Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operational Security

12/14/2018
10:10 AM
Scott Ferguson
Scott Ferguson
News Analysis-Security Now
50%
50%

Spam Emails Bring Bomb Threats to US Businesses, Schools

On Thursday, US businesses and schools began receiving a number of bomb threats that demanded Bitcoin as ransom. All these seem related to a series of spam emails.

A series of bomb threats emailed to businesses and schools throughout the US on Thursday sent law enforcement and security official scrambling to find the origin of what appears to be a massive spam campaign and hoax.

A significant number of companies, especially financial institutions, first began receiving the threatening emails on December 13. Later, several schools reported receiving bomb threats that demanded Bitcoin as ransom.

Security reporter Brian Krebs first reported on the emails on his blog.

(Source: iStock)
(Source: iStock)

While the bomb threats all appear to be hoaxes, it was enough for local and national law enforcement agencies to send out alerts, asking for calm as they investigated, although at least some businesses and schools were evacuated.

While the threats remain under investigation into Friday, it does appear that the spam emails might be related to a series of "sextortion" emails sent to individuals that also demanded money. In some cases, the attackers claimed to have hacked PCs with a Remote Access Trojan (RAT), but it's doubtful they had access to these tools. (See New 'Sextortion' Schemes Fueled by Stolen Passwords & Credentials.)

Mukul Kumar, chief information security officer and vice president of cyber practice at security vendor Cavirin believes that this week's series of threats was a copycat scheme, but that cybercriminals can cheaply gain access to malware and other malicious tools, making it harder to distinguish between what's a real threat and what's a hoax.

"As with any trend, there is the genuine product, and there are the copycats," Kumar wrote in an email to Security Now. "This is obviously the latter. However, given the availability of hacker tools for hire and personal data for rock-bottom prices, it will become harder to separate the two. The bad guys are looking for any vulnerabilities in one's security controls. This is just another example, with the hope that a small percentage of the targets will act on the email."

Kumar added that these types of incident should remind security teams to update software and filters, as well as review policies to keep employees safe.

"Potential disruption from what is obviously a false threat is just as real," he added. "And one of the risks here is if there had been links in the email that an employee could inadvertently click out of panic or confusion. Email filters would help here, not to mention blocking the source domain of the sender."

Related posts:

— Scott Ferguson is the managing editor of Light Reading and the editor of Security Now. Follow him on Twitter @sferguson_LR.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Zero Trust doesn't have to break your budget!
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-32243
PUBLISHED: 2021-06-16
FOGProject v1.5.9 is affected by a File Upload RCE (Authenticated).
CVE-2021-32244
PUBLISHED: 2021-06-16
Cross Site Scripting (XSS) in Moodle 3.10.3 allows remote attackers to execute arbitrary web script or HTML via the "Description" field.
CVE-2021-32245
PUBLISHED: 2021-06-16
In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS. These SVG files can contain malicious scripts. This file will be uploaded to the system and it will not be stripped or filtered. The user can create a link on the website pointing to "/storage/exp.svg" t...
CVE-2021-34201
PUBLISHED: 2021-06-16
D-Link DIR-2640-US 1.01B04 is vulnerable to Buffer Overflow. There are multiple out-of-bounds vulnerabilities in some processes of D-Link AC2600(DIR-2640). Local ordinary users can overwrite the global variables in the .bss section, causing the process crashes or changes.
CVE-2021-34203
PUBLISHED: 2021-06-16
D-Link DIR-2640-US 1.01B04 is vulnerable to Incorrect Access Control. Router ac2600 (dir-2640-us), when setting PPPoE, will start quagga process in the way of whole network monitoring, and this function uses the original default password and port. An attacker can easily use telnet to log in, modify ...