FBI email servers were hacked to send spam warning of a “sophisticated chain attack”, with a likely goal to discredit security researcher Vinny Troia

The Federal Bureau of Investigation (FBI) email servers were hacked to distribute spam email impersonating FBI warnings …

BleepingComputer 2021-11-15 Ionut Ilascu

Context & Ripple Effects

The apparent use of FBI infrastructure turned a warning-style phishing message into a more credible impersonation attempt aimed at Vinny Troia. Related reporting attributes the sending capability to allegedly insecure code in the FBI's LEEP portal, shifting attention from a spoofed domain to abuse of a trusted sender.

The episode fits the same social-engineering logic described in earlier business-email impersonation attacks: attackers borrow institutional authority to influence a target or its audience. Here, the compromised authority was the FBI itself.

First-order effects

Recipients of the messages could not rely on the FBI sender identity as an authenticity signal, while Troia faced a targeted attempt to damage his credibility through an apparently official warning.
The FBI's email reputation and the security of its LEEP portal became immediate operational concerns, because the alleged flaw enabled messages to originate from FBI-controlled systems.

Second-order effects

Organizations receiving FBI-themed alerts must add independent verification steps for unusual security warnings, reducing the value of sender-based filtering when legitimate infrastructure is abused.
The alleged LEEP weakness puts pressure on the FBI to review portal code and outbound-mail controls, rather than treating email spoofing as solely a recipient-side phishing problem.

Third-order effects

If attacks increasingly originate through trusted institutional tools, security programs will shift from checking who sent a message to validating the workflow and evidence behind high-impact alerts.
The incident points to a broader trusted-tool boundary problem: control of an official communications system can be as valuable to an attacker as control of a recognizable brand.

The trend: Phishing is moving beyond look-alike senders toward abuse of legitimate communication systems whose authority recipients already trust.

