[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fY4haEQ9WgsDtryk24NSJo0IuM7JQI-rWVwmyWuUyvD0":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"ec5a8278-9edc-4d19-9fd3-8b30b427da06","The School Bomb Threats Came From Accounts Already in Stolen Data","the-school-bomb-threats-came-from-accounts-already-in-stolen-data-a14cc5","Hudson Rock researchers found that two university addresses tied to Italy’s school bomb threats were in infostealer data. On 11 November, bomb-threat emails hit schools across Europe. ANSA, citing the Education Ministry, reported that about 6,000 Italian schools received them. Some evacuated, others kept teaching after talking to police, so the recipient count tells you […]","Researchers discovered that two university email addresses linked to bomb threats sent to Italian schools on November 11 were present in infostealer data. The emails, signed 'Mikhail Andropov', targeted schools across Europe, with over 6,000 Italian schools receiving them. While the credentials were found in stolen data, the researchers emphasize that this exposure predates the threats and does not confirm continuous access or attribute the attacks to specific individuals or groups.","Bomb threats sent to European schools originated from accounts found in stolen data.","https:\u002F\u002Fsecurityaffairs.com\u002F202941\u002Fsecurity\u002Fthe-school-bomb-threats-came-from-accounts-already-in-stolen-data.html","https:\u002F\u002Fsecurityaffairs.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002Fimage-25.png","2026-11-12T22:42:10+00:00","2026-11-13T00:00:30.695153+00:00",7,[17,20],{"name":18,"type":19},"infostealer","technology",{"name":21,"type":22},"Hudson Rock","vendor","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":23,"icon":25,"name":26,"slug":27},null,"Threat Intelligence","threat-intelligence",[29,34,39,44],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":45},{"id":23,"icon":25,"name":26,"slug":27},[],[21],{"controls":49,"vendors":136},[50,79,108],{"slug":51,"name":52,"problem":53,"products":54},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":80,"name":81,"problem":82,"products":83},"breach-attack-simulation","Breach and attack simulation","You only find out whether your security tools stop an attack when a real attacker tries.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"attackiq","AttackIQ","\u002Fvendor-logos\u002Fattackiq.png","attackiq-ready","AttackIQ Ready","https:\u002F\u002Fwww.attackiq.com\u002Fproducts\u002Fready\u002F","Managed service that runs MITRE ATT&CK based emulations for you, with no scripting or tuning on your side.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"pentera","Pentera","\u002Fvendor-logos\u002Fpentera.png","pentera-platform","Pentera Platform","https:\u002F\u002Fpentera.io\u002Fpentera-platform\u002F","Runs automated, safe attacks in production to validate exploitable attack paths, prioritise proven risk and confirm fixes. Modules cover internal networks, the external attack surface and cloud.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"picus-security","Picus Security","\u002Fvendor-logos\u002Fpicus-security.png","picus-autonomous-penetration-testing","Picus Autonomous Penetration Testing","https:\u002F\u002Fwww.picussecurity.com\u002Fplatform\u002Fautonomous-penetration-testing","Automated penetration tests that prove which weaknesses are actually exploitable, so fixing can focus on real risk.",{"slug":27,"name":109,"problem":110,"products":111},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[112,120,128],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",[],{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":147},"stolen-credentials-linked-to-school-bomb-threats-highlight-infostealer-risk","Stolen Credentials Linked to School Bomb Threats Highlight Infostealer Risk","Two university email accounts used to send bomb threats to over 6,000 Italian schools were already present in infostealer-harvested credential dumps, meaning the accounts had been compromised before the threats were even sent. This incident illustrates how stolen credentials can sit in criminal markets for extended periods, enabling malicious actors to abuse legitimate institutional accounts for high-impact activities like mass threat campaigns. The use of a real university email address lends false legitimacy to such threats and complicates attribution. Organizations that fail to monitor for credential exposure and enforce strong account hygiene leave their users — and third parties — vulnerable to downstream abuse of compromised identities.",[142,143,144,145,146],"MITRE ATT&CK T1078: Valid Accounts","CIS Control 6: Access Control Management (v8)","NIST SP 800-53 SI-4: System Monitoring","NIS2 Article 21(2)(j)","ISO\u002FIEC 27001:2022 A.5.17: Authentication information",{"NIS2 Article 21(2)(j)":148,"MITRE ATT&CK T1078: Valid Accounts":149,"NIST SP 800-53 SI-4: System Monitoring":150,"CIS Control 6: Access Control Management (v8)":151,"ISO\u002FIEC 27001:2022 A.5.17: Authentication information":152},"This point explicitly requires the use of multi-factor authentication and secured communications, which, if applied to institutional email accounts, would have prevented stolen passwords alone from being used to send the threats.","The threat actors leveraged credentials already present in stolen infostealer data to abuse legitimate university email accounts, which is precisely what this technique describes — using valid credentials to gain or maintain access.","SI-4 requires monitoring information systems for anomalous activity; detecting the bulk-sending of threatening emails from two accounts would have been possible with outbound email anomaly monitoring.","CIS Control 6 requires managing and enforcing access credentials including password policies and MFA; enforcing MFA on the compromised university accounts would have prevented the stolen passwords from being sufficient to send the threats.","This control requires secure management of authentication information including monitoring for compromised credentials, which would have prompted a reset of the exposed university email passwords before they could be abused."]