Email addresses used in European school bomb hoaxes spotted in old infostealer logs
Two email addresses used to send bomb threats that disrupted thousands of Italian schools this week were found exposed in infostealer logs for over a year, experts say.
Key points
- Researchers at Hudson Rock looked into the two university email addresses used to send the bomb threats.
- Understanding whether the sender authenticated into the account could rule out spoofing, but would not in itself provide proof that the sender used a corresponding password taken from an infostealer log, Hudson Rock noted.
- The researchers said that in any case where a credential is detected among infostealer logs, the organizations responsible for those accounts must contain them, revoke their access, rotate secrets, and go looking for suspicious activity.
The experts said that the two addresses in infostealer logs do not strictly mean that those behind the bomb threats gained access to the accounts using the previous infostealer compromise.
Additional details
- The other, from Taiwan's Dayeh University, was found among the 284 million addresses included in the massive AlienTXTBASE infostealer dump, dated February 2025.
- The researchers said that they would need access to details such as the email headers, and data from email providers, including sign-in events and audit records, that could show them more about who sent the email and from what session.
- Investigators and the judiciary, along with their European colleagues, are working to determine who is behind them." Schools in France, Ireland, Northern Ireland, and Scotland also received similar emails this week.
- "An account associated with an ordinary university user can become a means of reaching schools, frightening families, and consuming emergency resources." The threats Around 6,300 of Italy's 7,476 state schools received fake bomb threat emails between November 11-12, although only around 390 of them evacuated their respective buildings.
- Various theories have been reported about the identity of the sender, ranging from a teacher based in the Philippines whose email was compromised to a Russia-backed disruption operation.
How this summary was made: extractive summary — built from the sources' own reporting. It is drawn only from the reporting of the sources listed below — read the originals for full detail. How we summarize →
Advertisement
Every article behind this summary — 1 article from 1 outlet
Get stories like this in your inbox.
Subscribe — it's freeOne free email at 6am — your topics, deduplicated, five minutes. No account, no paywall.