Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operational Security

12/14/2018
10:10 AM
Scott Ferguson
Scott Ferguson
News Analysis-Security Now
50%
50%

Spam Emails Bring Bomb Threats to US Businesses, Schools

On Thursday, US businesses and schools began receiving a number of bomb threats that demanded Bitcoin as ransom. All these seem related to a series of spam emails.

A series of bomb threats emailed to businesses and schools throughout the US on Thursday sent law enforcement and security official scrambling to find the origin of what appears to be a massive spam campaign and hoax.

A significant number of companies, especially financial institutions, first began receiving the threatening emails on December 13. Later, several schools reported receiving bomb threats that demanded Bitcoin as ransom.

Security reporter Brian Krebs first reported on the emails on his blog.

(Source: iStock)
(Source: iStock)

While the bomb threats all appear to be hoaxes, it was enough for local and national law enforcement agencies to send out alerts, asking for calm as they investigated, although at least some businesses and schools were evacuated.

While the threats remain under investigation into Friday, it does appear that the spam emails might be related to a series of "sextortion" emails sent to individuals that also demanded money. In some cases, the attackers claimed to have hacked PCs with a Remote Access Trojan (RAT), but it's doubtful they had access to these tools. (See New 'Sextortion' Schemes Fueled by Stolen Passwords & Credentials.)

Mukul Kumar, chief information security officer and vice president of cyber practice at security vendor Cavirin believes that this week's series of threats was a copycat scheme, but that cybercriminals can cheaply gain access to malware and other malicious tools, making it harder to distinguish between what's a real threat and what's a hoax.

"As with any trend, there is the genuine product, and there are the copycats," Kumar wrote in an email to Security Now. "This is obviously the latter. However, given the availability of hacker tools for hire and personal data for rock-bottom prices, it will become harder to separate the two. The bad guys are looking for any vulnerabilities in one's security controls. This is just another example, with the hope that a small percentage of the targets will act on the email."

Kumar added that these types of incident should remind security teams to update software and filters, as well as review policies to keep employees safe.

"Potential disruption from what is obviously a false threat is just as real," he added. "And one of the risks here is if there had been links in the email that an employee could inadvertently click out of panic or confusion. Email filters would help here, not to mention blocking the source domain of the sender."

Related posts:

— Scott Ferguson is the managing editor of Light Reading and the editor of Security Now. Follow him on Twitter @sferguson_LR.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Enterprise Cybersecurity Plans in a Post-Pandemic World
Download the Enterprise Cybersecurity Plans in a Post-Pandemic World report to understand how security leaders are maintaining pace with pandemic-related challenges, and where there is room for improvement.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-36363
PUBLISHED: 2021-09-28
Nagios XI before 5.8.5 has Incorrect Permission Assignment for migrate.php.
CVE-2021-36364
PUBLISHED: 2021-09-28
Nagios XI before 5.8.5 incorrectly allows backup_xi.sh wildcards.
CVE-2021-36365
PUBLISHED: 2021-09-28
Nagios XI before 5.8.5 has Incorrect Permission Assignment for repairmysql.sh.
CVE-2021-36366
PUBLISHED: 2021-09-28
Nagios XI before 5.8.5 incorrectly allows manage_services.sh wildcards.
CVE-2021-29360
PUBLISHED: 2021-09-28
A buffer overflow vulnerability in FORMATS!Read_Utah_RLE+0x37a of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted RLE file.