Someone used an FBI email account to send out messages warning recipients of fake cyberattacks that targeted their systems.

Highlights of the hack

According to Bleeping Computer, researchers at the Spamhaus Project observed two waves of fake emails reaching more than 100,000 mailboxes on November 13, 2021.

All the emails originated from “[email protected],” a legitimate email account associated with the FBI’s Law Enforcement Enterprise Portal (LEEP).

The messages warned recipients that a threat actor had infiltrated their systems and stolen their data.

“Our intelligence monitoring indicates exfiltration of several of your virtualized clusters in a sophisticated chain attack,” the email read, as quoted by Bleeping Computer. “We tried to blackhole the transit nodes used by this advanced persistent threat actor, however, there is a huge chance he will modify his attack with fastflux technologies, which he proxies through multiple global accelerators.”

The email even went on to identify who was “responsible” for the attack.

“We identified the threat actor to be Vinny Troia, who is believed to be affiliated with the extortion gang TheDarkOverlord. We highly recommend you to check your systems and IDS monitoring,” as elaborated by the email. “Beware this threat actor is currently working under inspection of the NCCIC, as we are dependent on some of his intelligence research we can not interfere physically within four hours, which could be enough time to cause severe damage to your infrastructure.”

Targeting a security professional’s reputation

But malicious actors lie, and this instance was no exception.

In actuality, Vinny Troia is head of security research of the dark web intelligence companies NightLion and Shadowbyte. Troia said that someone named “pompompurin” contacted him a few hours before the spam email campaign and simply said “enjoy”.

He went on to say that pompompurin, an actor who attempted to damage the researcher’s reputation in the past, messages him every time before launching an attack against him.

In an interview with KrebsOnSecurity, pompompurin said that the hacking incident began with an exploration of the FBI’s LEEP. The actor discovered that the LEEP sent out an email confirmation containing a one-time password (OTP) from [email protected] at the time of the compromise. They also observed that the website leaked the OTP in the web page’s HTML code.

By editing the request sent to their browser and changing the text in the message, pompompurin was able to send an email to themselves from the FBI’s email account. They then created a script to automate sending out the hoax message referenced above to thousands of email addresses.

Not the first security incident involving the FBI

The incident discussed above isn’t the first time that digital attackers have targeted the FBI.

Back in January 2017, for instance, the attacker CyberZeist broke into FBI.gov by exploiting a zero-day vulnerability in the Bureau’s website.

The malicious actor found several backup files in the process, reported Security Affairs. Subsequently, the threat actor leaked account data including names, passwords and emails on Pastebin.

How organizations can defend themselves

The hoax emails didn’t require recipients to perform any action, so there wasn’t anything specifically malicious about its contents.

That said, someone could have used the incident to distribute malware through a phishing attack.

This emphasizes the importance of security awareness training. Specifically, security teams can educate their employees to send emails with similar levels of urgency and frightening language to the IT department. Team members can then conduct the necessary research to protect their organization’s systems and data.

More from News

Securing critical infrastructure with the carrot and stick

4 min read - It wasn’t long ago that cybersecurity was a fringe topic of interest. Now, headline-making breaches impact large numbers of everyday citizens. Entire cities find themselves under cyberattack. In a short time, cyber has taken an important place in the national discourse. Today, governments, regulatory agencies and companies must work together to confront this growing threat. So how is the federal government bolstering security for critical infrastructure? It looks like they are using a carrot-and-stick approach. Back in March 2022, the…

650,000 cyber jobs are now vacant: How to tackle the risk

4 min read - How far is the United States behind in filing cybersecurity jobs? As per Rep. Andrew Garbarino, R-N.Y., Chairman of the HHS Cybersecurity and Infrastructure Protection Subcommittee, overseas adversaries have a workforce advantage over FBI cyber personnel of 50 to one. His statements were made during a recent subcommittee hearing titled “Growing the National Cybersecurity Talent Pipeline.” Meanwhile, recent CyberSeek data shows over 650,000 cyber jobs to fill nationwide. Given the rising rate of cyberattacks, these numbers are truly alarming. How…

Will data backups save you from ransomware? Think again

4 min read - Backups are an essential part of any solid anti-ransomware strategy. In fact, research shows that the median recovery cost for ransomware victims that used backups is half the cost incurred by those that paid the ransom. But not all data backup approaches are created equal. A separate report found that in 93% of ransomware incidents, threat actors actively target backup repositories. This results in 75% of victims losing at least some of their backups during the attack, and more than…

Should you worry about state-sponsored attacks? Maybe not.

4 min read - More than ever, state-sponsored cyber threats worry security professionals. In fact, nation-state activity alerts increased against critical infrastructure from 20% to 40% from 2021 to 2022, according to a recent Microsoft Digital Defense Report. With the advent of the hybrid war in Ukraine, nation-state actors are launching increasingly sophisticated attacks. But is this the most prominent danger facing companies today? While nation-state-based attacks cannot be ignored, it looks like insider cyber incidents are far more common. In fact, for the…