Advisory on Extortion Emails

What is affected, what to do

Background In August 2024, SingCERT received at least 33 reports of extortion emails from individuals and organisations. These emails attempt to intimidate recipients into making a payment by claiming that the perpetrator (sender) possesses sensitive or compromising information about the recipient, and threatening to expose the information unless payment is made.

The available sources name no fixed version. Check the vendor guidance in the references below.

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Handle the vulnerability in regular vulnerability handling under Art. 21(2)(e) NIS2.

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

From 11.12.2027, Annex I Part II CRA requires manufacturers of affected products with digital elements to handle vulnerabilities without delay and provide security updates.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Background In August 2024, SingCERT received at least 33 reports of extortion emails from individuals and organisations. These emails attempt to intimidate recipients into making a payment by claiming that the perpetrator (sender) possesses sensitive or compromising information about the recipient, and threatening to expose the information unless payment is made. This advisory provides awareness on what extortion emails are, as well as guidance on what to do when receiving such emails. Description of an Extortion Email We have observed multiple variants of extortion emails, some of which were sent in languages other than English. Common to all variants are the following elements: Claims of compromise. The perpetrator will claim to have installed malware on the recipient's devices, including computers and smartphones, and that the malware has been used to record private and potentially embarrassing videos of the recipient. Alternate narratives may include claiming to have compromised the recipient’s email account, and having access to their emails and contact list. Threats of exposure. The perpetrator demands a cryptocurrency payment and threatens to send the videos to the recipient's contacts if not paid within a stipulated time. Examples of extortion emails are shown below: Figure 1: Example of an extortion email Figure 2: Example of an extortion note sent via email As we noted above, some of these extortion emails appear to have been sent from the recipient’s own email account. To make their ruse more believable, the perpetrator will draw attention to this and claim to have accessed the recipient’s email account to send the extortion email. In reality, this is achieved through a technique known as email spoofing , which allows an adversary to manipulate the sender address and make the email appear as having been sent from a legitimate or trusted source — in this case, the recipient. These extortion emails are typically indiscriminate — they contain identical messages and are sent out as part of a large-scale campaign using automated tools. What to Do If You Receive an Extortion Email Depending on the email authentication protocols of the email service you use, such extortion emails usually end up in the spam/junk folder. It is important to remember that the spam/junk folder serves as a filter for potentially harmful or unsolicited emails, and users need not be alarmed to find such emails there. However, on occasion, an extortion email may successfully evade email filters. If you discover an extortion email in your inbox, consider the following: Remember that this is likely a scam. The claims made in these emails are baseless, and the perpetrators have no real compromising information or videos of you. The email is part of an indiscriminate extortion campaign and does not specifically target you. Ignore the threat. Understand that these baseless claims are designed to intimidate and extort money from you. Do not reply to the email, and do not make any payment. Engaging with the perpetrators or yielding to the extortion will encourage them to continue their cybercriminal activities. Secure your accounts. If you have enabled multi-factor authentication (MFA) for your email account, you may rest assured that your account is secure. Otherwise, take additional precautions by ensuring that you have a complex passphrase and is MFA enabled for an additional layer of security. Review the recent security activity of your email account regularly to ensure that it is secure. Report the email. You can report the email to your email service provider or IT security team, which may help protect other users from spam and abuse. You can also report the incident to SingCERT at https://www.csa.gov.sg/cyber-aid to help us monitor and counter these scams. In the unlikely event that you are being blackmailed or held ransom by a perpetrator who provides verifiable proof of compromise, you should lodge a police report immediately. The police should be able to advise you further once they are able to establish the case. You can lodge a report directly at any neighbourhood police post or online at https://eservices1.police.gov.sg . Protecting Your Email Address from Spam Cybercriminals and perpetrators of spam acquire email addresses for their campaigns from various sources, including data breaches, scraping publicly available information, purchasing marketing databases, or bruteforcing common email formats. To protect your primary personal email address from spam, you should continually safeguard its privacy as part of good cyber hygiene. Be selective about who you share your email address with, and only provide it to trusted individuals and organisations. Refrain from sharing your email publicly, such as on forums or social media, where it can attract unwanted attention. Further consider using a secondary email address or alias. These can be used for websites that you do not frequent or consider non-essential. Should you start receiving unwanted emails through your secondary email or alias, you can dispose of them without worrying about your primary email being compromised. For Organisations Organisations should consult their IT security teams to ensure that robust filters are in place for their email servers. To further enhance email security, organisations may refer to our resources on: Domain-based Message Authentication, Reporting & Conformance (DMARC) Domain Key Identified Message (DKIM) Sender Policy Framework (SPF)

Source: CSA/SingCERT