On the evening of November 12th, thousands of hoax emails were sent out from an official FBI email address, “eims@ic.fbi[.]gov”, with the subject “Urgent: Threat actor in systems.” The email, which contains multiple grammatical errors and cybersecurity “buzz words”, states that the FBI observed “exfiltration of several of your virtualized clusters in a sophisticated chain attack.” The hoax attributes this attack to the cybersecurity expert Vinny Troia, who has had multiple controversies in the past, and the extortion gang “TheDarkOverlord”, which Troia is known to have researched. Following the attack, the hacker sent an email to security reporter Brian Krebs sharing the details of the attack. The threat actor, an infamous RaidForums user known as “pompompurin”, stated the vulnerability resided in the FBI’s Law Enforcement Enterprise Portal (LEEP), an information sharing platform used by criminal justice entities. The account creation process leads to a confirmation email which is sent from a client-side HTTP POST request to the server. By changing the “To”, “Subject”, and “Text Content” fields, an attacker can send an email address to any recipient with the subject and content they specify. pompompurin is known to have feuds with Troia, as the security researcher has published multiple blog posts “exposing” the hacker. This attack appears to be just another development in the rivalry between this threat actor and a security researcher.