Threat reportThreat IntelligenceTL-2026-3615
Digital Forensics Corporation sextortion 'recovery' scam: FTC alleges $60M taken from victims
Digital Forensics Corporation sextortion 'recovery' scam (TL-2026-3615), also tracked as FTC v. Digital Forensics Corporation, LLC, is a medium-severity tracked intrusion set, first published 2026-10-15. It is attributed to Dmitry Belkin with medium confidence, affects N/A Sextortion victims (consumers); advertising platforms (Google, maps to 5 MITRE ATT&CK techniques (T1583.001, T1583.008, T1585), and is covered by 9 detection rules and 15 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 5MITRE ATT&CK
- Actors
- 1Dmitry Belkin
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 15Indicators of compromise
Key facts for TL-2026-3615
- Threat ID
- TL-2026-3615
- Also known as
- FTC v. Digital Forensics Corporation, LLC
- Severity
- MEDIUM
- Status
- MONITORING
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution
- Dmitry Belkin
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- consumers, military
- Target regions
- North America
- Detection rules
- 9
- Indicators of compromise
- 15
How Digital Forensics Corporation sextortion 'recovery' scam works
The FTC alleges Digital Forensics Corporation LLC, owner Dmitry Belkin and 11 affiliated companies took at least $60 million from sextortion victims for 'Phase 1' assistance packages that were frequently not delivered. A federal court granted a temporary restraining order halting the business.
On October 13, 2026 the U.S. Federal Trade Commission filed FTC v. Digital Forensics Corporation, LLC, et al. in the U.S. District Court for the Northern District of Ohio (case 1:26-cv-02615 as reported by a third-party tracker) against Digital Forensics Corporation LLC (DFC), its CEO/owner Dmitry Belkin and 11 other companies, many listing 4400 Renaissance Parkway, Warrensville Heights, Ohio. The Commission voted 2-0 to authorize the complaint and the court granted a temporary restraining order halting the defendants' activities pending further proceedings. The conduct is alleged to have run from February 2023 through July 2026 and to have netted at least $60 million.
Per the FTC, the defendants advertised on search engines, video platforms and social media (Google, YouTube, X and others) and used fear-based telemarketing to reach consumers in crisis, including military members and married individuals. Victims were sold 'Phase 1' packages priced from $1,499 to $20,000 that were promised to stop the attack, pinpoint the sextortionist's location through a 'tracking campaign', deliver a detailed investigative report, notify law enforcement and send a cease-and-desist letter. The FTC alleges that in numerous instances none of this was delivered: staff routinely only changed victim account settings to block the sextortionist (something victims can do themselves), fabricated chat transcripts and investigative information, and reused pre-saved coordinates, typically for Nigeria and the Philippines, to present as the perpetrator's location. Victims were also reportedly discouraged from blocking blackmailers, contrary to law-enforcement and expert advice, and were pressured into additional 'Phase 2' monitoring/reporting services costing thousands more. Installment financing with interest up to 18% was reportedly offered and refunds refused citing contract policies.
The FTC further alleges review fraud: India-based employees wrote fake reviews, positive reviews were purchased from Uber drivers who never used the service, customers were coerced into posting positive reviews before receiving services, legitimate negative reviews were suppressed, and complaints were reportedly directed to fake BBB websites. Alleged violations include the FTC Act, Telemarketing Sales Rule, Reviews and Testimonials Rule and Gramm-Leach-Bliley Act. This is a fraud-ecosystem item with no CVE, malware or technical IOCs; it is relevant to defenders as victim-targeting abuse context (secondary exploitation of sextortion victims). Severity is an analyst judgment, not source-stated. Allegations are unproven claims in a civil complaint.
MITRE ATT&CK techniques used in TL-2026-3615
Resource Development
T1583.001 Domains; T1583.008 Malvertising; T1585 Establish Accounts
Impact
Defense Evasion
Affected products and versions in Digital Forensics Corporation sextortion 'recovery' scam
- N/A — Sextortion victims (consumers); advertising platforms (Google, YouTube, X) used for promotion
Remediation for Digital Forensics Corporation sextortion 'recovery' scam
Immediate actions
- Sextortion victims: stop paying, preserve evidence (screenshots, usernames, URLs), and report to FBI (tips.fbi.gov), NCMEC CyberTipline and the platform
- Report 'sextortion help' fraud to ReportFraud.ftc.gov
- Victims can block the blackmailer and tighten account privacy settings themselves at no cost
Workarounds
- Verify any 'recovery' or 'forensics' firm independently before payment; be wary of fear-based unsolicited telemarketing, upsell tiers and pre-purchase review requests
Longer-term hardening
- Educate users and staff that legitimate law enforcement and NCMEC do not charge for sextortion assistance
- Use NCMEC Take It Down / StopNCII.org for image removal rather than paid intermediaries
- Platform trust-and-safety teams: review ad policy enforcement for paid 'sextortion/blackmail help' advertising
Timeline of Digital Forensics Corporation sextortion 'recovery' scam
- Start of the period (February 2023) during which the FTC alleges Digital Forensics Corporation operated its sextortion 'assistance' scheme
- USA Today expose (March 2025) reported customers' complaints about the firm's sextortion help services
- End of the alleged conduct period (July 2026) per the FTC complaint
- Federal court grants the FTC's request for a temporary restraining order halting the defendants' activities
- FTC files FTC v. Digital Forensics Corporation, LLC, et al. in N.D. Ohio against Dmitry Belkin and 12 companies; Commission vote 2-0
- Malwarebytes publishes analysis of the FTC allegations: at least $60 million taken, Phase 1 packages of $1,499-$20,000
Sources cited for Digital Forensics Corporation sextortion 'recovery' scam
- Sextortion 'help' firm took $60 million from victims, FTC alleges (Malwarebytes)
- FTC Sues Operator of Sextortion Relief Scheme for Misleading Consumers into Believing it Would Identify Criminals and End Sextortion Attacks
- FTC complaint: FTC v. Digital Forensics Corporation, LLC, et al.
- FTC: Company netted at least $60 million charging sextortion victims for help it didn't provide (The Record)
- Digital Forensics accused by US FTC of misleading 'sextortion' victims (MLex)
- FTC halts Ohio firm accused of scamming sextortion victims
- FTC secures restraining order against Digital Forensics LLC (dig.watch)
Detection coverage for TL-2026-3615
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3615 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.