaign-spoofs-cia\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.thexyz.com\/blog\/wp-content\/uploads\/thexyz-twitter-card-cia.png\",\"datePublished\":\"2019-03-25T14:38:21+00:00\",\"dateModified\":\"2019-06-13T16:08:02+00:00\",\"author\":{\"@id\":\"https:\/\/www.thexyz.com\/blog\/#\/schema\/person\/fecc09248fed8c409da290b0ff71b280\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.thexyz.com\/blog\/extortion-email-phishing-campaign-spoofs-cia\/#breadcrumb\"},\"inLanguage\":\"en-CA\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.thexyz.com\/blog\/extortion-email-phishing-campaign-spoofs-cia\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-CA\",\"@id\":\"https:\/\/www.thexyz.com\/blog\/extortion-email-phishing-campaign-spoofs-cia\/#primaryimage\",\"url\":\"https:\/\/www.thexyz.com\/blog\/wp-content\/uploads\/thexyz-twitter-card-cia.png\",\"contentUrl\":\"https:\/\/www.thexyz.com\/blog\/wp-content\/uploads\/thexyz-twitter-card-cia.png\",\"width\":612,\"height\":314},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.thexyz.com\/blog\/extortion-email-phishing-campaign-spoofs-cia\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.thexyz.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Extortion email phishing campaign spoofs CIA\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.thexyz.com\/blog\/#website\",\"url\":\"https:\/\/www.thexyz.com\/blog\/\",\"name\":\"Thexyz Blog\",\"description\":\"Email and Domains\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.thexyz.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-CA\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.thexyz.com\/blog\/#\/schema\/person\/fecc09248fed8c409da290b0ff71b280\",\"name\":\"Ryan Woods\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-CA\",\"@id\":\"https:\/\/secure.gravatar.com\/avatar\/c571363b6a95fc880e50f8095ca7d07b17da81eeed58cee1d9248cff2d547971?s=96&d=monsterid&r=g\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/c571363b6a95fc880e50f8095ca7d07b17da81eeed58cee1d9248cff2d547971?s=96&d=monsterid&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/c571363b6a95fc880e50f8095ca7d07b17da81eeed58cee1d9248cff2d547971?s=96&d=monsterid&r=g\",\"caption\":\"Ryan Woods\"},\"description\":\"I write a lot of fuzzing tools for anti-abuse purposes. I use these to make the web safer. Usually there's a custom firewall involved for some obscure performance benefit. Who knows.\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Extortion email phishing campaign spoofs CIA - Thexyz Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.thexyz.com\/blog\/extortion-email-phishing-campaign-spoofs-cia\/","og_locale":"en_US","og_type":"article","og_title":"Extortion email phishing campaign spoofs CIA - Thexyz Blog","og_description":"Extortion phishing email campaigns have been on the increase of late, often hoping to take advantage of a mix of humiliation and embarrassment to deceive recipients. A recent sextortion spam campaign that netted hundreds of thousands of dollars is just another example of this. Thexyz spam filters recently intercepted a particularly large run of such […]","og_url":"https:\/\/www.thexyz.com\/blog\/extortion-email-phishing-campaign-spoofs-cia\/","og_site_name":"Thexyz Blog","article_published_time":"2019-03-25T14:38:21+00:00","article_modified_time":"2019-06-13T16:08:02+00:00","og_image":[{"width":612,"height":314,"url":"https:\/\/www.thexyz.com\/blog\/wp-content\/uploads\/thexyz-twitter-card-cia.png","type":"image\/png"}],"author":"Ryan Woods","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Ryan Woods","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.thexyz.com\/blog\/extortion-email-phishing-campaign-spoofs-cia\/#article","isPartOf":{"@id":"https:\/\/www.thexyz.com\/blog\/extortion-email-phishing-campaign-spoofs-cia\/"},"author":{"name":"Ryan Woods","@id":"https:\/\/www.thexyz.com\/blog\/#\/schema\/person\/fecc09248fed8c409da290b0ff71b280"},"headline":"Extortion email phishing campaign spoofs