Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operational Security

12/14/2018
10:10 AM
Scott Ferguson
Scott Ferguson
News Analysis-Security Now
50%
50%

Spam Emails Bring Bomb Threats to US Businesses, Schools

On Thursday, US businesses and schools began receiving a number of bomb threats that demanded Bitcoin as ransom. All these seem related to a series of spam emails.

A series of bomb threats emailed to businesses and schools throughout the US on Thursday sent law enforcement and security official scrambling to find the origin of what appears to be a massive spam campaign and hoax.

A significant number of companies, especially financial institutions, first began receiving the threatening emails on December 13. Later, several schools reported receiving bomb threats that demanded Bitcoin as ransom.

Security reporter Brian Krebs first reported on the emails on his blog.

(Source: iStock)
(Source: iStock)

While the bomb threats all appear to be hoaxes, it was enough for local and national law enforcement agencies to send out alerts, asking for calm as they investigated, although at least some businesses and schools were evacuated.

While the threats remain under investigation into Friday, it does appear that the spam emails might be related to a series of "sextortion" emails sent to individuals that also demanded money. In some cases, the attackers claimed to have hacked PCs with a Remote Access Trojan (RAT), but it's doubtful they had access to these tools. (See New 'Sextortion' Schemes Fueled by Stolen Passwords & Credentials.)

Mukul Kumar, chief information security officer and vice president of cyber practice at security vendor Cavirin believes that this week's series of threats was a copycat scheme, but that cybercriminals can cheaply gain access to malware and other malicious tools, making it harder to distinguish between what's a real threat and what's a hoax.

"As with any trend, there is the genuine product, and there are the copycats," Kumar wrote in an email to Security Now. "This is obviously the latter. However, given the availability of hacker tools for hire and personal data for rock-bottom prices, it will become harder to separate the two. The bad guys are looking for any vulnerabilities in one's security controls. This is just another example, with the hope that a small percentage of the targets will act on the email."

Kumar added that these types of incident should remind security teams to update software and filters, as well as review policies to keep employees safe.

"Potential disruption from what is obviously a false threat is just as real," he added. "And one of the risks here is if there had been links in the email that an employee could inadvertently click out of panic or confusion. Email filters would help here, not to mention blocking the source domain of the sender."

Related posts:

— Scott Ferguson is the managing editor of Light Reading and the editor of Security Now. Follow him on Twitter @sferguson_LR.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-16632
PUBLISHED: 2021-05-15
A XSS Vulnerability in /uploads/dede/action_search.php in DedeCMS V5.7 SP2 allows an authenticated user to execute remote arbitrary code via the keyword parameter.
CVE-2021-32073
PUBLISHED: 2021-05-15
DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remote code execution.
CVE-2021-33033
PUBLISHED: 2021-05-14
The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value.
CVE-2021-33034
PUBLISHED: 2021-05-14
In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value.
CVE-2019-25044
PUBLISHED: 2021-05-14
The block subsystem in the Linux kernel before 5.2 has a use-after-free that can lead to arbitrary code execution in the kernel context and privilege escalation, aka CID-c3e2219216c9. This is related to blk_mq_free_rqs and blk_cleanup_queue.