Ethical Hacking News
The school bomb threats across Europe have left authorities on high alert, but a new report has revealed that the source of the threats may not be as sinister as initially thought. The threats were sent to over 6,000 Italian schools and more than 300 schools in Northern Ireland, but an analysis by Hudson Rock researchers has found that the stolen credentials used to send the threats were already present in data obtained from a Windows 7 machine. The researchers recommend that organizations take steps to protect their accounts and devices to prevent similar incidents in the future.
The recent school bomb threats in Europe may not be as sinister as initially thought, according to an in-depth analysis by Hudson Rock researchers.The threats were linked to stolen data from a Windows 7 machine running Chrome, which was exposed more than five years ago.The attackers did not use the stolen credentials until recently, highlighting the importance of account and device protection.The incident illustrates the consequences of credential exposure and the need to address it beyond fraud and data theft.The researchers recommend steps to prevent similar incidents, including blocking accounts, resetting passwords, and revoking active sessions.The incident highlights the importance of monitoring sign-in activity and outgoing emails, and introducing phishing-resistant authentication.
The recent wave of school bomb threats across Europe has left authorities and parents on high alert. The threat emails, which were sent to over 6,000 Italian schools and more than 300 schools in Northern Ireland, were signed with the name "Mikhail Andropov" and threatened to target pupils, school staff, and even the prime minister. However, an in-depth analysis by Hudson Rock researchers has revealed that the source of these threats may not be as sinister as initially thought.
The researchers found that the two university addresses tied to the threats were already present in stolen data, which was obtained from a Windows 7 machine running Chrome. The Egyptian address, which was used by an Egyptian university, appeared in a Vidar infostealer record from 1 October 2021, while the Taiwanese address, which was used by a Taiwanese university, turned up in AlienTXTBASE, a collection of aggregated infostealer data, in February 2025.
The findings suggest that the stolen credentials were exposed more than five years ago, but the attackers did not use them until recently. The researchers emphasize that the age of the record is important, as it places documented exposure more than five years before the threats. However, it does not demonstrate five years of continuous attacker access, an unchanged password, or an unremediated infection.
The report highlights the consequences of a single device infection, as the same stolen collection can expose several accounts, including a university identity used on unrelated websites. The researchers conclude that the disruption illustrates why credential exposure deserves attention beyond fraud and data theft.
To prevent similar incidents in the future, the researchers recommend that organizations take steps to protect their accounts and devices. They suggest that organizations should block the account, reset its password through a trusted process, and check whether the same password was used elsewhere. They also recommend revoking active sessions and refreshing tokens, reviewing app passwords, unauthorized sign-in methods, and mailbox rules.
The affected device must also be checked and cleaned to prevent malware from stealing the new password. Organizations should also introduce phishing-resistant authentication and monitor sign-in activity and outgoing emails. A sudden increase in outgoing messages should always raise a security alert.
The report concludes that the disruption highlights the importance of addressing credential exposure beyond fraud and data theft. An account associated with an ordinary university user can become a means of reaching schools, frightening families, and consuming emergency resources.
Related Information:
https://www.ethicalhackingnews.com/articles/The-Credential-Connection-How-Stolen-Data-Fuelled-the-School-Bomb-Threats-ehn.shtml
https://securityaffairs.com/202941/security/the-school-bomb-threats-came-from-accounts-already-in-stolen-data.html
Published: Thu Nov 12 18:37:16 2026 by llama3.2 3B Q4_K_M
