January 5, 2022 By David Bisson 2 min read

Someone used an FBI email account to send out messages warning recipients of fake cyberattacks that targeted their systems.

Highlights of the hack

According to Bleeping Computer, researchers at the Spamhaus Project observed two waves of fake emails reaching more than 100,000 mailboxes on November 13, 2021.

All the emails originated from “[email protected],” a legitimate email account associated with the FBI’s Law Enforcement Enterprise Portal (LEEP).

The messages warned recipients that a threat actor had infiltrated their systems and stolen their data.

“Our intelligence monitoring indicates exfiltration of several of your virtualized clusters in a sophisticated chain attack,” the email read, as quoted by Bleeping Computer. “We tried to blackhole the transit nodes used by this advanced persistent threat actor, however, there is a huge chance he will modify his attack with fastflux technologies, which he proxies through multiple global accelerators.”

The email even went on to identify who was “responsible” for the attack.

“We identified the threat actor to be Vinny Troia, who is believed to be affiliated with the extortion gang TheDarkOverlord. We highly recommend you to check your systems and IDS monitoring,” as elaborated by the email. “Beware this threat actor is currently working under inspection of the NCCIC, as we are dependent on some of his intelligence research we can not interfere physically within four hours, which could be enough time to cause severe damage to your infrastructure.”

Targeting a security professional’s reputation

But malicious actors lie, and this instance was no exception.

In actuality, Vinny Troia is head of security research of the dark web intelligence companies NightLion and Shadowbyte. Troia said that someone named “pompompurin” contacted him a few hours before the spam email campaign and simply said “enjoy”.

He went on to say that pompompurin, an actor who attempted to damage the researcher’s reputation in the past, messages him every time before launching an attack against him.

In an interview with KrebsOnSecurity, pompompurin said that the hacking incident began with an exploration of the FBI’s LEEP. The actor discovered that the LEEP sent out an email confirmation containing a one-time password (OTP) from [email protected] at the time of the compromise. They also observed that the website leaked the OTP in the web page’s HTML code.

By editing the request sent to their browser and changing the text in the message, pompompurin was able to send an email to themselves from the FBI’s email account. They then created a script to automate sending out the hoax message referenced above to thousands of email addresses.

Not the first security incident involving the FBI

The incident discussed above isn’t the first time that digital attackers have targeted the FBI.

Back in January 2017, for instance, the attacker CyberZeist broke into FBI.gov by exploiting a zero-day vulnerability in the Bureau’s website.

The malicious actor found several backup files in the process, reported Security Affairs. Subsequently, the threat actor leaked account data including names, passwords and emails on Pastebin.

How organizations can defend themselves

The hoax emails didn’t require recipients to perform any action, so there wasn’t anything specifically malicious about its contents.

That said, someone could have used the incident to distribute malware through a phishing attack.

This emphasizes the importance of security awareness training. Specifically, security teams can educate their employees to send emails with similar levels of urgency and frightening language to the IT department. Team members can then conduct the necessary research to protect their organization’s systems and data.

More from News

CISA hit by hackers, key systems taken offline

3 min read - The Cybersecurity and Infrastructure Security Agency (CISA) — responsible for cybersecurity and infrastructure protection across all levels of the United States government — has been hacked.“About a month ago, CISA identified activity indicating the exploitation of vulnerabilities in Ivanti products the agency uses,” a CISA spokesperson announced.In late February, CISA had already issued a warning that cyber threat actors are exploiting previously identified vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure gateways. Ivanti Connect Secure is a widely deployed…

DOJ’s crackdown: A brief look at hacker group takedowns

3 min read - The Department of Justice (DOJ) is ramping up efforts focused on disrupting cyber criminal organizations operating within and outside of United States borders. The dismantling of Volt Typhoon, a prolific hacker collective, marked a turning point in the DOJ's offensive against cyber crime syndicates. The group was notorious for its brazen cryptocurrency scams and heists. Through coordinated global law enforcement efforts, individuals linked to the organization were apprehended, assets were frozen and critical infrastructure was seized. The success of the…

Will watermarking save the 2024 election from a deepfake debacle?

3 min read - It seems like only months ago deepfakes were still just a curiosity. Now, deepfakes are a real and present danger. And in an election year, the influence of AI-manipulated content could be disastrous. During a recent Washington Post Live event, Anne Neuberger, deputy national security adviser for cyber and emerging technologies at the White House, commented on the rising risk of deepfakes. Incidents have already occurred, such as the recent fake-Biden robocall meant to discourage voters ahead of the New…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today