Editor's note: This article was updated with comment from Abnormal Security at 10:15 a.m. EST. 

Bomb threats sent to thousands of schools across Europe this week came from a compromised email account at a Taiwanese university, the latest in a series of hoax threats that have targeted airports and newsrooms using messages sent from legitimate institutions.

Taiwan’s Da-Yeh University said it suspended the account used on Wednesday to send the emails, according to Taiwan’s Central News Agency. Officials in the Colombian capital Bogotá said last week they were investigating a potential hack impacting a city health agency where other hoax emails originated.

The use of hijacked accounts at real and relatively trustworthy institutions has enabled the hoaxers to send messages that pass authentication checks and avoid triggering spam filters. It also introduces challenges for investigators attempting to find out who was responsible.

Stolen credentials are widely traded and exploited both by criminals and state-sponsored hackers. Security company Proofpoint told Recorded Future News that threats it examined last week all came from compromised accounts rather than forged addresses.

No government has attributed the hoaxes to a specific actor, although the Irish government said last week “it seems likely that this is a coordinated campaign of disruption.” Proofpoint said that while aspects of the campaign “could be consistent with a nation-state-aligned actor,” it did not have enough evidence to reach that conclusion.

The email security company Abnormal Security told Recorded Future News it detected another hoax threat sent from what appeared to be “a legitimate, compromised account rather than a spoofed address” on a Lithuanian domain.

As the messages were sent through genuine webmail accounts, the technical details associated with them will largely resolve to the email providers’ own services. Login records showing who accessed each account could hit dead ends if the hoaxers used anonymizing tools such as VPNs or proxy networks.

The global spread of the accounts across multiple jurisdictions will also be a challenge to investigators who will need to seek evidence from different jurisdictions using often very slow mutual legal assistance requests.

New Wave

Last week’s hoaxes appeared to be repeated at a much larger scale on Wednesday, when an email threatening “genocide” and claiming explosives had been planted in schools was sent to thousands of Italian state schools. The threats prompted evacuations from Milan to Sicily.

Similar messages reached hundreds of schools in Scotland, Northern Ireland and the Republic of Ireland. Police Scotland’s assistant chief constable Mark Sutherland said Wednesday that “around a thousand Scottish schools received a threatening email message” that was also sent to other schools across the United Kingdom.

“These messages were immediately assessed and we are treating them as hoaxes. Our enquiries have established that there is nothing to suggest that they represent a credible threat or that there is any wider threat to the public,” Sutherland said.

The Irish police force, An Garda Síochána, said it also assessed the threats sent to schools as “not credible” and stressed that it was “not advising any educational establishment to evacuate.”

Another threat was reportedly sent to Italian schools on Thursday morning from an address belonging to the Philippines’ Department of Education, which did not immediately respond to a request for comment.

Proofpoint said that last week it observed threats targeting roughly 20 organizations, most of them in Europe, including at least a dozen newsrooms and several airports.

The messages did not contain malicious links or attachments, “suggesting the objective was disruption or intimidation rather than malware delivery or credential theft,” said Mark Kelly, a staff threat researcher at Proofpoint.

In the text of the messages, the senders claimed to have access to compromised computer systems. In one email sent to newsrooms last week, seen by Recorded Future News, the sender professed to be a leader of the same group responsible for the flight threats.

The message said the group had “experimented with multithreading” to send the emails and had gained access to compromised devices, servers and accounts belonging to people in Europe and elsewhere.

It is not known whether the waves of threats are part of the same campaign of hostile action or if they are inspiring copycats. Some of the emails have carried different signatures, with several targeting flights signed by “fighters of the Male State,” a Russian anti-feminist movement banned in Russia. Its founder has denied involvement.

Other messages sent to newsrooms and schools were signed “Mikhail Andropov,” although neither signature establishes who sent them to any evidentiary standard.

In Ireland, Garda Commissioner Justin Kelly said police believed the threats originated outside the country and were intended to “sow discord,” particularly around Thursday’s European Political Community summit in Dublin, where dozens of European leaders have gathered under the largest security operation in Ireland’s history.

A spokesperson for Northern Ireland’s police service said: “As part of this investigation, officers and detectives are carrying out extensive enquiries to establish the source of these mass-distributed emails and any potential links to previous emails.

“The working theory is that these hoax and malicious emails were sent from outside the UK, enquiries are continuing on other aspects of the investigation,” they said.