Bomb Scare Hoax Emails

12/13/2018 - 8:45pm

While not reported here at Brown, other institutions that include universities * have been inundated with emails about phony bomb threats, in which the sender requests a sizable sum of money in bitcoins to stop the bomb from exploding. Major new outlets, such as the Washington Post and CNN have reported this widespread bomb hoax, as well as US-CERT sending an alert.

The FBI is actively investigating and has requested that we provide them with the bitcoin address of any emails that members of the Brown community might receive. Should you receive one, please forward the email to us at phishbowl@brown.edu.


Example #1:
From: [REDACTED]
Sent: Thursday, December 13, 2018 12:14 PM
To: [REDACTED]
Subject: You are responsible for people

Good day. My mercenary carried a bomb (Tetryl) into the building where your company is located. My man constructed the explosive device according to my guide. It can be hidden anywhere because of its small size, it is not able to destroy the building structure, but if it detonates you will get many wounded people. My recruited person keeps the building under the control. If he sees any unusual behavior, panic or policemen the bomb will be blown up. I can withdraw my man if you pay. You send me $20'000 in Bitcoin and the bomb will not explode, but do not try to fool me -I warrant you that I will withdraw my man solely after 3 confirmations in blockchain.

My payment details (btc address)- [REDACTED]

You must solve problems with the transfer by the end of the working day. If you are late with the transaction the bomb will detonate. This is just a business, if you don’t send me the money and the bomb detonates, other companies will send me more money, because this is not a one-time action. To stay anonimous I will no longer log into this email account. I monitor my Bitcoin wallet every forty minutes and after receiving the money I will give the command to my person to get away. If an explosion occurred and the authorities notice this email- We arent a terrorist society and dont take responsibility for explosions in other buildings.


Example #2:
I write you to inform you that my man hid the explosive device (Tetryl) in the building where your company is conducted. My mercenary constructed the bomb according to my guide. It can be hidden anywhere because of its small size, it is impossible to damage the building structure by this explosive device, but in the case of its detonation there will be many wounded people.

My man is controlling the situation around the building. If any unusual activity, panic or cop is noticed he will power the bomb.
I want to offer you a transaction. 20'000 usd is the cost for your life. Pay it to me in BTC and I ensure that I have to call off my man and the bomb will not explode. But do not try to deceive me- my warranty will become actual only after 3 confirmations in blockchain network.

My payment details (btc address)- (removed)

You have to pay me by the end of the working day, if the workday is over and people start leaving the building the device will explode.
Nothing personal, if I do not receive the bitcoin and the bomb detonates, next time other companies will send me more money, because it isnt a single incident.
For security and anonymity reasons, I will no longer enter this email. I check my address every 40 min and if I see the money I will give the command to my man to get away.

If an explosion occurred and the authorities read this letter:
We are not terrorists and do not assume any responsibility for explosions in other buildings.

Note: Both examples appeared on the "Email Bomb Threat Potential Spam?" thread on this reddit page.

* See these articles from the University of Michigan and Penn State

Phishing
Phishing Email (in the wild)

Written by pfalcon@brown.edu on