Scammers Attempting Extortion Via “Review Bombing” Reputation Campaigns
|by Alpha Team
In August 2018, scammers are attempting to extort companies with threats of massive negative search engine optimization (SEO) and social media smear campaigns. The cybercriminals, who call themselves “STD Company,” privately contacted companies via email and Twitter in the last week of August with the same statement, describing themselves as “experts in destroying personal or company reputation online,” according to a report from Motherboard and information obtained by ZeroFOX. ZeroFOX maintains a copy of the threat provided by “STD Company,” including the cryptocurrency wallet address. [Reference 1, p.2]
Although this is an emerging threat with few confirmed targets, the widespread vulnerability to negative reputation campaigns means this threat could spread to a variety of sectors. The cybercriminals have so far posted sample threats on Twitter, Facebook, Instagram, and YouTube, indicating they plan to target a variety of major social media platforms. This is similar to denial of service extortions where they send sample traffic as a way to show the seriousness of their threat. In addition, the cybercriminals threatened to destroy the companies’ search engine ranking by spamming forums and blogs with negative comments and bad backlinks, which could lead to the targeted site being banned by Google. As of 30 August, no campaign has apparently been initiated against the targeted companies, suggesting this could be a false threat.
The cybercriminals used bots on multiple social media platforms to demonstrate the type of negative information they would post about the company if the ransom was not paid, providing examples of language that could be detected by ZeroFOX’s platform as well as indicators about the bot networks. The bots appear to post the exact same comment three times from three different accounts, often in rapid succession, and the comments frequently refer to “scams” and “frauds.” The bot networks appear to target Brazilian Portuguese and Turkish language accounts and probably consist of a combination of stolen/compromised accounts and fake accounts created solely for bot functions.
Recommendations
- Contact ZeroFOX if you receive a similar threat to enable our custom FoxScript and discuss remediation tactics
- Work with the owners of your public social media, email, and support channels to establish a reporting procedure for similar threats
Reference 1: Copy of threat provided by “STD Company”
To Whom It May Concern,
My name is Dmitry and I'm writing on behalf of STD Company.
We are specialists in negative SEO and negative social media influence.
To be more specific, we are experts in destroying personal or company reputation online.
How do we achieve this? Just a few examples:
- Thousands of negative reviews and fraud reports on sites like TrustPilot, Ripoff Report, etc.
- Thousands of negative posts on social media and negative ratings and replies on your social media accounts.
- Most importantly, destroying your search engine ranking by spamming with over 1,000,000 (one million) forum profile and blog comment backlinks with irrelevant/negative anchor text (for example "penis pills"). It will lower your PR and in a worst case your site can get banned by Google.
Once we complete our job, even if your site remains on Google, you can be sure that all first page would be full of negative results about your company.
Just a few examples of how it's going to look like:
[REDACTED]
Check comments of profile and header pictures of your Facebook page.
Check likes and comments of this video from your channel: [REDACTED]
This are just a few examples, to prove that this we are not sending an empty threats, as at this point we are not working against you. If you need more demonstrations (Bad backlinks? Twitter storm? Whatever...) let us know.
We will refrain from this and we will never contact you again for a small fee of 2 BTC which has to be paid to 1HTFHmB3seg359f7tpnwx2aAWPeh8njU6h until [REDACTED].
If not, we will proceed with our work and you should understand that damage once made can't be undone, not even by us.
You do not need to contact us, because we have gave you unique Bitcoin address and we will know that you have paid once we receive your payment.
(You can contact us if you want to use our service to destroy your competition, but only after your payment is received. And there are special terms for this service, but we will explain it if necessary.)
Best Regards,
Dmitry
STD Company
Sources
Tags: logistics, us/canada, threat actor