{"id":3709,"date":"2021-11-15T19:47:45","date_gmt":"2021-11-15T14:17:45","guid":{"rendered":"https:\/\/xiarch.com\/blog\/?p=3709"},"modified":"2021-11-17T12:20:28","modified_gmt":"2021-11-17T06:50:28","slug":"fbi-system-hijacked-to-email-immediate-alert-about-fake-cyberattacks","status":"publish","type":"post","link":"https:\/\/xiarch.com\/blog\/fbi-system-hijacked-to-email-immediate-alert-about-fake-cyberattacks\/","title":{"rendered":"FBI System Hijacked to Email \u2018Immediate\u2019 Alert About Fake Cyberattacks"},"content":{"rendered":"\n

The Federal Bureau of Investigations (FBI) email servers were hijacked to administer spam email impersonating FBI warnings that the receivers\u2019 network was stealing and the information was stolen.<\/p><\/p>\n\n\n\n

The spam-tracking nonprofit SpamHaus alerted that tens of thousands of these messages were delivered in two waves early this morning. They also believe is just a small part of the operations.<\/p><\/p>\n\n\n\n

Appropriate Address Delivers Fake Content <\/strong><\/h2>\n\n\n\n

Security Investigators observed two waves of this operation, one at 5 AM (UTC) and a second one-two hour later. The message came from an appropriate email address -xyz@yv.fbi.gov \u2013 which is in the form of FBI\u2019s Law Enforcement Portal (LEEP), and carried the subject \u201cUrgent: Threat actor in systems.\u201d<\/p><\/p>\n\n\n\n

All emails came from the FBI\u2019s IP address 153.31.119.142 (mx-east-ic.fbi.gov), security researchers told us.<\/p><\/p>\n\n\n\n

\"FBI-System-Hijacked-to-Email-\u2018Immediate\u2019-Alert-About-Fake-Cyberattacks-image1\"<\/figure><\/div>\n\n\n\n

The message alerts that an attacker has been analyzed in the receiver\u2019s network and has hijacked information from devices.<\/p><\/p>\n\n\n\n

\u201cOur intelligence monitoring indicates exfiltration of several of your virtualized clusters in a sophisticated chain attack. We tried to blackhole the transit nodes used by this advanced persistent threat actor, however, there is a huge chance he will modify his attack with fast-flux technologies, which he proxies through multiple global accelerators. We identified the threat actor to be Vinny Troia, who is believed to be affiliated with the extortion gang TheDarkOverlord, We highly recommend you to check your systems and IDS monitoring. Beware this threat actor is currently working under the inspection of the NCCIC, as we are dependent on some of his intelligence research we can not interfere physically within 4 hours, which could be enough time to cause severe damage to your infrastructure.<\/p><\/p>\n\n\n\n

Stay safe,<\/p><\/p>\n\n\n\n

U.S. Department of Homeland Security | Cyber Threat Detection and Analysis | Network Analysis Group\u201d<\/p><\/p>\n\n\n\n

Spamhaus Project told our experts that the fraudulent emails reached at least 100,000 mailboxes. The number is a very traditional estimate, though, as the investigators believe \u201cthe operation was probably much, much larger.\u201d<\/p><\/p>\n\n\n\n

In a tweet today, the nonprofit said that the recipients were scraped from the American Registry for Internet Numbers (ARIN) database. While this looks like a prank, there is no doubt that the emails originate from the FBI\u2019s servers as the headers of the message show that its origin is verified by the DomainKeys discovered Mail (DKIM) mechanism.<\/p><\/p>\n\n\n\n

\u201cReceived: from mx-east-ic.fbi.gov ([153.31.119.142]:33505 helo=mx-east.fbi.gov)<\/p><\/p>\n\n\n\n

envelope-from<\/p><\/p>\n\n\n\n

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed\/relaxed;<\/p><\/p>\n\n\n\n

d=fbi.gov; s=cjis; t=1636779463; x=1668315463; <\/p><\/p>\n\n\n\n

h=date:from:to:message-id:subject:mime-version; <\/p><\/p>\n\n\n\n

bh=UlyBPHe3aElw3Vfnk\/pqYLsBAoJGDFR1NyZFcSfpl5g=; <\/p><\/p>\n\n\n\n

b=N3YzXzJEbQCTJGh8qqjkYu\/A5DTE7yoloPgO0r84N+Bm2ae6f+SxzsEq nbjnF2hC0WtiVIMMUVGzxWSiZjq1flEygQGI\/JVjjk\/tgVVPO5BcX4Os4  <\/p><\/p>\n\n\n\n

vIeg2pT+r\/TLTgq4XZDIfGXa0wLKRAi8+e\/Qtcc0qYNuTINJDuVxkGNUD  <\/p><\/p>\n\n\n\n

62DNKYw5uq\/YHyxw+nl4XQwUNmQCcT5SIhebDEODaZq2oVHJeO5shrN42  <\/p><\/p>\n\n\n\n

urRJ40Pt9EGcRuzNoimtUtDYfiz3Ddf6vkFF8YTBZr5pWDJ6v22oy4mNK  <\/p><\/p>\n\n\n\n

F8HINSI9+7LPX\/5Td1y7uErbGvgAya5MId02w9r\/p3GsHJgSFalgIn+uY<\/p><\/p>\n\n\n\n

   Q==;<\/p><\/p>\n\n\n\n

   X-IronPort-AV: E=McAfee;i=”6200,9189,10166″; a=”4964109″<\/p><\/p>\n\n\n\n

   X-IronPort-AV: E=Sophos;i=”5.87,231,1631577600″;  <\/p><\/p>\n\n\n\n

d=”scan’208″;a=”4964109″<\/p><\/p>\n\n\n\n

Received: from dap00025.str0.eims.cjis ([10.67.35.50])<\/p><\/p>\n\n\n\n

  by wvadc-dmz-pmo003-fbi.enet.cjis with ESMTP\/TLS\/ECDHE-RSA-AES256-GCM-SHA384; 13 Nov 2021 04:57:41<\/p><\/p>\n\n\n\n

+0000<\/p><\/p>\n\n\n\n

Received: from dap00040.str0.eims.cjis (dap00040.str0.eims.cjis [10.66.2.72])<\/p><\/p>\n\n\n\n

               by dap00025.str0.eims.cjis (8.14.4\/8.13.8) with ESMTP id 1AD4vf5M029322<\/p><\/p>\n\n\n\n

for ; Fri, 12 Nov 2021 23:57:41 -0500<\/p><\/p>\n\n\n\n

Date: Fri, 12 Nov 2021 23:57:41 -0500 (EST)<\/p><\/p>\n\n\n\n

From: eims@ic.fbi.gov<\/a><\/p><\/p>\n\n\n\n

v=DMARC1; p=reject; rua=mailto:dmarc-feedback@fbi.gov, mailto:reports@dmarc.cyber.dhs.gov; ruf=mailto:dmarc-feedback@fbi.gov; pct=100\u201d<\/p><\/p>\n\n\n\n

The headers also display the following FBI internal servers that processed the emails:<\/p><\/p>\n\n\n\n