Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operational Security

12/14/2018
10:10 AM
Scott Ferguson
Scott Ferguson
News Analysis-Security Now
50%
50%

Spam Emails Bring Bomb Threats to US Businesses, Schools

On Thursday, US businesses and schools began receiving a number of bomb threats that demanded Bitcoin as ransom. All these seem related to a series of spam emails.

A series of bomb threats emailed to businesses and schools throughout the US on Thursday sent law enforcement and security official scrambling to find the origin of what appears to be a massive spam campaign and hoax.

A significant number of companies, especially financial institutions, first began receiving the threatening emails on December 13. Later, several schools reported receiving bomb threats that demanded Bitcoin as ransom.

Security reporter Brian Krebs first reported on the emails on his blog.

(Source: iStock)
(Source: iStock)

While the bomb threats all appear to be hoaxes, it was enough for local and national law enforcement agencies to send out alerts, asking for calm as they investigated, although at least some businesses and schools were evacuated.

While the threats remain under investigation into Friday, it does appear that the spam emails might be related to a series of "sextortion" emails sent to individuals that also demanded money. In some cases, the attackers claimed to have hacked PCs with a Remote Access Trojan (RAT), but it's doubtful they had access to these tools. (See New 'Sextortion' Schemes Fueled by Stolen Passwords & Credentials.)

Mukul Kumar, chief information security officer and vice president of cyber practice at security vendor Cavirin believes that this week's series of threats was a copycat scheme, but that cybercriminals can cheaply gain access to malware and other malicious tools, making it harder to distinguish between what's a real threat and what's a hoax.

"As with any trend, there is the genuine product, and there are the copycats," Kumar wrote in an email to Security Now. "This is obviously the latter. However, given the availability of hacker tools for hire and personal data for rock-bottom prices, it will become harder to separate the two. The bad guys are looking for any vulnerabilities in one's security controls. This is just another example, with the hope that a small percentage of the targets will act on the email."

Kumar added that these types of incident should remind security teams to update software and filters, as well as review policies to keep employees safe.

"Potential disruption from what is obviously a false threat is just as real," he added. "And one of the risks here is if there had been links in the email that an employee could inadvertently click out of panic or confusion. Email filters would help here, not to mention blocking the source domain of the sender."

Related posts:

— Scott Ferguson is the managing editor of Light Reading and the editor of Security Now. Follow him on Twitter @sferguson_LR.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Enterprises are Attacking the Cybersecurity Problem
Concerns over supply chain vulnerabilities and attack visibility drove some significant changes in enterprise cybersecurity strategies over the past year. Dark Reading's 2021 Strategic Security Survey showed that many organizations are staying the course regarding the use of a mix of attack prevention and threat detection technologies and practices for dealing with cyber threats.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-42258
PUBLISHED: 2021-10-22
BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation. SQL injection can, for example, use the txtID (aka username) parameter. Successful exploitation can include ...
CVE-2020-28968
PUBLISHED: 2021-10-22
Draytek VigorAP 1000C contains a stored cross-site scripting (XSS) vulnerability in the RADIUS Setting - RADIUS Server Configuration module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the username input field.
CVE-2020-28969
PUBLISHED: 2021-10-22
Aplioxio PDF ShapingUp 5.0.0.139 contains a buffer overflow which allows attackers to cause a denial of service (DoS) via a crafted PDF file.
CVE-2020-36485
PUBLISHED: 2021-10-22
Portable Ltd Playable v9.18 was discovered to contain an arbitrary file upload vulnerability in the filename parameter of the upload module. This vulnerability allows attackers to execute arbitrary code via a crafted JPEG file.
CVE-2020-36486
PUBLISHED: 2021-10-22
Swift File Transfer Mobile v1.1.2 and below was discovered to contain a cross-site scripting (XSS) vulnerability via the 'path' parameter of the 'list' and 'download' exception-handling.