Discussion

@spamhaus @spamhaus on x
We have been made aware of “scary” emails sent in the last few hours that purport to come from the FBI/DHS. While the emails are indeed being sent from infrastructure that is owned by the FBI/DHS (the LEEP portal), our research shows that these emails *are* fake.
@briankrebs @briankrebs on x
Got one of these this morning. Full headers in image https://twitter.com/... https://twitter.com/...
@spamhaus @spamhaus on x
These fake warning emails are apparently being sent to addresses scraped from ARIN database. They are causing a lot of disruption because the headers are real, they really are coming from FBI infrastructure. They have no name or contact information in the .sig. Please beware!
@gossithedog Kevin Beaumont on x
FBI email infrastructure has been compromised and is being used to send fake emails about fake cyberattacks to system admins right now. https://twitter.com/...
@vinnytroia Vinny Troia, PhD on x
Wow I can't imagine who would be behind this. #thedarkoverlord aka @pompompur_in https://twitter.com/...
@zackwhittaker Zack Whittaker on x
Per @briankrebs, hackers abused a website coding bug in the FBI's LEEP online portal to blast out thousands of hoax emails overnight from an FBI email address. https://krebsonsecurity.com/ ...
@briankrebs @briankrebs on x
I asked the FBI for comment. Here's what they said: “The FBI and CISA are aware of the incident this morning involving fake emails from an @ic.fbi.gov email account. This is an ongoing situation and we are not able to provide any additional information at this time.” https://twit…
@gossithedog Kevin Beaumont on x
This is an example email being sent via FBI notification. It is not real. https://twitter.com/...
@c7five Nick Percoco on x
If you receive emails legitimately sent by the FBI/DHS, you unfortunately now have to question their authenticity. It appears their email infrastructure has been compromised. Header analysis won't help. https://twitter.com/...
@gossithedog Kevin Beaumont on x
“The impacted hardware was taken offline quickly upon discovery of the issue.” https://www.fbi.gov/...
@anthony Anthony DeRosa on x
Fake emails were sent from @ic.fbi.gov email account that has been compromised. FBI says this is an ongoing situation: https://www.fbi.gov/...
@rayredacted @rayredacted on x
These headers indicate that the FBI LEEP portal was hijacked or social engineered in order to deliver these “prank” messages using FBI infrastructure. (1/3) https://twitter.com/... https://twitter.com/...
@bobgourley Bob Gourley on x
FBI system hacked to email ‘urgent’ warning about fake cyberattacks https://www.bleepingcomputer.com/ ... “...there is no doubt that the emails originate from FBI's servers as the headers of the message show that it's origin is verified by the DomainKeys Identified Mail (DKIM) me…
@malwarejake Jake Williams on x
I'm not into victim blaming, but someone is definitely ending a career over this. https://twitter.com/...
@quinnypig Corey Quinn on x
The clowns handling infosec at @FBI could not be reached for comment at press time. Seriously; I started my career thwarting email system compromises. https://twitter.com/...
@cisajen Jen Easterly on x
We're aware of this incident and engaged with our @FBI teammates. As always, we stand ready to support as needed. https://twitter.com/...
@cybersecmeg Meg on x
sending positive vibes, and a lot of caffeine to whoever's leading incident response on this 🥺 https://twitter.com/...
@gossithedog Kevin Beaumont on x
FBI comment confirming. They are in IR mode basically. https://twitter.com/...
@pgl Peter Lowe on x
This is legit scary - there's no WAY the average end user could tell these aren't real emails, and even checking headers and IP locations reinforces they're actually from the FBI. The only way you could tell is by spidey sense or just hearing about it. Frightening. https://twitte…
@jhaddix Jason Haddix on x
Wow. Just parameter tampering in a webapp. https://twitter.com/...
@dangoodin001 Dan Goodin on x
“We continue to encourage the public to be cautious of unknown senders,” says the agency whose infrastructure was hacked to send emails from a legitimate account. https://twitter.com/...
@o2bnobx Alan on x
$100 this is a rogue device inside an FBI facility attached to the network and not an actual hack into it; somebody with a phone. https://twitter.com/...
@kwestin Ken Westin on x
FBI Statement on Incident Involving Fake Emails: “We don't know yet either” https://www.fbi.gov/...
@bleepincomputer @bleepincomputer on x
The emails started to pour into thousands of mailboxes in the early hours (UTC time) of Saturday alerting of a “sophisticated chain attack” from an APT actor. Whoever did this identified security researcher @vinnytroia as the attacker, likely in an attempt to discredit him.
@gossithedog Kevin Beaumont on x
The threat actor also separately messaged Brian Krebs from the FBI's Criminal Justice Information Services Division email system (spot the different subject). https://twitter.com/...
@dinodaizovi Dino A. Dai Zovi on x
The big question is: if someone noisy was able to compromise this infra to send out these e-mails, were silent others able to compromise the infra to *monitor* e-mails? https://twitter.com/...
@briankrebs @briankrebs on x
Last night and early this morning, 1000s of hoax messages were sent out by the FBI's email address and IP address. The person claiming responsibility says they were able to send the messages by abusing poor coding on an FBI portal. https://krebsonsecurity.com/ ...
@rayredacted @rayredacted on x
