# School Bomb Threat Emails: Sender Accounts Linked to Infostealer Data (Vidar, AlienTXTBASE)

> Hoax bomb-threat emails reached about 6,000 Italian schools (ANSA, citing the Education Ministry) and more than 300 Northern Ireland schools (PSNI) around Nov 11, 2026. Hudson Rock found that reported sender addresses at an Egyptian and a Taiwanese university appear in infostealer data (a Vidar-associated machine log and the AlienTXTBASE collection). Hudson Rock does not establish that the credentials were used to send the threats, that any password was still valid, or who is responsible.

- **Published:** 2026-11-12T09:29:03Z
- **Last reviewed:** 2026-11-12T09:29:03Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5844
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5844.png
- **ID:** TL-2026-5844
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 12 (1 shown free below)

## Description

Hoax emails threatening pupils and staff, and referring to an alleged bomb targeting the Italian prime minister, were sent to schools in Italy and the UK/Ireland. The messages used the claimed sender name 'Mikhail Andropov', which is unverified. ANSA, citing the Italian Education Ministry, reported about 6,000 Italian schools received the email; some evacuated and others continued teaching after consulting police. PM Giorgia Meloni said searches found no bombs. The PSNI reported more than 300 Northern Ireland schools received the same message and treated it as a hoax. Police Scotland assessed related messages as hoaxes, and The Journal (Ireland) reported threats to schools and newsrooms using different sender addresses for each. Reporting on an earlier Oct 19, 2026 wave of threatening emails to Northern Ireland, Scotland, Hungary and Serbia schools exists, but no source reviewed links the two waves.

Hudson Rock (infostealers.com, published 2026-11-12) checked the sender addresses reported in the media against its Cavalier infostealer dataset. An Egyptian university address, shown partially in la Repubblica and identified in a public X post, matched a Cavalier machine log classified as Vidar. The log's system information file is dated 2021-10-01 and describes a Windows 7 Ultimate x64 host with a Google Chrome password export of 112 credential records, 20 of which use the university address and 2 of which point to Microsoft authentication URLs (login.microsoftonline.com/common/oauth2/authorize and ccs.login.microsoftonline.com/ccs/common/oauth2/authorize). Password reuse was observed. The Taiwanese address, published by the Italian school IIS G. A. Remondini and attributed by Focus Taiwan to Da-Yeh University (Dayeh University), matched a URL-login-password entry in the AlienTXTBASE stealer-log collection tied to a Microsoft authentication URL. Hudson Rock dates that record to more than a year before the threats (its own assessment). AlienTXTBASE was documented by Troy Hunt (Feb 2025) as roughly 23 billion rows from 744 files (about 1.5TB) distributed through Telegram in URL:email:password format and ingested into Have I Been Pwned.

Focus Taiwan reports that Da-Yeh University's initial investigation found an alumnus account had sent a large volume of email and appeared compromised; the university suspended the account, and the cause and actual sender remain under investigation. Important caveats from the source: no attribution to any person, group or state; matching a sender address does not identify who operated the account; the passwords were not tested and Hudson Rock has not shown they remained valid; the Egyptian log is from 2021; and no token theft or MFA bypass was demonstrated. Record counts are export entries, not unique people. No network IOCs (IPs, domains, hashes) are published, and no CVE applies. Defender value lies in credential exposure response: reset passwords, revoke sessions and tokens, review app passwords, consents and mailbox rules, remediate infected endpoints, move to phishing-resistant authentication, and monitor sign-ins and outbound mail for bulk sending. Only one primary analysis (Hudson Rock) links the accounts to infostealer data, so severity and confidence are conservative.

## MITRE ATT&CK

- T1555.003 Credentials from Web Browsers
- T1005 Data from Local System
- T1586.002 Email Accounts
- T1078.004 Cloud Accounts
- T1078.004 Cloud Accounts

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TL-2026-5844 Entra ID Cloud Account Sign-In From First-Seen Country (Stolen Credential Replay)** (`TL-2026-5844-SPL-001`)

Flags a user whose successful Entra ID sign-in comes from a country not seen in the preceding days of history. Credentials exposed in Vidar and AlienTXTBASE stealer logs (T1078.004) are replayed from attacker infrastructure, so the sign-in geography usually differs from the account owner's baseline. The search also counts invalid-password failures (error 50126) per user so replay that follows guessing or stuffing of reused passwords (T1110.004) is visible; the research observed password reuse in the Vidar-associated log. Exposure in a stealer log is not proof of misuse, so each hit needs verification against the user's travel and VPN usage.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1078.004, T1110.004
- **Data sources:** azure:aad:signin (Entra ID sign-in logs via Splunk Add-on for Microsoft Cloud Services), SigninLogs (Microsoft Sentinel), azure signinlogs
- **Severity:** medium
- **Confidence:** medium