CIA","datePublished":"2019-03-25T14:38:21+00:00","dateModified":"2019-06-13T16:08:02+00:00","mainEntityOfPage":{"@id":"https:\/\/www.thexyz.com\/blog\/extortion-email-phishing-campaign-spoofs-cia\/"},"wordCount":617,"commentCount":2,"image":{"@id":"https:\/\/www.thexyz.com\/blog\/extortion-email-phishing-campaign-spoofs-cia\/#primaryimage"},"thumbnailUrl":"https:\/\/www.thexyz.com\/blog\/wp-content\/uploads\/thexyz-twitter-card-cia.png","articleSection":["Spam"],"inLanguage":"en-CA","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.thexyz.com\/blog\/extortion-email-phishing-campaign-spoofs-cia\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.thexyz.com\/blog\/extortion-email-phishing-campaign-spoofs-cia\/","url":"https:\/\/www.thexyz.com\/blog\/extortion-email-phishing-campaign-spoofs-cia\/","name":"Extortion email phishing campaign spoofs CIA - Thexyz Blog","isPartOf":{"@id":"https:\/\/www.thexyz.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.thexyz.com\/blog\/extortion-email-phishing-campaign-spoofs-cia\/#primaryimage"},"image":{"@id":"https:\/\/www.thexyz.com\/blog\/extortion-email-phishing-campaign-spoofs-cia\/#primaryimage"},"thumbnailUrl":"https:\/\/www.thexyz.com\/blog\/wp-content\/uploads\/thexyz-twitter-card-cia.png","datePublished":"2019-03-25T14:38:21+00:00","dateModified":"2019-06-13T16:08:02+00:00","author":{"@id":"https:\/\/www.thexyz.com\/blog\/#\/schema\/person\/fecc09248fed8c409da290b0ff71b280"},"breadcrumb":{"@id":"https:\/\/www.thexyz.com\/blog\/extortion-email-phishing-campaign-spoofs-cia\/#breadcrumb"},"inLanguage":"en-CA","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.thexyz.com\/blog\/extortion-email-phishing-campaign-spoofs-cia\/"]}]},{"@type":"ImageObject","inLanguage":"en-CA","@id":"https:\/\/www.thexyz.com\/blog\/extortion-email-phishing-campaign-spoofs-cia\/#primaryimage","url":"https:\/\/www.thexyz.com\/blog\/wp-content\/uploads\/thexyz-twitter-card-cia.png","contentUrl":"https:\/\/www.thexyz.com\/blog\/wp-content\/uploads\/thexyz-twitter-card-cia.png","width":612,"height":314},{"@type":"BreadcrumbList","@id":"https:\/\/www.thexyz.com\/blog\/extortion-email-phishing-campaign-spoofs-cia\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.thexyz.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Extortion email phishing campaign spoofs CIA"}]},{"@type":"WebSite","@id":"https:\/\/www.thexyz.com\/blog\/#website","url":"https:\/\/www.thexyz.com\/blog\/","name":"Thexyz Blog","description":"Email and Domains","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.thexyz.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-CA"},{"@type":"Person","@id":"https:\/\/www.thexyz.com\/blog\/#\/schema\/person\/fecc09248fed8c409da290b0ff71b280","name":"Ryan Woods","image":{"@type":"ImageObject","inLanguage":"en-CA","@id":"https:\/\/secure.gravatar.com\/avatar\/c571363b6a95fc880e50f8095ca7d07b17da81eeed58cee1d9248cff2d547971?s=96&d=monsterid&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/c571363b6a95fc880e50f8095ca7d07b17da81eeed58cee1d9248cff2d547971?s=96&d=monsterid&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/c571363b6a95fc880e50f8095ca7d07b17da81eeed58cee1d9248cff2d547971?s=96&d=monsterid&r=g","caption":"Ryan Woods"},"description":"I write a lot of fuzzing tools for anti-abuse purposes. I use these to make the web safer. Usually there's a custom firewall involved for some obscure performance benefit. Who knows."}]}},"_links":{"self":[{"href":"https:\/\/www.thexyz.com\/blog\/wp-json\/wp\/v2\/posts\/984","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thexyz.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thexyz.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thexyz.com\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thexyz.com\/blog\/wp-json\/wp\/v2\/comments?post=984"}],"version-history":[{"count":4,"href":"https:\/\/www.thexyz.com\/blog\/wp-json\/wp\/v2\/posts\/984\/revisions"}],"predecessor-version":[{"id":1136,"href":"https:\/\/www.thexyz.com\/blog\/wp-json\/wp\/v2\/posts\/984\/revisions\/1136"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thexyz.com\/blog\/wp-json\/wp\/v2\/media\/987"}],"wp:attachment":[{"href":"https:\/\/www.thexyz.com\/blog\/wp-json\/wp\/v2\/media?parent=984"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thexyz.com\/blog\/wp-json\/wp\/v2\/categories?post=984"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thexyz.com\/blog\/wp-json\/wp\/v2\/tags?post=984"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}