Shortly after 7:20 on the morning of Thursday 5 November 2026, staff at Aeroporti di Roma and at the ground handler Aviapartner received an email with the subject "Segnalazione minaccia". It named two flights bound for Rome, a Finnair from Helsinki and an Aer Lingus from Dublin, said explosive devices had been placed on board and would go off in sixty minutes, and closed: "Oggi il vostro cielo sarà rosso", today your sky will be red. It was signed by the "fighters of the Male State", the name of a Russian misogynist movement banned in its own country. Before the morning was out a Croatian fighter had intercepted the Finnair flight, two Italian Eurofighters had escorted it to Fiumicino, and French fighters had taken the Aer Lingus jet to a military air base in Normandy. Eurocontrol would count fourteen threatened flights across Europe that day. There was no bomb on any of them.
That morning was the peak of one week and a stage in a longer sequence. Flights had already been targeted on 2 and 3 November; on 6 November newsrooms in Dublin and Sofia were evacuated after emails from a self-styled "Mikhail Andropov" who claimed to lead the group behind the flight threats; on 11 November an email reached some six thousand Italian schools, and the same morning well over a thousand schools in Scotland, Northern Ireland and Ireland received another; on 12 November a second email to Italian schools demanded the prime minister's resignation. Three weeks earlier, on 19 October, schools in Italy and the United Kingdom had been threatened in the name of Allah, on the same day as alarms in Hungary and Serbia. Every threat was false, and almost every wave carried a different name.
A Russian extremist movement, Iran's Revolutionary Guards, a KGB nostalgic? Or someone who changes masks precisely so that nobody can say? That is the question we put to BackBox AI and its Threat Hunter profile. The answers, and the sources behind them, are in an interactive dashboard that we will update with every new research cycle.
One question, many sources, no shortcuts
The Threat Hunter ran six research cycles between 5 and 12 November, using public sources only: news agencies and the press of a dozen countries, statements by police, prosecutors, ministries and airports, research on the movement whose name was used, and the record of earlier campaigns. The first cycle, on the day of the main wave, built the factual base and a first attribution assessment; the second, that evening, examined social networks, Telegram first; the third, on 9 November, covered the following days and searched criminal forums and the dark web; the fourth, on 11 November, followed the school waves; the fifth and sixth, on 12 November, went back to the open questions and followed the second email to Italian schools. Every source went into a ledger with an identifier, a type and a reliability grade, and every episode, flight, message and precedent received an identifier that later cycles will keep.
As in our investigations into the October protests and the sabotage of the cold chain, every statement carries a status. A verified fact rests on an official or primary source, or on several independent outlets; a reported item has a single credible source behind it; a hypothesis is an inference and says who holds it. Here the distinction matters more than usual, because the campaign is built on claims: every message says who sent it, and none of them can be taken at its word.
Before publication we checked the sources against the originals wherever they could be reached, looked for the full texts of the messages and added sources where the record was thin, from the statements of Bogotá's city government and Eurojust to the court records of earlier hoax campaigns. The dashboard now rests on 152 sources.
What happened
The register holds nineteen episodes, almost all against flights, newsrooms or schools. Read in order, they show a campaign that changed targets and names but kept a recognisable voice.
October, the schools. On 19 October the same morning brought emailed threats to schools in Italy, Northern Ireland, Scotland, Hungary and Serbia. In Italy about a hundred schools were evacuated after an email with the subject «La morte è vicina», death is near, sent from an address made to look like the Saudi education ministry: it announced attacks "with the permission of Allah", an ammonium-nitrate device in the building and "only the beginning", and ended "Allahu Akbar". In Northern Ireland up to 300 schools received a threat that the education minister called Islamist, signed off the same way and sent, according to the police, from outside the United Kingdom. In Hungary the email naming more than seventy schools went to newsrooms rather than to the schools themselves. Two weeks earlier, on 5 October, kindergartens, schools and institutions in several parts of Bulgaria had received emailed threats from compromised accounts and servers abroad; no text has been published to compare with the later waves.
