Borrowing from the playbook of ransomware purveyors, the darknet
narcotics bazaar Incognito Market has begun extorting all of its
vendors and buyers, threatening to publish cryptocurrency transaction
and chat records of users who refuse to pay a fee ranging from $100 to
$20,000. The bold mass extortion attempt comes just days after
Incognito Market administrators reportedly pulled an “exit scam” that
left users unable to withdraw millions of dollars worth of funds from
the platform.
An extortion message currently on the Incognito Market homepage.
In the past 24 hours, the homepage for the Incognito Market was updated
to include a blackmail message from its owners, saying they will soon
release purchase records of vendors who refuse to pay to keep the
records confidential.
“We got one final little nasty surprise for y’all,” reads the message
to Incognito Market users. “We have accumulated a list of private
messages, transaction info and order details over the years. You’ll be
surprised at the number of people that relied on our ‘auto-encrypt’
functionality. And by the way, your messages and transaction IDs were
never actually deleted after the ‘expiry’….SURPRISE SURPRISE!!! Anyway,
if anything were to leak to law enforcement, I guess nobody never
slipped up.”
Incognito Market says it plans to publish the entire dump of 557,000
orders and 862,000 cryptocurrency transaction IDs at the end of May.
“Whether or not you and your customers’ info is on that list is totally
up to you,” the Incognito administrators advised. “And yes, this is an
extortion!!!!”
The extortion message includes a “Payment Status” page that lists the
darknet market’s top vendors by their handles, saying at the top that
“you can see which vendors care about their customers below.” The names
in green supposedly correspond to users who have already opted to pay.
The “Payment Status” page set up by the Incognito Market extortionists.
We’ll be publishing the entire dump of 557k orders and 862k crypto
transaction IDs at the end of May, whether or not you and your
customers’ info is on that list is totally up to you. And yes, this is
an extortion!!!!
Incognito Market said it plans to open up a “whitelist portal” for
buyers to remove their transaction records “in a few weeks.”
The mass-extortion of Incognito Market users comes just days after a
large number of users reported they were no longer able to withdraw
funds from their buyer or seller accounts. The cryptocurrency-focused
publication Cointelegraph.com [1]reported Mar. 6 that Incognito was
exit-scamming its users out of their bitcoins and Monero deposits.
CoinTelegraph notes that Incognito Market administrators initially lied
about the situation, and blamed users’ difficulties in withdrawing
funds on recent changes to Incognito’s withdrawal systems.
Incognito Market deals primarily in narcotics, so it’s likely many
users are now worried about being outed as drug dealers. Creating a new
account on Incognito Market presents one with an ad for 5 grams of
heroin selling for $450.
New Incognito Market users are treated to an ad for $450 worth of
heroin.
The double whammy now hitting Incognito Market users is somewhat akin
to the double extortion techniques employed by many modern ransomware
groups, wherein victim organizations are hacked, relieved of sensitive
information and then presented with two separate ransom demands: One in
exchange for a digital key needed to unlock infected systems, and
another to secure a promise that any stolen data will not be published
or sold, and will be destroyed.
Incognito Market has priced its extortion for vendors based on their
status or “level” within the marketplace. Level 1 vendors can
supposedly have their information removed by paying a $100 fee.
However, larger “Level 5” vendors are asked to cough up $20,000
payments.
The past is replete with examples of similar darknet market exit scams,
which tend to happen eventually to all darknet markets that aren’t
seized and shut down by federal investigators, said [2]Brett Johnson, a
convicted and reformed cybercriminal who built the organized cybercrime
community Shadowcrew many years ago.
“Shadowcrew was the precursor to today’s Darknet Markets and laid the
foundation for the way modern cybercrime channels still operate today,”
Johnson said. “The Truth of Darknet Markets? ALL of them are Exit
Scams. The only question is whether law enforcement can shut down the
market and arrest its operators before the exit scam takes place.”
References
1.
https://cointelegraph.com/news/bitcoin-monero-reportedly-stolen-darknet-market-exit-scam
2.
https://www.linkedin.com/in/gollumfun/?midToken=AQFhY1xi5kHTDw&midSig=0yI12VazbfWX01&trk=eml-email_premium_inmail_initial_single_02-null-3-null&trkEmail=eml-email_premium_inmail_initial_single_02-null-3-null-null-1gq77~lq13o88l~9q-null-neptune/profile~vanity.view
