Got mass-BCC'd by an extortion crew trying to use me as a pressure channel against their victim
Source Reddit ThreatIntel
Discussion
An extortion group is mass-BCC'ing journalists and other contacts to pressure victims by leveraging the recipients as indirect channels of coercion. The tactic involves sending breach claim emails to multiple journalists simultaneously, urging them to publish stories or contact the alleged victim before any proof is provided. This approach weaponizes journalists as pressure points in extortion campaigns without verified evidence of a breach.
r/threatintel (opens in a new tab)u/maayds0 points0 comments
Run a CTI site and my public contact address apparently landed on a bulk list. Yesterday I got an email BCC'd "along with other journalists" from a crew claiming a breach, asking for a story to be published and the victim called for comment before offering any proof. That's not a tip, it's asking a journalist to be the pressure arm of the extortion. I wrote up the tactic itself (kept the victim unnamed since nothing was verified and naming them on an extortionist's word is a defamation problem), including what email headers actually confirm vs don't. Curious if anyone else has gotten one of these, and how you'd handle the 'do you contact the named victim' call.