Spams meet Cryptocurrencies: Sextortion in the Bitcoin Ecosystem

In the past year, a new spamming scheme has emerged: sexual extortion messages requiring payments in the cryptocurrency Bitcoin, also known as sextortion. This scheme represents a first integration of the use of cryptocurrencies by members of the spamming industry. Using a dataset of 4,340,736 sextortion spams, this research aims at understanding such new amalgamation by uncovering spammers’ operations. To do so, a simple, yet effective method for projecting Bitcoin addresses mentioned in sextortion spams onto transaction graph abstractions is computed over the entire Bitcoin blockchain. This allows us to track and investigate monetary flows between involved actors and gain insights into the financial structure of sextortion campaigns. We find that sextortion spammers are somewhat sophisticated, following pricing strategies and benefiting from cost reductions as their operations cut the upper-tail of the spamming supply chain. We discover that one single entity is likely controlling the financial backbone of the majority of the sextortion campaigns and that the 11-month operation studied yielded a lower-bound revenue between $1,300,620 and $1,352,266. We conclude that sextortion spamming is a lucrative business and spammers will likely continue to send bulk emails that try to extort money through cryptocurrencies.过去一年间，一种新型垃圾邮件诈骗手段应运而生：以加密货币比特币（Bitcoin）为勒索对价的性敲诈（sextortion）邮件，此类诈骗行为也被称为性敲诈。本研究依托包含4340736封性敲诈垃圾邮件的数据集，旨在通过揭露诈骗者的运作流程，剖析这一加密货币与垃圾邮件产业融合的新型诈骗模式。为此，本研究针对全比特币区块链展开分析，构建了一套简洁高效的映射方法，将性敲诈垃圾邮件中提及的比特币地址映射至交易图抽象模型。借此可追踪并研判相关参与主体间的资金流向，进而洞悉性敲诈诈骗活动的金融运作结构。研究发现，性敲诈垃圾邮件发送者具备一定的运营成熟度：他们会制定系统性定价策略，并通过砍掉垃圾邮件供应链的上游环节以降低运营成本，从而实现收益提升。研究还发现，单一主体极有可能掌控了绝大多数性敲诈诈骗活动的金融核心架构；本次研究覆盖的11个月运营周期内，其最低营收区间为1300620美元至1352266美元。综上，性敲诈垃圾邮件诈骗已成为一门利润丰厚的生意，诈骗者大概率会继续通过加密货币发送批量邮件实施勒索。