'Andropov' signs new mail bombing, more accounts used

Second day of mail bombing in Italian schools for the elusive 'Mikhail Andropov'. Unlike Wednesday's sending, which started from a single compromised email address, this time there were more than one accounts that propagated the threatening messages. A detail being examined by investigators, grappling with the difficult task of tracing the identity of those who sowed chaos in the country with a simple click.

In fact, it doesn't take a team of sophisticated hackers to carry out a sensational action like the one of these two days. All it takes is one person who knows how to make himself untraceable. Maximum result with minimum effort. However, all investigative hypotheses are on the table. The Postal Police is at work, in contact with other countries that have undergone similar campaigns. As well as specialists from intelligence and the National Cybersecurity Agency.

The debut of the acronym Mikhail Andropov dates back to last Friday, when he appeared in a message announcing the presence of bombs sent to Irish television Rte and Bulgarian Nova TV and entitled "Message to the west". Within 45 minutes the bomb would explode, "the clock is ticking", "time is running out", he wrote, informing that "this is just the beginning. What happened this week is only a small part of what awaits Europe in the near future".

A few days pass and 'Mikhail' targets Italy this time. The system is the same: a bombshell announcement that later turns out to be false. But the fuss raised in families and in politics is true. On Wednesday, the messages came from the hacked email of a student at Daye University in Taiwan.

Today the accounts are different: one belongs to Jorhaida Budiang, a teacher from Davao in the Philippines. The domain deped.gov.ph links to the Department of Education of the Philippine government. Another profile used today is that of Ysabel Canary, an educator at a school in Batangas City, also in the Philippines. And there are others.

Trying to follow the trail of compromised accounts is like navigating a dead-end maze. On the dark web there is a thriving market for government credentials, which can be purchased for a few dozen dollars. A territory in which investigators also move in search of possible connections. Furthermore, the emails fail the schools' anti-spam filters because they do not contain attachments. Artificial Intelligence was presumably used both in the acquisition of the targets (the thousands of educational institutions) and in the propagation of the message. Which in this case does not have yesterday's mocking reference to "Misoginistan".

But the title of the email is "Message from Italy. You are in danger". Almost as if to indicate the inside track, even if some expressions used, such as "sniffer dogs" and "prime minister Giorgia Meloni", would suggest an automatic translation. All inferences at the moment, while among analysts there is the hypothesis that the campaign of false alarms could continue, moving from schools to other sectors.