Brian's article should clarify pretty much everything about the FBI LEEP incident of the past 12 hours. https://twitter.com/...
@gossithedog Kevin Beaumont on x
.@briankrebs interviewed the threat actor behind this (who contacted him via the FBI's network). https://krebsonsecurity.com/ ...
@embryoresist @embryoresist on x
1) Breach FBI LEEP system. 2) Use it to email security specialist Brian Krebs. 3) Tell Krebs he is hosting a botnet “on his forehead”. 4) Carry one's large balls home in a wheelbarrow. https://twitter.com/...
@jsrailton John Scott-Railton on x
The ever-timely @briankrebs already has an interview with the person who claimed responsibility. https://krebsonsecurity.com/ ... https://twitter.com/...
@campuscodi Catalin Cimpanu on x
Confirms what Carel Bitter from Spamhaus told me yesterday about the hackers' possible way of entry https://twitter.com/...
@grufftech Adam Baird on x
Fun fact: Getting this hoax email 8 hours before the biggest charity event of the year for @RoosterTeeth — even with how silly it was written AND not following protocol — was NOT the weird juju I wanted going into this weekend. https://krebsonsecurity.com/ ... https://twitter.com…
@fbi @fbi on x
#FBI Statement on Incident Involving Fake Emails @CISAgov https://www.fbi.gov/... https://twitter.com/...
@esmcintyre Erin Siegal McIntyre on x
Hackers, you see any of my unanswered FOIA's up in there? https://twitter.com/...
@norskladywolf Ladywolf on x
Anybody else just a WEE bit embarrassed that our own FBI got hacked and spam was sent out from their system? I mean aren't we supposed to have some of the greatest minds at work, here? Doesn't conjure up much confidence, does it. 🙄🙄🙄 https://thehill.com/...
@cachedchecks @cachedchecks on x
Can confirm, I received an email the FBI sent last night. Emails headers indicative of it not being spoofed. It was clearly fake, just the first 3 sentences. This is what I posted about earlier today. If the FBI can get hit, how are people so lax on security? https://twitter.com/…
@model_daughters @model_daughters on x
Just my 2C but I really take exception to our intelligence agencies getting hacked as much as they do and I largely blame them. My gut tells me these usually occur through a) poor tools, b) poor protocols and c) poor adherence to protocols. rant: off https://twitter.com/...
@wtfioguy @wtfioguy on x
👀 Fake emails from a “.gov” address..yikes. https://twitter.com/...
@stevebellovin Steven M. Bellovin on x
The after-action report will be a fun thing to FOIA. Better yet, I'd like to see the CSRB report, but the CSRB doesn't seem to exist yet, despite Biden's executive order from May. https://twitter.com/...
@letsfishsmarter Brett Favaro on x
Honestly it's time for IT departments to implement mandatory 2FA everywhere. Drop the “phishing awareness” campaigns - even the most sophisticated could fall for this https://twitter.com/...
@mhall119 Michael Hall on x
At this point @HillaryClinton's email server is the only one that hasn't been hacked https://twitter.com/...
@rvawonk Caroline Orr Bueno, Ph.D on x
So, Brian Krebs interviewed the alleged hacker, who said he did it to point out a “glaring vulnerability in the FBI's system.” Not sure why this isn't being reported more widely. https://krebsonsecurity.com/ ... https://twitter.com/...
@eyestray Isaac on x
Good example of both: 1) it WILL happen to everyone and 2) manage your scope so that when it does, the impact is minimized. Do not feel bad when you say “it could have been worse.” Instead, know that you did your job. https://twitter.com/...
@snlyngaas Sean Lyngaas on x
Another update: The FBI acknowledged Sunday that someone had exploited a software configuration in an IT system the FBI uses to communicate with state and local law enforcement to send the emails. https://www.cnn.com/...
@gossithedog Kevin Beaumont on x
Updated FBI statement. I think it's pretty open and transparent, and a quick isolation. LEEP webapp was indeed abused. Well handled incident I think. Orgs should take note talking about it stops rumour mill stories. https://krebsonsecurity.com/ ... https://twitter.com/...
@briankrebs @briankrebs on x
FBI confirms yesterday's reporting, says its Law Enforcement Enterprise Portal (LEEP) portal was abused to send fake emails. “No actor was able to access or compromise any data or PII on FBI's network.” Full statement in update: https://krebsonsecurity.com/ ...
@sonofuhgunn Kyle on x
Just a reminder that the FBI wants to own encryption keys as a back door into major software like iOS. https://twitter.com/...
@fabio_viggiani Fabio Viggiani on x
It kind of immediately felt it must have been such a basic vuln when I glanced at that website. It smells legacy all over the place. It really reminds me of my early pentest days when I was so excited to be able to change email content sent from target sites 😆 https://twitter.com…
@cioontherun @cioontherun on x
The “one-time” passcode was hard coded into the site and the emails were generated client-side... when was this website developed, 1990? https://twitter.com/...
@dinodaizovi Dino A. Dai Zovi on x
Now imagine if this were abused by a more advanced actor to send out an *especially* convincing spear phish... https://twitter.com/...
@spamhaus @spamhaus on x
The person claiming responsibility for yesterday's shenanigans says they were able to send the messages by abusing flawed code on the FBI LEEP portal. An interesting read from @briankrebs: https://twitter.com/...
@tylabs Tyler McLellan on x
The waste of (allegedly) hacking an fbi email account for a weird grudge and not running some sort of bitcorn scam. https://twitter.com/... https://twitter.com/...

Chronicles