The Record reports hijacked accounts sent European bomb hoax emails

What happened

According to The Record, bomb threats sent to thousands of schools across Europe this week came from a compromised email account at a Taiwanese university. The Record says the messages are the latest in a series of hoax threats that also targeted airports and newsrooms using messages sent from legitimate institutions. The Record reports that Taiwan’s Da-Yeh University said it suspended the account used on Wednesday, citing Taiwan’s Central News Agency. The Record also says officials in Bogotá said last week they were investigating a potential hack of a city health agency where other hoax emails originated.

Proofpoint told Recorded Future News that the threats it examined last week all came from compromised accounts rather than forged addresses. Abnormal Security told the outlet it detected another hoax from what appeared to be a compromised account on a Lithuanian domain. The Record reports that using real accounts lets messages pass authentication checks and avoid spam filters, and that it complicates investigations. Login records could hit dead ends if VPNs or proxy networks were used, and evidence would have to be sought across jurisdictions through slow mutual legal assistance requests.

On the impact, The Record reports the following:

• An email claiming explosives had been planted was sent to thousands of Italian state schools on Wednesday, and The Record says it prompted evacuations from Milan to Sicily.
• Similar messages reached hundreds of schools in Scotland, Northern Ireland and the Republic of Ireland.
• Police Scotland said around a thousand Scottish schools received the message and that it was being treated as a hoax with nothing to suggest a credible threat.
• An Garda Síochána assessed the threats as “not credible” and was not advising schools to evacuate.
• Proofpoint said it saw threats last week targeting roughly 20 organizations, most in Europe, including at least a dozen newsrooms and several airports. It said the messages contained no malicious links or attachments.

Not confirmed: who sent the emails. According to The Record, no government has attributed the hoaxes. Ireland’s government said it “seems likely that this is a coordinated campaign of disruption”. Proofpoint said aspects “could be consistent with a nation-state-aligned actor” but it lacks enough evidence to conclude that. The Record says it is not known whether the waves are one campaign or include copycats. Signatures such as “fighters of the Male State” and “Mikhail Andropov” do not establish the sender to any evidentiary standard, and the founder of the Male State movement has denied involvement, according to The Record.

Am I affected?

The Record’s report lists these recipients and sources of the hoax emails:

• Schools in Italy, Scotland, Northern Ireland and the Republic of Ireland, and other UK schools.
• Newsrooms and airports, reported by Proofpoint.
• Accounts at a Taiwanese university, a Colombian city health agency, a Lithuanian domain and, reportedly, the Philippines’ Department of Education. The Record says the Philippine department did not immediately respond to a request for comment.

If you hold accounts at an institution like these, the sources do not say how the accounts were taken over, so the entry point is not confirmed. No CVE or software flaw is mentioned in the sources.

What to do now

1. Follow the guidance of your local police for any threat email. The Record cites police in Scotland and Ireland assessing the messages as hoaxes and not advising evacuation, but each situation is assessed by police, not by this advisory.
2. Do not rely on sender authentication or a trusted domain alone to judge such a message. The Record reports the messages passed authentication checks because they came from genuine accounts.
3. Check whether any of your own mailbox accounts were used to send messages you did not write. This step is general practice and is not drawn from the sources.
4. Watch for updates on attribution and on the account compromises. As of the report, the technical cause is not confirmed.

Sources

• The Record: Hijacked email accounts complicate investigations into European bomb hoaxes