### Splunk SPL

````spl
index=azure sourcetype="azure:aad:signin" earliest=-7d@d
| eval err=tonumber('status.errorCode'), country='location.countryOrRegion', ok=if(err=0,1,0), bad_pw=if(err=50126,1,0)
| where isnotnull(userPrincipalName) AND isnotnull(country)
| stats min(eval(if(ok=1,_time,null()))) as first_seen max(eval(if(ok=1,_time,null()))) as last_seen sum(ok) as successful_signins sum(bad_pw) as bad_password_attempts values(ipAddress) as src_ips values(clientAppUsed) as client_apps values(authenticationRequirement) as auth_requirement values(appDisplayName) as apps by userPrincipalName country
| eventstats sum(bad_password_attempts) as user_bad_pw by userPrincipalName
| where successful_signins>0
| eventstats dc(country) as countries_7d min(first_seen) as user_first_seen by userPrincipalName
```baseline is the earlier days in the window; alert on a country first seen in the last 24h for a user with older history```
| where first_seen>=relative_time(now(),"-24h") AND user_first_seen<relative_time(now(),"-24h") AND countries_7d>=2
| convert ctime(first_seen) ctime(last_seen)
| sort - user_bad_pw - successful_signins
````

### Microsoft KQL

```kql
let lookback = 7d;
let recent = 24h;
let signins = SigninLogs
    | where TimeGenerated > ago(lookback) and ResultType in (0, 50126)
    | extend Country = tostring(LocationDetails.countryOrRegion)
    | where isnotempty(Country)
    | summarize FirstSeen=minif(TimeGenerated, ResultType == 0), LastSeen=maxif(TimeGenerated, ResultType == 0), SuccessfulSignIns=countif(ResultType == 0), BadPasswordAttempts=countif(ResultType == 50126), SourceIPs=make_set(IPAddress, 10), Apps=make_set(AppDisplayName, 10), ClientApps=make_set(ClientAppUsed, 5), AuthRequirement=make_set(AuthenticationRequirement, 3) by UserPrincipalName, Country;
let baseline = signins | where FirstSeen <= ago(recent) | distinct UserPrincipalName;
signins
| where SuccessfulSignIns > 0 and FirstSeen > ago(recent)
| join kind=inner baseline on UserPrincipalName
| project UserPrincipalName, Country, FirstSeen, LastSeen, SuccessfulSignIns, BadPasswordAttempts, SourceIPs, Apps, ClientApps, AuthRequirement
| order by BadPasswordAttempts desc, SuccessfulSignIns desc
```

### Sigma

