An H1 2023 cyber threat report highlights the adaptability of cybercriminals and documented a renewed rise in sextortion scams – the use of sexual threats and coercion to receive a ransom.

Online sextortion usually comes in the form of email or messages, where threat actors will threaten victims that they have sexually explicit images or videos of the victim that they will release if a ransom is not paid.

Fraudsters also claim that they have installed malware on the target’s device that allows them to gather data of a sexual nature, which can be exploited if a ransom is not paid.

According to the report from ESET, these claims should be ignored as empty threats. The most common variant of these types of frauds the cybersecurity firm saw were DOC/Fraud.AAW, which they observed demanding Bitcoin in return for not divulging sexual content.

Other variants included ATT and ADJ, with similar scams claiming to have stolen data of a sexual nature.

When the report was published, ESET discovered a Bitcoin address among the extortion demands which had amassed 0.08 Bitcoin, which is currently work over 2,000 USD, and then emptied.

Overall, sextortion scams rose by around 201% in H1 2023, and the sextortion fraud grouping ranked third among all email threats detected by the cybersecurity firm.

However, it is possible that these scams are coming from a relatively small group of threat actors, according to a report by Barracuda Networks, which could make the threat easier to defend against.

Sextortion appears to be on the rise in Scotland as well – Police Scotland in a recent meeting said that a rise in overall sexual and violent crimes was largely due to a rise of online sextortion, where criminals were threatening victims to post explicit images online unless a ransom was paid.

Police Scotland have therefor urged residents to stay vigilant online and to not pay up ransoms, and instead report the incidents to the police. They have also encouraged better education concerning online safety, especially for younger children.

Social Engineering, AI, and Sextortion

Sextortion is a form of social engineering – when scams play on human emotions to gain money or personal data. Advancements in AI large language models (LLMs) has increased the effectiveness of threat actors.

Recommended reading

• Nearly a Third of Young People Preyed on by “Text Pests,” ICO Reveals
• Watch Out for Crypto Romance Scams Using AI
• Which Sectors Are Investing the Least in Cybersecurity Training?

Large language models like ChatGPT can remove many of the inconsistencies or inaccuracies which are usually hallmarks of scam attempts. Spelling and grammatical errors are often tell-tale signs of a fraud attempt, but using LLMs can make scams harder to pick up for unassuming victims.

Further, the threat of sexual exploitation on the internet has reached new heights with the advent of deepfakes – technology which allows users to create fake images and videos with realistic likeness of a target. These can be used to threaten for ransom ore genuine explicit photos, and the phenomenon has caused the US Federal Bureau of Investigation (FBI) to release an alert concerning the threat.

But these financially-motivated, technology-enabled actors are not the only threats lurking in an ever-increasing online world. A rise in text pests – the use of personal data shared for business purposes being used to contact people for romantic or sexual reasons – is also on the rise in the UK, with around a third (29%) of 18 to 34-year-old experiencing this phenomenon.