Global Swatting Wave: Schools Targeted by Coordinated Digital Bomb Threats
Anonymous mass email campaigns exploit digital vulnerabilities to trigger widespread panic and evacuations.
1Massive School Evacuation Wave
Six thousand Italian schools recently received anonymous bomb threats signed by a fictitious entity called Mikhail Andropov. These emails triggered immediate evacuations and school closures across the country. Authorities are currently investigating the source, noting that similar threats have previously targeted aviation, media outlets, and educational institutions in multiple nations.
2Origins of the Scripts
The threatening messages utilize extremist rhetoric and pseudo-terrorist slogans sourced from underground Telegram channels and alt-right forums. Attackers often exploit compromised email domains, such as those from Taiwan’s Dayeh University, to bypass security filters. These coordinated campaigns aim to create simultaneous panic across entire nations using automated botnet delivery systems.
3Global Pattern of Attacks
The phenomenon began in Eastern Europe during the spring of 2022, shortly after the invasion of Ukraine. Since then, waves of threats have hit the United States, India, Japan, and Singapore. In India alone, over 150 schools in New Delhi were targeted in a single morning using European-based anonymous servers.
4Hybrid Warfare Allegations
Intelligence agencies in the Czech Republic formally attributed several 2024 attacks to Russian-backed hybrid warfare operations. The goal of these campaigns is to destabilize countries allied with Ukraine and paralyze emergency services. Investigators have tracked messages to Russian servers or encrypted services frequently utilized by pro-Russian disinformation networks and actors.
5The Dnipro Investigation Case
In July 2025, a joint task force involving Eurojust arrested a suspect in Dnipro, Ukraine, linked to thousands of threats against Czech and Slovak schools. Although the suspect was detained, he later fled to Belarus, reportedly en route to Russia. This incident caused diplomatic friction between Prague and Bratislava regarding official reporting.
6Criminal Swatting Services
Beyond state-sponsored hybrid warfare, many attacks are driven by cybercriminals selling swatting services on Telegram and Discord. These individuals, often minors or young adults, accept cryptocurrency payments to launch automated threats. In France, local students even adopted these methods, using school digital portals to trigger false alarms to avoid exams.
7Evolving Threat Landscape
The tactics have evolved from simple email threats to sophisticated, multi-national campaigns involving various extremist groups like the Russian-linked Male State. While some incidents are clearly linked to geopolitical destabilization, others are the result of copycat behavior by students or profit-driven cybercriminals seeking to cause chaos for personal gain.
8Future Security Implications
The recurring nature of these threats highlights a critical vulnerability in global public infrastructure. As authorities struggle to distinguish between state-sponsored hybrid attacks and individual criminal swatting, schools remain soft targets. Future security efforts must focus on international cooperation and robust digital verification to mitigate the impact of these disruptions.