European Schools Targeted by Bomb Hoaxes via Hijacked University Email Accounts
Thousands of European schools received bomb threats this week, originating from a compromised email account at Taiwan's Da-Yeh University, complicating investigations into a series of coordinated disruption campaigns.
Thousands of European schools were inundated with bomb threats this week, with the malicious messages originating from a compromised email account belonging to Taiwan's Da-Yeh University. This incident marks the latest in a series of coordinated hoax threats that have targeted airports and newsrooms, leveraging legitimate institutional email accounts to bypass security measures and sow discord.
Da-Yeh University confirmed it had suspended the account used to send the emails on Wednesday, according to Taiwan's Central News Agency. The use of hijacked accounts from seemingly trustworthy institutions allows the perpetrators to circumvent authentication checks and avoid spam filters, significantly complicating efforts by law enforcement and cybersecurity professionals to trace the origin of the threats. Security firm Proofpoint noted that recent threats they examined all originated from compromised accounts rather than forged addresses, highlighting the effectiveness of this tactic.
While no government has officially attributed these hoaxes to a specific actor, the Irish government suggested it was likely a coordinated campaign of disruption. Proofpoint indicated that while some aspects of the campaign could align with nation-state-aligned actors, definitive evidence remains elusive. The technical trails associated with these emails often lead back to the email providers' own services, and login records can become dead ends if anonymizing tools like VPNs or proxy networks were employed by the hoaxers.
The scale of the attacks became apparent on Wednesday when thousands of Italian state schools received emails threatening "genocide" and claiming explosives had been planted, prompting evacuations across the country. Similar threats were also sent to hundreds of schools in Scotland, Northern Ireland, and the Republic of Ireland. Police Scotland reported that approximately a thousand Scottish schools received a threatening email, with similar messages reaching other schools across the United Kingdom.
Authorities in affected regions, including Police Scotland and Ireland's An Garda Síochána, assessed the threats as non-credible and advised against evacuations. However, the coordinated nature and widespread impact underscore a deliberate attempt to disrupt educational institutions and public services. Another threat was reportedly sent to Italian schools from an address belonging to the Philippines' Department of Education, further complicating attribution.
Proofpoint observed threats targeting around 20 organizations in the preceding week, predominantly in Europe, including newsrooms and airports. The messages lacked malicious links or attachments, suggesting the primary objective was disruption and intimidation rather than malware delivery or credential theft. Some emails claimed the senders had access to compromised computer systems and experimented with "multithreading" to send the messages, indicating a degree of technical sophistication.
The attribution of these threats remains challenging, with some emails signed by "fighters of the Male State," a Russian anti-feminist movement, and others by "Mikhail Andropov." However, these signatures do not provide conclusive evidence of the perpetrators. In Ireland, police believe the threats originated outside the country and were intended to "sow discord," particularly in light of the European Political Community summit held in Dublin, which was under a heightened security operation.
Investigators are facing significant hurdles due to the global spread of the compromised accounts and the need for cross-jurisdictional cooperation, which can be a slow process. The ongoing nature of these attacks, coupled with the use of sophisticated evasion techniques, presents a persistent challenge for cybersecurity professionals and law enforcement agencies attempting to identify and neutralize the responsible actors.