January 5, 2022 By David Bisson 2 min read

Someone used an FBI email account to send out messages warning recipients of fake cyberattacks that targeted their systems.

Highlights of the hack

According to Bleeping Computer, researchers at the Spamhaus Project observed two waves of fake emails reaching more than 100,000 mailboxes on November 13, 2021.

All the emails originated from “[email protected],” a legitimate email account associated with the FBI’s Law Enforcement Enterprise Portal (LEEP).

The messages warned recipients that a threat actor had infiltrated their systems and stolen their data.

“Our intelligence monitoring indicates exfiltration of several of your virtualized clusters in a sophisticated chain attack,” the email read, as quoted by Bleeping Computer. “We tried to blackhole the transit nodes used by this advanced persistent threat actor, however, there is a huge chance he will modify his attack with fastflux technologies, which he proxies through multiple global accelerators.”

The email even went on to identify who was “responsible” for the attack.

“We identified the threat actor to be Vinny Troia, who is believed to be affiliated with the extortion gang TheDarkOverlord. We highly recommend you to check your systems and IDS monitoring,” as elaborated by the email. “Beware this threat actor is currently working under inspection of the NCCIC, as we are dependent on some of his intelligence research we can not interfere physically within four hours, which could be enough time to cause severe damage to your infrastructure.”

Targeting a security professional’s reputation

But malicious actors lie, and this instance was no exception.

In actuality, Vinny Troia is head of security research of the dark web intelligence companies NightLion and Shadowbyte. Troia said that someone named “pompompurin” contacted him a few hours before the spam email campaign and simply said “enjoy”.

He went on to say that pompompurin, an actor who attempted to damage the researcher’s reputation in the past, messages him every time before launching an attack against him.

In an interview with KrebsOnSecurity, pompompurin said that the hacking incident began with an exploration of the FBI’s LEEP. The actor discovered that the LEEP sent out an email confirmation containing a one-time password (OTP) from [email protected] at the time of the compromise. They also observed that the website leaked the OTP in the web page’s HTML code.

By editing the request sent to their browser and changing the text in the message, pompompurin was able to send an email to themselves from the FBI’s email account. They then created a script to automate sending out the hoax message referenced above to thousands of email addresses.

Not the first security incident involving the FBI

The incident discussed above isn’t the first time that digital attackers have targeted the FBI.

Back in January 2017, for instance, the attacker CyberZeist broke into FBI.gov by exploiting a zero-day vulnerability in the Bureau’s website.

The malicious actor found several backup files in the process, reported Security Affairs. Subsequently, the threat actor leaked account data including names, passwords and emails on Pastebin.

How organizations can defend themselves

The hoax emails didn’t require recipients to perform any action, so there wasn’t anything specifically malicious about its contents.

That said, someone could have used the incident to distribute malware through a phishing attack.

This emphasizes the importance of security awareness training. Specifically, security teams can educate their employees to send emails with similar levels of urgency and frightening language to the IT department. Team members can then conduct the necessary research to protect their organization’s systems and data.

More from News

White House cements CISA’s role as national coordinator for cybersecurity

2 min read - In 2013, the Obama Administration rolled out "The Presidential Policy Directive (PPD) on Critical Infrastructure Security and Resilience", a forerunner to the Cybersecurity and Infrastructure Security Agency (CISA), created "to strengthen and maintain secure, functioning and resilient critical infrastructure."The directive was groundbreaking in 2013, noting the importance of the rising risk of cyberattacks against critical infrastructure. But as cyber risks are constantly shifting, every cybersecurity program needs to be re-evaluated, and CISA is no exception. That’s why, in April 2024, President…

Debate rages over DMCA Section 1201 exemption for generative AI

3 min read - The Digital Millennium Copyright Act (DMCA) is a federal law that protects copyright holders from online theft. The DMCA covers music, movies, text and anything else under copyright. The DMCA also makes it illegal to hack technologies that copyright owners use to protect their works against infringement. These technologies can include encryption, password protection or other measures. These provisions are commonly referred to as the “Anti-Circumvention” provisions or “Section 1201”. Now, a fierce debate is brewing over whether to allow…

CISA Malware Next-Gen Analysis now available to public sector

2 min read - One of the main goals of the Cybersecurity and Infrastructure Security Agency (CISA) is to promote security collaboration across the public and private sectors. CISA firmly believes that partnerships and effective coordination are essential to maintaining critical infrastructure security and cyber resilience. In faithfulness to this mission, CISA is now offering the Malware Next-Generation Analysis program to businesses and other organizations. This service has been available to government and military workers since November 2023 but is now available to the…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today