FBI email servers were hacked to send spam warning of a “sophisticated chain attack”, with a likely goal to discredit security researcher Vinny Troia

The Federal Bureau of Investigation (FBI) email servers were hacked to distribute spam email impersonating FBI warnings …

BleepingComputer 2021-11-14 Ionut Ilascu

Context & Ripple Effects

The incident turned an FBI email channel into an impersonation vehicle aimed at Vinny Troia, extending a familiar fraud pattern in which attackers borrow an authoritative sender to make a message credible. Related coverage attributes the sending capability to alleged insecure code in the FBI’s LEEP portal.

It also sharpens the practical risk behind earlier reporting on [[a:867772|executive-impersonation fraud]:] the sender’s legitimacy can be as consequential as the wording of the message when recipients assess a warning.

First-order effects

The FBI must treat messages sent through the compromised email infrastructure as potentially untrustworthy, while recipients of the spoofed warnings face uncertainty over whether an apparent FBI alert is authentic.
Vinny Troia absorbs an immediate reputational attack because the spoofed warnings were reportedly designed to associate him with a purported “sophisticated chain attack.”

Second-order effects

Organizations that receive FBI-branded security communications have reason to rely more heavily on independent verification channels, reducing the stand-alone authority of an email’s government sender identity.
The alleged LEEP portal weakness puts the security of adjacent FBI-facing systems under scrutiny, because a flaw in a portal was reportedly sufficient to reach an official outbound communications channel.

Third-order effects

The episode illustrates a trusted-tool boundary problem: compromise of a legitimate communications system can turn institutional authority into an attack asset rather than merely disrupt operations.
If similar failures recur, security-warning ecosystems will increasingly need authentication and verification practices that survive compromise of the sender’s own email infrastructure.

The trend: Cyberattacks are increasingly targeting trusted communications channels to weaponize institutional credibility against specific people and organizations.