2 and 3 November. On 2 November 279 Italian schools received emails from a sender calling itself the "corpo delle guardie della rivoluzione islamica", Iran's Revolutionary Guards: an ammonium-nitrate bomb in a plastic bag with a remote detonator, an explosion within the hour, the survivors killed with knives. The same day a Wizz Air flight from London to Sofia was diverted to Budapest under the escort of a Hungarian Gripen. On 3 November Eurocontrol counted seven threatened flights: a LOT flight from Heathrow was diverted to Warsaw's Modlin airport, which briefly closed, two Italian Eurofighters escorted a Ryanair flight from Dublin to Rome, and a single email covered two Sofia-bound flights carrying 176 and 185 people. A cruise ship was evacuated and searched at Syros. The alarm on the Rome flights came from an email to Aeroporti di Roma. According to Corriere della Sera, a mail signed «militanti della provincia di Neviansk», after a town in Russia's Urals, reached dozens of the airport company's employees and announced bombs on two Ryanair flights bound for Fiumicino: probably this one, which would give the day a signature too. Investigators told the Guardian they saw no immediate evidence of a hostile state.
5 November. The main wave reached airports in a dozen countries. Eurocontrol counted fourteen flights, 0.049% of the day's traffic; press tallies ran from eighteen to almost thirty, partly because the same flights were counted more than once. Fighters were scrambled in Italy, Croatia, France and Bulgaria, where the MiG-29s flew on orders from NATO's air operations centre, and three aircraft were diverted, to Évreux in Normandy, Vienna and Plovdiv. The emails received in Rome and at Sofia airport carried the same sentences in the same order and the Male State signature; Birmingham airport said its threat came from the same group. At Malpensa the message was, according to the deputy prefect of Varese, a single line: "Metteremo una bomba sugli aerei". The Spanish police received three emails in twenty minutes, Prague four flight numbers in one message, Vienna an "abstract" threat against four flights. According to the airlines' association IATA, most threats were not sent to the airlines operating the flights. Three incidents of the same day had a different method and stay outside the count: the word "bomba" written in the lavatory of a Ryanair flight from Pescara to Charleroi, an anonymous phone call to Cork airport, and a passenger detained at Schiphol for threatening his own flight, released the next day.
6 November. A third day of threats against flights, fourteen by Eurocontrol's count, which brings its total for 3, 5 and 6 November to thirty-five: Hungarian Gripens escorted three airliners, a Wizz Air flight from Prague to Rome was diverted to Venice and four aircraft were landed at Orly. Hungary's defence minister said NATO had ordered extra air patrols. The same morning an email titled "MESSAGE TO THE WEST" reached RTÉ, Newstalk, the Irish Independent, Today FM and Virgin Media in Ireland, Nova TV in Bulgaria and Sky; RTÉ evacuated its Dublin campus for more than three hours. Its author, signing as Mikhail Andropov, claimed to be one of the leaders of the group behind the flight threats, said they had "experimented with multithreading", recruited residents of European countries and gained access to compromised devices and accounts, and promised to blow up planes, cruise ships, subway stations and trains. "This is only the beginning", it said; a device in the building would explode in 45 minutes. Reuters could not establish who sent it, or whether it came from the same source as the flight threats.
11 November. Between 8:59 and about 10:00, one email reached some six thousand Italian state schools, by the Education Ministry's count, causing precautionary evacuations in almost every region. It was signed "Mikhail Andropov, leader del Vilayat di Misoginistan" and announced a genocide against the Italians, a bomb with a remote detonator left in a plastic bag in each building, another in the engine of the prime minister's car, and the survivors finished off with knives. It was sent from the account of a former student of Da-Yeh University in Taiwan, which the university says appeared to have been hacked and has suspended; a copy shown in a newspaper screenshot came from an address at an Egyptian university. No school in Trentino-Alto Adige or Valle d'Aosta received it, the two regions whose schools are outside the ministry's mail system, and many copies ended in spam folders. That morning British and Irish schools received an email with the subject "DEATH IS NEAR", from the leader of a "Red Owl" project: more than 300 schools in Northern Ireland according to the police, around a thousand in Scotland and several hundred in Ireland according to the press. Police in all three jurisdictions called it a hoax, and Police Scotland and Ireland's education authorities said there was no need to evacuate.
12 November. At 9:39 the next morning a second email reached Italian schools in Vicenza, Rome, Naples, Catania and other cities, with the subject «Messaggio dall'Italia. Siete in pericolo», a message from Italy, you are in danger. Signed again by Mikhail Andropov, "con disprezzo", with contempt, it was a new text: the building "mined" with an ammonium nitrate and nitromethane device, sealed in vacuum bags so that sniffer dogs could not find it and packed with metal fragments to maim the survivors; another device at Palazzo Chigi, "in Piazza Colonna, 370"; a bomb just detonated in a school in the city, "causando la morte di alcune persone", which was false. For the first time the campaign asked for something: the immediate resignation of the prime minister, or hundreds of victims. "Il conto alla rovescia è iniziato", the countdown has begun, it said, without giving a time. Most schools stayed open. The prime minister met the opposition leaders that morning and appealed for unity, and Palazzo Chigi announced a protocol already in force, published by the Education Ministry: no evacuation on the mere receipt of a mass email, while the prefect keeps the power to order one when there are concrete elements of real risk.
