Leading threats with torpedo bank – E24

This is how the email opens, which was sent to a man in a managerial position in Norway on April 20 of this year. E24 has seen an anonymous version of the email.

There, he has four days to pay NOK 30,000 through a specific cryptocurrency, with a completely open threat of violence if he does more than pay.

The sender writes:

The email is written in near-perfect Norwegian and is also directly tailored, with personal content, to the recipient.

So far, only a handful of people have reported emails with these similarities to the police, reports the Norwegian Center for Information Security (NorSIS) and Kripos.

They choose to make the content public, hoping that both will stop the sponsors and that more recipients can see that they are not alone.

Torpedo threats

The concern that Kripos and NorSIS have is that there are several cases that have not been reported to the police, and that the scope is greater than they know. They say that these types of cases are difficult to investigate, especially since services have been used that facilitate a high degree of anonymity.

More reviews, if there are actually more cases, will increase the chances of identification, the police hope.

Then the extortionists add that it will cost them NOK 30,000 to hire a torpedo and that they don’t know the perpetrators, but will also pay them with cryptocurrencies.

– Digital extortion is not a strange phenomenon in itself. What is special is that it is written by someone who apparently has Norwegian as their mother tongue. The language does not appear to be automatically translated, and is specifically directed at those who appear in high-ranking positions, says police chief and section manager Jostein Strømnes at the National Center for Cybercrime (NC3), Kripos, at E24.

The department he heads, the Internet-related investigative support section, got involved in the case when local police and NorSIS saw that there were common characteristics of several threats that had been recently broadcast.

– Here are some nuances that differ from the way we have seen before. Typically, work has been done to establish a basis for extortion, a value that someone will protect, often a file or confidential information, but here it is not. These are direct threats of violence against these criminals.

Strømnes says he has not seen anything similar before.

– Not in this mode, no. In isolation, threats of violence are by no means foreign to the police, it is very similar to the settlement and torpedo activities that we see in organized criminal settings, among other things. But there is no such relationship behind.

At the same time, it expresses a strong understanding that email is perceived as intimidating and has something to do with the recipient.

– Here we would like to emphasize that we have no indication that there is any real intention behind the threats to actively practice violence. It is rather a pressure tool to get the sum you want, it is a purely winning motive.

NorSIS: something new

NorSIS Senior Advisor Ole Anders Ulsrud says this variant of email blackmail is brand new.

– This is not at all like what we’ve been through before. in Threats and trends report, which arrived in February, we said that we think the personification of scams and blackmail would get better and better. It took three months for something to happen that was much more personal than we had ever imagined, says Ulsrud.

Impersonation involves sending the sender directly to the recipient and demonstrating that they have knowledge of who this person is and the environment around them.

– It’s you they talk to in the email. And when the threats are so serious and affect you and your family, it’s something that hits the victim much more than the previous fraudulent emails we’ve talked about before.

One of the recipients NorSIS has spoken to stated that he had considered paying, because at first it seemed like the easiest way to escape.

– He thought it was so uncomfortable that he first thought that the easiest way was to pay to get rid of the problem. But fortunately, he quickly came into contact with someone who could support him.

Both NorSIS and Kripos say they fear it is dark.

– We are very afraid that the reality is that there are many people around who have actually paid, and therefore this fraud may continue, since they have shown that they have made a payment.

Encourage review

In one of the emails E24 has accessed, blackmailers are trying to minimize the opportunities the police have to help. They write that the police can issue an alert and drive around the residence with a patrol.

The sender’s mastery and choice of payment method facilitate a high degree of anonymity, making it difficult for the police to identify the sender. But the more people report, the more the police have to work, Strømnes emphasizes in Kripos.

– All cases have been reported to the local police. It is also fair to do so, all these cases should be reported to your local police district.

– What we have done in NC3 is to look at threats as a whole, as a comprehensive complex. We do not have an investigation, but we observe common denominators that allow us to contribute, for example, to identification.

NC3 has specialists and experience in identifying anonymous web users, among other things. Until now, the police have theorized that the threats have been sent by a young adult with some knowledge of ICT.

Strømnes asks the recipients of such emails to save all the information, bring screenshots and emails to the police and report it.

– Our call is not to pay. Do not enter into dialogue and do not pay, inform the police.

E24 is based on advice from our readers. Contact E24 reporter by email [email protected] or in an encrypted message through Signal or WhatsApp at +47 416 15141.

Nettvett.no – See the NorSIS, NKOM, and NSM collection page for information, tips, and guidance on safer Internet use here