theDocumentId => 748298 Spam Emails Bring Bomb Threats to US Businesses, ...

Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operational Security

12/14/2018
10:10 AM
Scott Ferguson
Scott Ferguson
News Analysis-Security Now
50%
50%

Spam Emails Bring Bomb Threats to US Businesses, Schools

On Thursday, US businesses and schools began receiving a number of bomb threats that demanded Bitcoin as ransom. All these seem related to a series of spam emails.

A series of bomb threats emailed to businesses and schools throughout the US on Thursday sent law enforcement and security official scrambling to find the origin of what appears to be a massive spam campaign and hoax.

A significant number of companies, especially financial institutions, first began receiving the threatening emails on December 13. Later, several schools reported receiving bomb threats that demanded Bitcoin as ransom.

Security reporter Brian Krebs first reported on the emails on his blog.

(Source: iStock)
(Source: iStock)

While the bomb threats all appear to be hoaxes, it was enough for local and national law enforcement agencies to send out alerts, asking for calm as they investigated, although at least some businesses and schools were evacuated.

While the threats remain under investigation into Friday, it does appear that the spam emails might be related to a series of "sextortion" emails sent to individuals that also demanded money. In some cases, the attackers claimed to have hacked PCs with a Remote Access Trojan (RAT), but it's doubtful they had access to these tools. (See New 'Sextortion' Schemes Fueled by Stolen Passwords & Credentials.)

Mukul Kumar, chief information security officer and vice president of cyber practice at security vendor Cavirin believes that this week's series of threats was a copycat scheme, but that cybercriminals can cheaply gain access to malware and other malicious tools, making it harder to distinguish between what's a real threat and what's a hoax.

"As with any trend, there is the genuine product, and there are the copycats," Kumar wrote in an email to Security Now. "This is obviously the latter. However, given the availability of hacker tools for hire and personal data for rock-bottom prices, it will become harder to separate the two. The bad guys are looking for any vulnerabilities in one's security controls. This is just another example, with the hope that a small percentage of the targets will act on the email."

Kumar added that these types of incident should remind security teams to update software and filters, as well as review policies to keep employees safe.

"Potential disruption from what is obviously a false threat is just as real," he added. "And one of the risks here is if there had been links in the email that an employee could inadvertently click out of panic or confusion. Email filters would help here, not to mention blocking the source domain of the sender."

Related posts:

— Scott Ferguson is the managing editor of Light Reading and the editor of Security Now. Follow him on Twitter @sferguson_LR.

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-23416
PUBLISHED: 2021-07-28
This affects all versions of package curly-bracket-parser. When used as a template library, it does not properly sanitize the user input.
CVE-2021-23417
PUBLISHED: 2021-07-28
All versions of package deepmergefn are vulnerable to Prototype Pollution via deepMerge function.
CVE-2021-23415
PUBLISHED: 2021-07-28
This affects the package elFinder.AspNet before 1.1.1. The user-controlled file name is not properly sanitized before it is used to create a file system path.
CVE-2020-4974
PUBLISHED: 2021-07-28
IBM Jazz Foundation products are vulnerable to server side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 192434.
CVE-2020-5004
PUBLISHED: 2021-07-28
IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 192957.