Nyakuza Extortion Case

Timeline of Events

Phase 1: Social Engineering (Dec 29, 7:13-7:23 PM JST)

The attacker, controlling the compromised "jetha" account, initiated contact with Nyakuza using a friendly, conversational approach:

Phase 2: Malware Execution & Extortion (Dec 29, 7:28-7:38 PM JST)

After Nyakuza downloaded and executed the malware, the attacker revealed their true intent:

Evidence #1

Screenshot showing attacker's access to victim's Hotmail inbox containing medical records, financial emails, and personal correspondence.

CRITICAL EVIDENCE #2

MANUFACTURED EVIDENCE: This screenshot shows the attacker using Nyakuza's compromised Discord account to spam "im selling child porn for 10 dollars" 9 times in a chat. The attacker created this "evidence" to use as leverage and later as the basis for a false report to Discord.

Phase 3: Continued Harassment (Dec 30, 3:29-3:44 AM JST)

Hours later, the attacker returned:

Evidence #3

Second screenshot demonstrating continued access to the victim's Hotmail account, showing medical, financial, and personal emails.

Evidence #4

Final image sent by attacker before executing the false report to Discord.

Evidence Analysis

Image 1: Compromised Email Access (7:29 PM)

The attacker demonstrated full access to the victim's Microsoft/Hotmail account by showing:

• Medical records: Emails regarding psychological assessments
• Financial data: Emails regarding property payments and strata notifications
• Gaming accounts: Square Enix/FFXIV account notifications
• Security alerts: Microsoft account security emails
• Personal contacts: Various personal correspondence

Image 2: Manufactured CSAM Evidence (7:31 PM)

This is fabricated evidence. The attacker:

1. Logged into Nyakuza's Discord using the stolen token
2. Joined or used an existing group chat
3. Spammed CSAM solicitation messages
4. Left the group
5. Screenshot the "evidence"
6. Sent it to Nyakuza as leverage
7. Later reported Nyakuza to Discord using this manufactured evidence

The False Report Mechanism

How It Worked

1. Account Compromise: Attacker stole Nyakuza's Discord token via Micro Stealer malware
2. Evidence Manufacturing: Using the stolen token, attacker logged into Nyakuza's account and posted CSAM solicitation messages
3. Documentation: Attacker screenshot the messages they posted as "evidence"
4. Extortion Leverage: Showed the screenshot to Nyakuza as proof of what they could do
5. False Report: When Nyakuza refused to pay, attacker reported Nyakuza's account to Discord Trust & Safety using the manufactured evidence
6. Account Ban: Discord, seeing apparent CSAM solicitation from the account, banned Nyakuza

Why This Is Particularly Malicious

• Victim is framed for a serious crime (CSAM distribution)
• Evidence appears legitimate - the messages did come from the account
• Discord's automated systems likely flagged and actioned the report quickly
• Victim has limited recourse - appealing a CSAM ban is extremely difficult
• Psychological harm - victim is now associated with child exploitation material

Victim Impact

The Victim (Nyakuza) Lost:

Data Stolen (from Micro Stealer logs):

• 1 password
• 887 cookies
• 3 autofill entries
• Discord token (used for the attack)
• 2 payment cards on Discord account

Attribution

The "jetha" account (Discord ID: 117097036242878465) was compromised and used by the Micro Stealer operation, a Turkish cybercrime group.

Linguistic Evidence

• Turkish language in interface screenshots ("Nyakuza gruptan ayrıldı")
• Use of "PAYİNG" with Turkish dotted capital I (İ)
• Phrase construction consistent with non-native English speaker

Recommendations for the Victim

Legal Implications

The attacker committed multiple crimes:

1. Computer Fraud: Unauthorized access to computer systems (Micro Stealer)
2. Identity Theft: Using victim's accounts without authorization
3. Extortion: Demanding payment under threat of harm
4. False Report: Filing fraudulent abuse reports
5. Defamation: Falsely associating victim with CSAM
6. Cyberstalking: Continued harassment over hours

In Australia, this may violate:

• Criminal Code Act 1995 (Cth) - computer offenses
• Cybercrime Act 2001
• State stalking/harassment laws

Conclusion

This case demonstrates a sophisticated weaponization of platform trust and safety mechanisms. The attacker:

1. Compromised the victim via malware
2. Manufactured evidence of serious ToS violations using the victim's own account
3. Used the evidence for extortion
4. Executed a false report when extortion failed