Discussion

@spamhaus @spamhaus on x
We have been made aware of “scary” emails sent in the last few hours that purport to come from the FBI/DHS. While the emails are indeed being sent from infrastructure that is owned by the FBI/DHS (the LEEP portal), our research shows that these emails *are* fake.
@briankrebs @briankrebs on x
Got one of these this morning. Full headers in image https://twitter.com/... https://twitter.com/...
@spamhaus @spamhaus on x
These fake warning emails are apparently being sent to addresses scraped from ARIN database. They are causing a lot of disruption because the headers are real, they really are coming from FBI infrastructure. They have no name or contact information in the .sig. Please beware!
@gossithedog Kevin Beaumont on x
FBI email infrastructure has been compromised and is being used to send fake emails about fake cyberattacks to system admins right now. https://twitter.com/...
@vinnytroia Vinny Troia, PhD on x
Wow I can't imagine who would be behind this. #thedarkoverlord aka @pompompur_in https://twitter.com/...
@zackwhittaker Zack Whittaker on x
Per @briankrebs, hackers abused a website coding bug in the FBI's LEEP online portal to blast out thousands of hoax emails overnight from an FBI email address. https://krebsonsecurity.com/ ...
@briankrebs @briankrebs on x
I asked the FBI for comment. Here's what they said: “The FBI and CISA are aware of the incident this morning involving fake emails from an @ic.fbi.gov email account. This is an ongoing situation and we are not able to provide any additional information at this time.” https://twit…
@gossithedog Kevin Beaumont on x
This is an example email being sent via FBI notification. It is not real. https://twitter.com/...
@c7five Nick Percoco on x
If you receive emails legitimately sent by the FBI/DHS, you unfortunately now have to question their authenticity. It appears their email infrastructure has been compromised. Header analysis won't help. https://twitter.com/...
@gossithedog Kevin Beaumont on x
“The impacted hardware was taken offline quickly upon discovery of the issue.” https://www.fbi.gov/...
@anthony Anthony DeRosa on x
Fake emails were sent from @ic.fbi.gov email account that has been compromised. FBI says this is an ongoing situation: https://www.fbi.gov/...
@rayredacted @rayredacted on x
These headers indicate that the FBI LEEP portal was hijacked or social engineered in order to deliver these “prank” messages using FBI infrastructure. (1/3) https://twitter.com/... https://twitter.com/...
@bobgourley Bob Gourley on x
FBI system hacked to email ‘urgent’ warning about fake cyberattacks https://www.bleepingcomputer.com/ ... “...there is no doubt that the emails originate from FBI's servers as the headers of the message show that it's origin is verified by the DomainKeys Identified Mail (DKIM) me…
@malwarejake Jake Williams on x
I'm not into victim blaming, but someone is definitely ending a career over this. https://twitter.com/...
@quinnypig Corey Quinn on x
The clowns handling infosec at @FBI could not be reached for comment at press time. Seriously; I started my career thwarting email system compromises. https://twitter.com/...
@cisajen Jen Easterly on x
We're aware of this incident and engaged with our @FBI teammates. As always, we stand ready to support as needed. https://twitter.com/...
@cybersecmeg Meg on x
sending positive vibes, and a lot of caffeine to whoever's leading incident response on this 🥺 https://twitter.com/...
@gossithedog Kevin Beaumont on x
FBI comment confirming. They are in IR mode basically. https://twitter.com/...
@pgl Peter Lowe on x
This is legit scary - there's no WAY the average end user could tell these aren't real emails, and even checking headers and IP locations reinforces they're actually from the FBI. The only way you could tell is by spidey sense or just hearing about it. Frightening. https://twitte…
@jhaddix Jason Haddix on x
Wow. Just parameter tampering in a webapp. https://twitter.com/...
@dangoodin001 Dan Goodin on x
“We continue to encourage the public to be cautious of unknown senders,” says the agency whose infrastructure was hacked to send emails from a legitimate account. https://twitter.com/...
@o2bnobx Alan on x
$100 this is a rogue device inside an FBI facility attached to the network and not an actual hack into it; somebody with a phone. https://twitter.com/...
@kwestin Ken Westin on x
FBI Statement on Incident Involving Fake Emails: “We don't know yet either” https://www.fbi.gov/...
@bleepincomputer @bleepincomputer on x
The emails started to pour into thousands of mailboxes in the early hours (UTC time) of Saturday alerting of a “sophisticated chain attack” from an APT actor. Whoever did this identified security researcher @vinnytroia as the attacker, likely in an attempt to discredit him.
@gossithedog Kevin Beaumont on x
The threat actor also separately messaged Brian Krebs from the FBI's Criminal Justice Information Services Division email system (spot the different subject). https://twitter.com/...
@dinodaizovi Dino A. Dai Zovi on x
The big question is: if someone noisy was able to compromise this infra to send out these e-mails, were silent others able to compromise the infra to *monitor* e-mails? https://twitter.com/...
@briankrebs @briankrebs on x
Last night and early this morning, 1000s of hoax messages were sent out by the FBI's email address and IP address. The person claiming responsibility says they were able to send the messages by abusing poor coding on an FBI portal. https://krebsonsecurity.com/ ...
@rayredacted @rayredacted on x
Brian's article should clarify pretty much everything about the FBI LEEP incident of the past 12 hours. https://twitter.com/...
@gossithedog Kevin Beaumont on x
.@briankrebs interviewed the threat actor behind this (who contacted him via the FBI's network). https://krebsonsecurity.com/ ...
@embryoresist @embryoresist on x
1) Breach FBI LEEP system. 2) Use it to email security specialist Brian Krebs. 3) Tell Krebs he is hosting a botnet “on his forehead”. 4) Carry one's large balls home in a wheelbarrow. https://twitter.com/...
@jsrailton John Scott-Railton on x
The ever-timely @briankrebs already has an interview with the person who claimed responsibility. https://krebsonsecurity.com/ ... https://twitter.com/...
@campuscodi Catalin Cimpanu on x
Confirms what Carel Bitter from Spamhaus told me yesterday about the hackers' possible way of entry https://twitter.com/...
@grufftech Adam Baird on x
Fun fact: Getting this hoax email 8 hours before the biggest charity event of the year for @RoosterTeeth — even with how silly it was written AND not following protocol — was NOT the weird juju I wanted going into this weekend. https://krebsonsecurity.com/ ... https://twitter.com…

Chronicles