Hackers access FBI email system, spam 100,000 accounts

Hackers accessed the FBI’s email system and sent spam to 100,000 accounts on Saturday, according to the Spamhaus Project, an email spam watchdog group.

The organization posted an example on Twitter of one of the emails that were sent to thousands of accounts.

The email bears the subject “Urgent: Threat actor in systems” and purports to come from a cybersecurity division of the Department of Homeland Security. 

The email purports to warn recipients of a potential “exfiltration” — meaning a withdrawal of data — from their systems by cybersecurity expert Vinny Troia and cybercriminal group The Dark Overlord.

These emails look like this:

Sending IP: 153.31.119.142 (https://t.co/En06mMbR88)
From: eims@ic.fbi.gov
Subject: Urgent: Threat actor in systems pic.twitter.com/NuojpnWNLh

— Spamhaus (@spamhaus) November 13, 2021

Spamhaus offered a number of different possible motivations for hackers to send the message.

“Triple action: Convince people to shut things down just in case, while veracity is determined, character assassination of Vinny Troia who was mentioned in it, and flooding the FBI with calls. Or, as someone else said, ‘for the lulz’. Maybe all of the above. Maybe something else!” the group tweeted.

The hackers began their campaign early Saturday morning in New York, according to Spamhaus. 

Austin Berglas, the head of professional services at cybersecurity company BlueVoyant and a former FBI special agent, told Bloomberg the email system that was hacked was not the one agents use to send classified information in the FBI.

“This is not the classified system that was compromised,” said Berglas. “This is an externally facing account that is used to share and communicate unclassified information.” 

The FBI said in a statement they were aware of the attack but could not give more information.