Hijacked email accounts complicate investigations into European bomb hoaxes
Bomb threats sent to thousands of schools across Europe this week originated from a compromised email account at Taiwan's Da-Yeh University, officials confirmed.
The university suspended the compromised account after it was used to send threatening emails claiming explosives had been planted in schools, prompting evacuations from Milan to Sicily.
Compromised Accounts
The use of hijacked accounts at legitimate institutions has enabled the hoaxers to send messages that pass authentication checks and avoid spam filters. Security company Proofpoint confirmed that recent threats examined all came from compromised accounts rather than forged addresses.
Stolen credentials are widely traded and exploited both by criminals and state-sponsored hackers.
Investigation Challenges
The technical details associated with the messages will largely resolve to the email providers' own services, creating potential dead ends if the hoaxers used anonymizing tools. The global spread across multiple jurisdictions complicates investigations requiring mutual legal assistance requests.
Coordinated Campaign
While no government has attributed the hoaxes to a specific actor, Ireland's government noted "it seems likely that this is a coordinated campaign of disruption." Proofpoint suggested aspects "could be consistent with a nation-state-aligned actor" but lacked sufficient evidence to confirm this.
The messages contained no malicious links or attachments, "suggesting the objective was disruption or intimidation rather than malware delivery," according to Mark Kelly of Proofpoint. Another threat was reportedly sent to Italian schools from the Philippines' Department of Education.
Related