What the messages give away
No investigator has published the headers, servers or accounts behind the messages, so the texts are the main public evidence about who wrote them. Compared line by line, as the dashboard's matrix does, they say more than the names they carry.
The first lesson is that each wave was coordinated. The Rome and Sofia emails are the same text, adapted to the flights of each airport, and the threats reached a dozen countries within the same hours. The messages name real aircraft in the air, with flight numbers and routes that anyone can read on a flight tracker: precision meant to make the threat hard to dismiss, not evidence of inside knowledge. None asked for anything until 12 November, and then the demand was political, never money. The newsroom email states the purpose itself: to cause "widespread panic" and force the authorities "to spend a fortune". An aviation-security professor quoted by AP estimates the cost of a single flight disruption at up to 250,000 dollars, before the cost of fighter sorties, which falls on the states.
The senders hid behind other people's mailboxes. The address behind the flight emails belonged to a health-sector body of the city of Bogotá, according to the city government, which asked prosecutors and police to investigate; The Record identifies it as a public hospital network, and whether the account was hijacked or only imitated is not known. The Italian school email of 11 November left from the account of a former student of a Taiwanese university and, in at least one copy, from an address at an Egyptian university; other threats came from addresses linked to a school in Lithuania and to a university in Thailand, and the October one from a fake Saudi ministry. Italian investigators also mention anonymising services such as Proton Mail. The two university accounts had leaked long before: Hudson Rock found the Taiwanese credentials in an aggregated infostealer collection more than a year old, and the Egyptian ones in the logs of a computer infected with the Vidar infostealer in 2021. That does not prove the stolen passwords were the ones used, as the firm itself stresses, but it shows how cheaply a sender can borrow an institution's name: no break-in is needed when the credentials are already circulating.
The second lesson concerns the schools. Their messages form a chain. The Italian subject of 19 October, «La morte è vicina», returns in English on 11 November as "DEATH IS NEAR". The ammonium nitrate of 19 October returns on 2 November; the plastic bag, the remote detonator and the knives of 2 November return on 11 November; the Italian texts of 2 and 11 November even share a grammatical slip, a feminine participle for the masculine "ordigno" ("verrà attivata", "l'ho posizionata"). Each element had been published, so a determined imitator could have copied it, but together they make a single author the more likely reading.
The third lesson is the strongest. The Italian and British emails of 11 November carry the same unusual lines on the same morning: the genocide, the device left in the building, the bomb in the prime minister's car. The full English text, published by the Daily Record, matches the Italian one sentence by sentence, from the plastic bag to the knives, and is signed by the same "Mikhail Andropov", with the "Red Owl" project in place of the "Vilayat di Misoginistan". Schools in Edinburgh were evacuating from around 10:00 UTC, before the first full publication of the Italian text we found, on Rai's live blog at 10:33 UTC. One text, localised and sent to two audiences, is the best explanation.
That name connects the schools to the newsrooms, and the newsroom email claims the flights. The flight emails, however, use a different template and a different name, so their link to the rest of the campaign rests on that claim and on one shared verb, "annientarvi", annihilate you. A claim costs nothing: anyone can take credit for a week of headlines.
The email of 12 November fits the chain less neatly. It keeps the persona and the ammonium nitrate, but drops the genocide, the knives and the feminine slip ("rintracciarlo" agrees with the masculine "ordigno"), and adds details, the vacuum bags against sniffer dogs and the metal fragments, that follow two days of reporting on dog units searching schools. Like the email of 11 November, it may have been composed from the news. The same sender writing a new text is the likelier reading, which the dashboard rates moderate; someone borrowing a name that the papers had made famous cannot be ruled out.