```yaml
title: Entra ID Successful Single-Factor Sign-In Over Legacy Authentication Protocol
id: 7c1d9b52-3e41-4a8f-9a6e-5d2b8f10a3c1
status: experimental
description: Detects successful Entra ID sign-ins that used only a password over a legacy client protocol, a pattern consistent with replay or stuffing of credentials exposed by infostealers (Vidar, AlienTXTBASE) against cloud email accounts. Sigma cannot express the per-user geography baseline used in the SPL and KQL versions, so this variant is scoped to legacy protocols that bypass MFA. Exposure in a stealer log is not proof of misuse.
references:
  - https://www.infostealers.com/article/school-bomb-threats-hudson-rock-finds-reported-sender-accounts-in-infostealer-data/
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks
author: Threadlinqs Team
date: 2026-11-12
tags:
  - attack.initial-access
  - attack.defense-evasion
  - attack.t1078.004
  - attack.credential-access
  - attack.t1110.004
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    ResultType: 0
    AuthenticationRequirement: singleFactorAuthentication
    ClientAppUsed:
      - 'IMAP4'
      - 'POP3'
      - 'Authenticated SMTP'
      - 'SMTP'
      - 'Exchange ActiveSync'
      - 'Other clients'
  condition: selection
fields:
  - UserPrincipalName
  - IPAddress
  - ClientAppUsed
  - Location
falsepositives:
  - Multifunction printers and scanners that send mail with basic authentication
  - Legacy line-of-business applications that have not been migrated to modern authentication
level: medium
```

**Known false positives:**

- Legitimate travel, conference attendance or a new VPN egress point for a university user
- Students and alumni who sign in from several countries because of remote study or mobile roaming

**Tuning notes:** Adjust earliest and the 24h recent window to the sign-in retention you hold. Exclude known corporate VPN and proxy egress countries with a lookup. Raise priority when the user also appears in a leaked-credential list or Entra ID Protection risk detection, or when bad_password_attempts is above zero before the first success. Add a requirement of authenticationRequirement=singleFactorAuthentication to cut volume. The Sigma variant needs your SIEM's Entra field mapping.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TL-2026-5844 Successful Sign-In After Entra ID Leaked Credentials Risk Detection (locked: unlock with TL Creds)
- TL-2026-5844 Hoax Bomb-Threat Email Content From a Single Sender Across Many Recipients (locked: unlock with TL Creds)
- TL-2026-5844 Community-Observed Vidar and AiTM Infrastructure Contact (OSINT Sibling Indicators) (locked: unlock with TL Creds)
- TL-2026-5844 Security Info or Authentication Method Registered on an Entra ID Account (locked: unlock with TL Creds)
- TL-2026-5844 Exchange Online Inbox Rule That Forwards, Redirects or Deletes Mail (locked: unlock with TL Creds)
- TL-2026-5844 Archiving of Browser Credential Stores With Compression Utilities (Stealer Staging) (locked: unlock with TL Creds)
- TL-2026-5844 Bulk External Outbound Email From a Single Mailbox (Compromised Account Abuse) (locked: unlock with TL Creds)
- TL-2026-5844 Non-Browser Process Touching Chromium Login Data Credential Store (Vidar-Style Theft) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 12)

Defanged, TLP:CLEAR.

- Domain: `login[.]microsoftonline[.]com`

Full set of 12 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [School Bomb Threats: Hudson Rock Finds Reported Sender Accounts in Infostealer Data](https://www.infostealers.com/article/school-bomb-threats-hudson-rock-finds-reported-sender-accounts-in-infostealer-data/)
- [Focus Taiwan: Dayeh University account suspended after emails to Italian schools](https://focustaiwan.tw/society/202611120012)
- [ANSA: Alarm over bomb threats in 6,000 Italian schools](https://www.ansa.it/sito/notizie/cronaca/2026/11/11/vi-annienteremo-lallarme-bomba-in-6.000-scuole-italiane.-meloni-strategia-per-il-caos_870b0024-72d2-4b15-bab5-0c74dcc1d653.html)
- [ANSA: Meloni - we will not allow an anonymous email to decide the school calendar](https://www.ansa.it/sito/notizie/topnews/2026/11/11/meloni-non-permetteremo-a-una-mail-anonima-di-decidere-il-calendario-scolastico_6a6809dc-f12f-48b8-9a16-a7376e58ac05.html)
- [PSNI: Threatening emails to over 300 schools being treated as hoax](https://www.psni.police.uk/latest-news/threatening-emails-over-300-schools-being-treated-hoax)
- [Police Scotland: Statement after threatening messages sent to schools](https://www.scotland.police.uk/what-s-happening/news/2026/november/statement-after-threatening-messages-sent-to-a-number-of-schools-in-scotland/)
- [The Journal: Bomb threats to schools and media](https://www.thejournal.ie/bomb-threats-schools-media-thejournal-7222128-Nov2026/)
- [la Repubblica: Mail scuole, Mikhail Andropov chi e](https://www.repubblica.it/cronaca/2026/11/11/news/mail_scuole_mikhail_andropov_chi_e-425715611/)
- [IIS G. A. Remondini: incident account of the email](https://www.remondini.net/pagine/una-mail-dal-misoginistan)
- [Troy Hunt: Processing 23 Billion Rows of ALIEN TXTBASE Stealer Logs](https://www.troyhunt.com/processing-23-billion-rows-of-alien-txtbase-stealer-logs/)
- [Infostealers.com: ALIEN TXTBASE data leak deep analysis](https://www.infostealers.com/article/alien-txtbase-data-leak-a-deep-analysis-of-the-breach/)
- [Microsoft Learn: Entra ID Protection risks (leaked credentials)](https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks)
- [Microsoft Learn: Responding to a compromised email account](https://learn.microsoft.com/en-us/defender-office-365/responding-to-a-compromised-email-account)
- [Microsoft Learn: Revoke user access in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/users/users-revoke-access)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5844