The spam blocking database Spamhaus issued a tweet on Saturday (13 November – 14 November AEDT) warning of the emails, pointing out that while the source was genuine, the content of the emails appeared to be fake.
"These fake warning emails are apparently being sent to addresses scraped from ARIN database," Spamhaus said.
These emails look like this:
— Spamhaus (@spamhaus) November 13, 2021
Sending IP: 153.31.119.142 (https://t.co/En06mMbR88)
From: eims@ic.fbi.gov
Subject: Urgent: Threat actor in systems pic.twitter.com/NuojpnWNLh
"They are causing a lot of disruption because the headers are real, they really are coming from FBI infrastructure. They have no name or contact information in the .sig. Please beware!"
It blamed one Vinny Troia, an employee of the dark web intelligence companies NightLion and Shadowbyte, for the emails, but named him as being affiliated with the extortion gang TheDarkOverlord.
Wow I can’t imagine who would be behind this. #thedarkoverlord aka @pompompur_in https://t.co/Xd6XoZNRnl
— Vinny Troia, PhD (@vinnytroia) November 13, 2021
The FBI issued an initial statement the same day, saying: "The FBI and CISA are aware of the incident this morning involving fake emails from an @ic .fbi .gov email account.
"This is an ongoing situation, and we are not able to provide any additional information at this time. The impacted hardware was taken offline quickly upon discovery of the issue. We continue to encourage the public to be cautious of unknown senders and urge you to report suspicious activity to ic3.gov or cisa.gov."
Later, the agency issued the following statement: "The FBI is aware of a software misconfiguration that temporarily allowed an actor to leverage the Law Enforcement Enterprise Portal to send fake emails. LEEP is FBI IT infrastructure used to communicate with our state and local law enforcement partners.
"While the illegitimate email originated from an FBI operated server, that server was dedicated to pushing notifications for LEEP and was not part of the FBI’s corporate email service.
"No actor was able to access or compromise any data or PII on the FBI’s network. Once we learned of the incident, we quickly remediated the software vulnerability, warned partners to disregard the fake emails, and confirmed the integrity of our networks."
In a tweet, Troia blamed an individual with the Twitter handle @pompompur_in. The website Bleeping Computer said Troia had been named due to an ongoing feud between him and the RaidForums community.
He told the website that once before this, the same individual had tried to smear him by attacking a site for missing children and claiming that he (Troia) was a paedophile.
