Email addresses used in European school bomb hoaxes spotted in old infostealer logs

Two email addresses used to send bomb threats that disrupted thousands of Italian schools this week were found exposed in infostealer logs for over a year, experts say.

Researchers at Hudson Rock looked into the two university email addresses used to send the bomb threats. One, from Egypt's Kafrelsheikh University, was scooped up by Vidar - a cybercrime tool that steals saved account credentials and passwords from an infected computer and leaks them to attackers - as far back as October 2021. The other, from Taiwan's Dayeh University, was found among the 284 million addresses included in the massive AlienTXTBASE infostealer dump, dated February 2025.

The experts said that the two addresses in infostealer logs do not strictly mean that those behind the bomb threats gained access to the accounts using the previous infostealer compromise.

However, it suggests that there was ample time for the universities and Microsoft, which both universities used for authentication, to take action against the accounts that they should have been aware were appearing in infostealer logs.

Modern threat intelligence has made infostealer logs highly visible.

"Both findings place credential exposure well before the disruption, creating a substantial window in which exposed access could have been investigated and secured," Hudson Rock said.

The researchers said that they would need access to details such as the email headers, and data from email providers, including sign-in events and audit records, that could show them more about who sent the email and from what session.

Understanding whether the sender authenticated into the account could rule out spoofing, but would not in itself provide proof that the sender used a corresponding password taken from an infostealer log, Hudson Rock noted. There are many ways to get around password-based authentication.

The researchers said that in any case where a credential is detected among infostealer logs, the organizations responsible for those accounts must contain them, revoke their access, rotate secrets, and go looking for suspicious activity.

"The disruption illustrates why credential exposure deserves attention beyond fraud and data theft," the researchers said.

"An account associated with an ordinary university user can become a means of reaching schools, frightening families, and consuming emergency resources."

Around 6,300 of Italy's 7,476 state schools received fake bomb threat emails between November 11-12, although only around 390 of them evacuated their respective buildings.

The emails contained messaging such as "we will annihilate you," and "we will carry out genocide against Italians," and mention of a "powerful explosive device... with a remote trigger."

Early reports suggested that the emails came from a Taiwanese email address and were signed by a "Mikhail Andropov, leader of the Vilayat of Misoginistan" - a fictitious state or region roughly mapping to "the land of Misogyny," with "vilayat" meaning an administrative region of the Ottoman Empire.

Various theories have been reported about the identity of the sender, ranging from a teacher based in the Philippines whose email was compromised to a Russia-backed disruption operation. Neither are confirmed. Russia denied any involvement.

Italy's Prime Minister Giorgia Meloni said on Thursday evening that there was no credence to the emails, and that whoever was behind the coordinated hoax sought to invoke chaos across the country.

"To date, there is no evidence of a concrete danger," she said, ANSA reported. "These messages aren't intended to shock, they're intended to scare.

"Those who write them are primarily seeking our fear, wasted days, suspicion, and chaos. Investigators and the judiciary, along with their European colleagues, are working to determine who is behind them."

Schools in France, Ireland, Northern Ireland, and Scotland also received similar emails this week. None of the respective police forces believed the threats were legitimate.

Hundreds of schools across the Republic of Ireland received the emails, as did news organizations such as RTE, which evacuated its Donnybrook campus, disrupting scheduled programming.

Around 300 schools in Northern Ireland received bomb threats, although the PSNI said these were being treated as a hoax, and that the risk to the public was deemed low.

Likewise, Police Scotland confirmed around 1,000 schools were affected by the email campaign and that the threats weren't believed to be credible.

In France, three school districts confirmed they received similar threats. Separately, domestic and international rail travel, including Eurostar services to London, were interrupted on Thursday following bomb threats made to Calais-Frethun station.

The latest wave of threats follows similar happenings at other types of organizations in recent weeks, including airline operators, air traffic controllers, and blood banks.

At least 34 flights across various operators in Europe were affected earlier this month. Some were forced into unplanned landings, such as an Aer Lingus flight which pulled up to a French air base instead of its intended target of Rome.

Military fighter jets were also scrambled to escort others in Italian and Austrian airspace. (R)