[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f8CwQ_Yn1I12tAvY9e65gek4y9sPOs1cOhW058RdmGco":3},{"article":4,"iocs":49,"watch_terms":50,"solutions":51,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"51aef5d5-15db-4a86-95ac-d4a3866c156b","Hijacked email accounts complicate investigations into European bomb hoaxes","hijacked-email-accounts-complicate-investigations-into-european-bomb-hoaxes-e1490e","Bomb threats sent to thousands of schools across Europe this week came from a compromised email account at a Taiwanese university, the latest incident in a series of hoax threats that have targeted airports and newsrooms using messages sent from legitimate institutions.","Bomb threats sent to thousands of schools across Europe this week originated from a compromised email account at Taiwan's Da-Yeh University. This incident is part of a series of hoax threats targeting institutions using legitimate, hijacked email accounts, which complicates investigations by bypassing spam filters and authentication checks. While no actor has been officially attributed, the coordinated nature suggests a potential nation-state-aligned campaign focused on disruption and intimidation rather than malware delivery.","Bomb threats sent to thousands of European schools originated from a compromised Taiwanese university email account.","https:\u002F\u002Ftherecord.media\u002Feurope-hoax-email-threats","http:\u002F\u002Fcms.therecord.media\u002Fuploads\u002FGarda_662e334238.jpg","2026-11-12T14:45:00+00:00","2026-11-12T15:00:20.748159+00:00",7,[17,20,23],{"name":18,"type":19},"Proofpoint","vendor",{"name":21,"type":22},"Da-Yeh University","product",{"name":24,"type":25},"email accounts","technology","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":26,"icon":28,"name":29,"slug":30},null,"Threat Intelligence","threat-intelligence",[32,37,42,47],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":38},{"id":39,"icon":28,"name":40,"slug":41},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":43},{"id":44,"icon":28,"name":45,"slug":46},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":48},{"id":26,"icon":28,"name":29,"slug":30},[],[18,21],{"controls":52,"vendors":134},[53,82,108],{"slug":54,"name":55,"problem":56,"products":57},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":83,"name":84,"problem":85,"products":86},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",[87,93,101],{"vendor_slug":88,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":88,"url":91,"description":92},"dmarcian","\u002Fvendor-logos\u002Fdmarcian.png","dmarcian-platform","https:\u002F\u002Fdmarcian.com\u002F","DMARC report processing and guidance for moving domains to enforcement.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"red-sift","Red Sift","\u002Fvendor-logos\u002Fred-sift.png","ondmarc","Red Sift OnDMARC","https:\u002F\u002Fredsift.com\u002Fpulse-platform\u002Fondmarc","Guided DMARC deployment and monitoring, with support for BIMI and MTA-STS.",{"vendor_slug":102,"vendor_name":18,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","email-fraud-defense","Proofpoint Email Fraud Defense","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-fraud-defense","DMARC deployment and monitoring with hosted SPF and DKIM services.",{"slug":109,"name":110,"problem":111,"products":112},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[113,118,126],{"vendor_slug":102,"vendor_name":18,"vendor_logo":103,"product_slug":114,"product_name":115,"url":116,"description":117},"core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",[],{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":145},"hijacked-university-email-account-used-to-send-mass-bomb-hoaxes-across-europe","Hijacked University Email Account Used to Send Mass Bomb Hoaxes Across Europe","Attackers compromised a legitimate email account at Taiwan's Da-Yeh University and used it to send coordinated bomb threats to thousands of European schools, bypassing spam filters and email authentication checks because the messages originated from a trusted domain. This highlights how weak account security at any institution can be weaponized far beyond its own network perimeter, turning a trusted sender into a tool for large-scale disruption. The hijacked account complicated law enforcement investigations because authentication mechanisms like SPF, DKIM, and DMARC saw the emails as legitimate. Organizations must treat account compromise not just as an internal risk but as a potential vector for harm to external parties, with serious reputational and legal consequences.",[140,141,142,143,144],"NIST CSF 2.0 PR.AA-01: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(j)","NIS2 Article 21(2)(b)","CIS Control 6: Access Control Management","NIST SP 800-53 SI-4: System Monitoring",{"NIS2 Article 21(2)(b)":146,"NIS2 Article 21(2)(j)":147,"NIST SP 800-53 SI-4: System Monitoring":148,"CIS Control 6: Access Control Management":149,"NIST CSF 2.0 PR.AA-01: Identity Management, Authentication, and Access Control":150},"This point covers incident handling procedures; a defined and practiced response plan for compromised accounts would have enabled faster detection, containment, and notification to affected parties across Europe.","This point explicitly requires the use of multi-factor authentication and secured communications, which if enforced on the compromised university account would have blocked unauthorized access.","SI-4 requires monitoring information systems for anomalous activity; automated detection of an unusual outbound email surge from a single account would have flagged the abuse early and limited the campaign's reach.","CIS Control 6 requires enforcing MFA and least-privilege access on all accounts, measures that would have made it significantly harder for attackers to take over and abuse the university email account.","This category requires organizations to manage and authenticate identities robustly; MFA and strong credential controls would have prevented attackers from hijacking the university email account in the first place."]