Who’s Behind the Screencam Extortion Scam?
Summary: A sextortion email campaign that cited recipients' real passwords was likely the work of multiple spammers who piled on after seeing payments, traced through domains registered in May 2018 at Namecheap and sharing name servers from uscourtsgov-dot-com, a domain previously tied to a June 2018 Sigma ransomware scam. That domain had redirected visitors to mtaexpert-dot-info, a spamming service whose briefly unmasked WHOIS record named Hicham Aallam of Morocco, who said one customer using the Skype name "brian.ortega_4" paid about $250 in Ethereum on April 3, 2018 for a mailing script license.
What's compelling: The address block behind these domains, 46.161.42.0/24, is registered to the same name behind network AS41995, and an adjacent block holds Rescator's stolen-card shop - the operation linked to the Target and Sally Beauty breaches - so the infrastructure behind a low-grade extortion email sits alongside established carding operations.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026