School districts in Tuolumne and Calaveras counties Thursday night received a hoax email threat from a cyber attack group known as Apophis Squad.
A similar hoax email was sent on Sunday.
The Union Democrat contacted Apophis Squad via email on Friday. Someone calling himself Pl3xl3t said Apophis Squad also “planned on doing something on Monday” but did not provide further details.
“We have an end goal.... but that is all I can say,” the email said.
The email also noted that Russia was not “our place of home,” though they described Russian President Vladimir Putin as a leader that “makes Russia strong.”
The emails sent to schools on Thursday from the address “firstname.lastname@example.org” with the title “Student Report (STAFF ONLY)” begins with “hello, a male student will be sent into your campus as you start the day, he will look normal but what is in his bag is a bomb.”
The email ends with, “we have a picture of the types of bombs we have placed in the bag. We think you should know what is going to kill the students.”
The email also contains notes that an explosive known as ANFO, also known as ammonium nitrate and fuel oil, will be inside two plastic bottles, and that when the school goes on lockdown it “will kill EVERY student in the room and maybe the rooms next to it.”
The email, which contains multiple spelling and grammatical errors, includes reference to “12 gauge shot guns shells” and “ sniper watching the exits with concreate with a ruger 10/22.”
The email also threatens that there have been five schools picked for an attack and school administrators may want to contact law enforcement or the FBI.
“Your school could be the one to be hit or it could be a lucky one and gets to be picked at a differnt time. The point is nobody but us will know which school is to be hit,” the email said.
“We follow in the foot steps of our two heros who died in the Columbine High School shooting. Natural selection is coming and we plan on being the onse to start it off,” it adds.
The Calaveras County Sheriff’s Office said in a press release that “the email contained a link to a photo of a device composed of a plastic bottle full of liquid, with black tape and wires attached and says ‘ Find me #apophissquad.’”
Calaveras Unified School District Superintendent Mark Campbell said he received the email Thursday night.
It was “not viable, not credible and not a safety concern,” he said.
Campbell said he felt “concern” over the impact the email might have on others due to how the threat is received, but he also felt annoyance for having to “navigate fictional attempts.”
A Tuolumne County press release stated that the content of the email did not identify a specific location or date that the threat might occur.
Sgt. Andrea Benson of the Tuolumne County Sheriff’s Office said Tuolumne County Superintendent of Schools Margie Bulkin notified the office late Thursday that multiple schools in the county had received the email.
Benson said she did not know which specific schools or districts received the email within the county and was unaware if the Sunday hoax email had been sent to schools across the United States. Current reports indicated that the message was circulated throughout California, she said.
Benson said that the investigation into Apophis Squad and the origin of the hoax email threat would be investigated by the FBI, but the concern remained that a person would “commit violent acts at one of our schools whether it was motivated by a ‘copycat’ or something else.”
“We continue to partner with our school districts to provide training and advice concerning these events. Our deputies were training with the Twain Harte School district just yesterday,” she said.
Summerville Union High School District Superintendent Robert Griffith said he did not receive the hoax email threat, but the district evaluated any potential threat to determine its credibility.
“It is concerning, because on the basic level it’s the sense of social network terrorism. It really raised the level of concern of teacher and parents and anyone associated with students and their safety,” he said. “A group is putting this out for one purpose only, to bring concern to the public as a sense of some kind of joke on a large scale.”
The Angels Camp Police Department also reported in a press release that local school officials received the threatening email.
The press release stated that the police department did not consider the email to be a credible threat, but increased police presence on campuses would be initiated as a precautionary measure.
The FBI has been investigating the emails since the first was received on Sunday. It read, “now you will understand the true mean of pain. I am coming into school with 3 bombs, and a .22 hand gun. If I see any staff or student I will shoot them and kill them. When I run out of bullets, I will slit there throats and watch them bleed out on the floor. If I see any police at the school I will blowup the bombs,” which was sent out on Sunday night to Mother Lode school officials.
In an emailed statement on Tuesday, the FBI office in Sacramento declined to acknowledge Apophis Squad as the culprits behind the message, but noted it was working with local law enforcement and “investigating the origin of the threats to determine their credibility.”
Another emailed response said the statement was “the extent of information that is available to provide in regard to the school threats at this time.”
On Friday morning, the FBI office in Sacramento said in an emailed statement that it does not comment on investigations unless public information such as court documents are available, and it rarely provides comments about particular groups.
On Monday, The Union Democrat contacted Apophis Squad via private message on Twitter and a person who identified themselves as “PI3xI3t” took credit for the email hoax on behalf of the cyber group.
The person said, “We got nothing better to do” and “We did this because we had been planning on doing so, also we love taking the piss out of Law Enforcement.”
“Listen. We do this because it is easy. Same with making a bomb. If we wanted to hurt people we would of walked into an airport and blown everyone tf up. Carbon wont’ set off a metal detector. Also we do this for a good reason. The U.S need this, we add a bit of spice into the lives of the people,” the purpose identified as PI3xI3t said.
The Apophis Squad Twitter account was taken offline after the Monday hoax email.
The group had previously been identified as being from Graubünden, Switzerland, but a new Twitter attributed to their name referencing Thursday’s emails cite their location as “Россия” which is Cyrillic for Russia.
Benson said the actual server that sent the message resides in the Netherlands under the domain "blazingfast.io"
Before the Twitter page was shut down, Apophis Squad said, “All emails are sent. We can not do anymore request till we come back” as well as “We take request for school clearouts / lockdowns. IF you want to SKIP a lesson? Maybe not do that exam?”
The Apophis Squad Twitter also posted “Tango down ~ U.S. + UK Schools We are Apophis Squad and we are HERE to stay! We 100% going dark now…. Hope the U.S. and UK enjoy it, if we get arrested then oops we must of messed up at some point.”
Apophis Squad has previously claimed responsibility for false threats directed toward schools in the United Kingdom.
Apophis is the Greek word for an ancient Egyptian mythological snake demon known as an embodiment for chaos.
The first hoax email threat was attributed to “email@example.com,” which hijacked the domain name of Zonix LLC, a Texas-based online gaming company that provides servers for users to play Minecraft, a world-popular 3-D building and exploratory game.
The second hoax email threat was attributed to “firstname.lastname@example.org,” using the domain name of another online gaming server for Minecraft. A representative of Mineplex could not be reached for comment.
On Tuesday, Hunter Frishman, 21, CEO of Zonix LLC, said an element of online gamers exists known for violent and unsolicited cyber attacks.
There have been many reports of “Swatting,” an online prank by which a hoax emergency call is placed in order to generate an armed law enforcement response to a specific location, or a distributed denial of service, where a cyber attacker to takes the IP address of another user offline without permission.
Calaveras County and Tuolumne County schools have promoted renewed focus on school safety following the shooting deaths of 17 students and staff at Marjory Stoneman Douglas High School in Parkland, Florida, on Feb. 14.
A town hall meeting was called in March with Calaveras County Superintendent of Schools Scott Nanik and Calaveras County Sheriff Rick DiBasilio after a 15-year-old Calaveras High School student was arrested on March 6 in connection with a report he mentioned bringing a firearm to campus.
On Feb. 21, an unspecified school shooting threat for schools with the acronym SHS circulated on social media throughout the country and prompted increased security at Sonora High School and Summerville High School in Tuolumne County.
In the social media screenshots of the threat, a person identified as “Ray Andres” wrote “I will not being telling people what my name is, but I will bring a gun to school Tomorrow so be prepared to hear shoots” and “Yes SHS is the school I want.”