Someone used an FBI email account to send out messages warning recipients of fake cyberattacks that targeted their systems.

Highlights of the Hack

According to Bleeping Computer, researchers at the Spamhaus Project observed two waves of fake emails reaching more than 100,000 mailboxes on November 13, 2021.

All the emails originated from “[email protected],” a legitimate email account associated with the FBI’s Law Enforcement Enterprise Portal (LEEP).

The messages warned recipients that a threat actor had infiltrated their systems and stolen their data.

“Our intelligence monitoring indicates exfiltration of several of your virtualized clusters in a sophisticated chain attack,” the email read, as quoted by Bleeping Computer. “We tried to blackhole the transit nodes used by this advanced persistent threat actor, however, there is a huge chance he will modify his attack with fastflux technologies, which he proxies through multiple global accelerators.”

The email even went on to identify who was “responsible” for the attack.

“We identified the threat actor to be Vinny Troia, who is believed to be affiliated with the extortion gang TheDarkOverlord. We highly recommend you to check your systems and IDS monitoring,” as elaborated by the email. “Beware this threat actor is currently working under inspection of the NCCIC, as we are dependent on some of his intelligence research we can not interfere physically within four hours, which could be enough time to cause severe damage to your infrastructure.”

Targeting a Security Professional’s Reputation

But malicious actors lie, and this instance was no exception.

In actuality, Vinny Troia is head of security research of the dark web intelligence companies NightLion and Shadowbyte. Troia said that someone named “pompompurin” contacted him a few hours before the spam email campaign and simply said “enjoy”.

He went on to say that pompompurin, an actor who attempted to damage the researcher’s reputation in the past, messages him every time before launching an attack against him.

In an interview with KrebsOnSecurity, pompompurin said that the hacking incident began with an exploration of the FBI’s LEEP. The actor discovered that the LEEP sent out an email confirmation containing a one-time password (OTP) from [email protected] at the time of the compromise. They also observed that the website leaked the OTP in the web page’s HTML code.

By editing the request sent to their browser and changing the text in the message, pompompurin was able to send an email to themselves from the FBI’s email account. They then created a script to automate sending out the hoax message referenced above to thousands of email addresses.

Not the First Security Incident Involving the FBI

The incident discussed above isn’t the first time that digital attackers have targeted the FBI.

Back in January 2017, for instance, the attacker CyberZeist broke into by exploiting a zero-day vulnerability in the Bureau’s website.

The malicious actor found several backup files in the process, reported Security Affairs. Subsequently, the threat actor leaked account data including names, passwords and emails on Pastebin.

How Organizations Can Defend Themselves

The hoax emails didn’t require recipients to perform any action, so there wasn’t anything specifically malicious about its contents.

That said, someone could have used the incident to distribute malware through a phishing attack.

This emphasizes the importance of security awareness training. Specifically, security teams can educate their employees to send emails with similar levels of urgency and frightening language to the IT department. Team members can then conduct the necessary research to protect their organization’s systems and data.

More from News

Hackers are Increasingly Targeting Auto Dealers

Auto dealerships are increasingly concerned with cybersecurity in the face of new regulations and an alarming rise in cyberattacks. The Second Annual Global State of Cybersecurity Report by CDK Global found that 85% of dealerships say cybersecurity is very or extremely important relative to other operational areas. Additionally, 89% say cybersecurity is more important than last year, a 12% increase. Not surprisingly, only 37% of auto retailers are confident in the current protection, which is a 21% decrease from 2021.…

LastPass Breaches Cast Doubt on Password Manager Safety

In 2022, LastPass suffered a string of security breaches which sparked concern among cyber professionals and those impacted by the intrusions. Some called into question the way LastPass handled and responded to the incident. In addition, the situation ignited a wider conversation about the risks linked to utilizing password managers. A password manager helps users generate strong passwords and safeguards them within a digital locker. A master password secures all data, which enables users to conveniently access all their passwords…

Good Guys Decrypt Ransomware Targeting Charitable Groups

Imagine you’re an IT manager amid a ransomware attack. While your team scrambles for solutions, the intruders demand a ransom. Of course, you don’t want to pay; you just want your files back. But as time ticks by and the extortionists turn up the heat, your bosses are about to give in and pay the ransom. But then, the FBI calls. “Don’t pay,” the agent says. “We’ve found someone who can crack the encryption.” Sound too good to be true?…

Threat Groups Offer $240k Salary to Tech Jobseekers

Dark web forums are home to various individuals interested in conducting illicit or questionable activities. These forums offer opportunities such as the transaction of stolen data, Malware-as-a-Service, hacking services and invitations to collaborate in hacktivism. Cyber crime team members are recruited directly from the source: the dark web. What does this activity look like? Kaspersky recently conducted an analysis of 155 dark web forums from January 2020 to June 2022. They examined job postings and resumes that contained information about…