Six masks, perhaps seven
From 19 October to 11 November the messages used six names: "Allahu Akbar", the Revolutionary Guards, the Male State, Mikhail Andropov, the "Vilayat di Misoginistan" and the "Red Owl" project. Each points somewhere else, at Islamist terrorism, Iran, a Russian far-right movement, the Soviet security apparatus through the surname of a KGB chairman, a hybrid of misogyny and an Islamic word for a province, or at nothing recognisable. Three of the names are inventions with no trace before this campaign. A seventh may belong in the list: the «militanti della provincia di Neviansk» of the 3 November email to Rome, reported by one newspaper only. Then the sender stopped changing: Mikhail Andropov signed the British, Irish and Italian school emails of 11 November and, on 12 November, the political demand.
The only real movement among them is the Male State. Founded in 2016 on VKontakte by a blogger and fitness trainer around an ideology of "national patriarchy", it was declared extremist by a Russian court in October 2021, renamed its main channel "Male Legion" and has backed the war against Ukraine since 2022; researchers describe it today as a movement in decline, and its founder's Telegram channel has some 5,400 subscribers. In 2021 bomb threats circulated around its harassment campaign against a Moscow restaurant chain, and its founder distanced himself; the head of security of Lithuania's airports told the Financial Times that the group, "or someone presenting itself in its name", had sent threats to them before. On 5 November the founder wrote that the movement has not existed since 2021 and had nothing to do with the emails; the next day an account linked to him answered BBC Russian with a taunt: "What Male State? Where have you seen it? It hasn't existed for many years."
A denial proves little, since every candidate would issue one. What weighs more is the sequence: a sender who signs in the name of Islamists, Iran, Russian misogynists and the KGB within three weeks does not hold any of those ideologies sincerely. The names are part of the hoax. Taking them at face value already lets the hoax shape the story: on 5 November a newspaper ran the headline that the movement had "taken responsibility" for the threats, when the only claim was the signature at the bottom of the email.
Italy
Italy was hit at every stage. Its schools received the waves of 19 October and of 2, 11 and 12 November, the one of 11 November by far the largest; the first coordinated day of flights included two Ryanair aircraft bound for Rome, and on 5 November at least eight flights to or from Italian airports were threatened, two of them named in the email to Fiumicino. The prosecutors of Busto Arsizio, whose district includes Malpensa, and the Polizia Postale are investigating the threats against the Milan airport, with reports also sent to the Rome and Civitavecchia prosecutors; the Genoa prosecutors have opened a file on the school email of 11 November for false alarm, interruption of a public service and serious threats, with a possible terrorism aggravation.
The political reading ran ahead of the investigations. On 5 November the Defence Minister told the Senate that the refrigeration attacks, the French blood service, the drones and the planes were "all linked" in his view, a "guerra sotto soglia", warfare below the threshold; on 11 November he spoke of fantasists and expected more copycats. The Interior Minister called it premature to speak of a common direction, and the Education Minister described the concrete risk as practically non-existent. The prime minister convened ministers, intelligence chiefs and the national cybersecurity agency at Palazzo Chigi on 11 November and met the opposition leaders the next morning; that day the government decided that a mass email alone no longer empties a school. Investigators quoted by ANSA see a trail "che sembrerebbe portare verso Mosca", that would seem to lead to Moscow, or else an attempt to throw them off.
The detail that matters most for an investigator is the gap on the map. The email of 11 November reached schools everywhere except Trentino-Alto Adige and Valle d'Aosta, the two regions whose schools do not use the ministry's mail system. The pattern suggests that whoever sent it worked from the ministry's list of the state schools' institutional addresses, and how that list was built, by collecting public directories or by entering a system, is one of the open questions that only the investigators can answer.
A campaign, and whose?
The evidence supports a clear answer to some questions and none to others, so it is best taken claim by claim.
- The flight threats of 3, 5 and 6 November were a coordinated email campaign. Emails to airports in a dozen countries on the same mornings, naming aircraft in the air. High confidence.
- The emails to Rome and Sofia have the same author. The same sentences in the same order. High confidence.
- Nothing was placed anywhere and no ransom was asked. The aim was disruption and fear; the only demand, on 12 November, was political. High confidence.
- The school emails of 11 November in Italy and in the UK and Ireland are one text from one source. Moderate to high confidence, because the full English text has been published by a single outlet.
- The school waves since 19 October have the same author. Moderate confidence: the shared subject, device, knives and grammatical slip make a borrower unlikely, but every element was public.
- The "Mikhail Andropov" of the newsrooms and of the schools, on 11 and 12 November, is the same operator. Moderate confidence: the same persona and the same boasting, but every text was published before the next one.
- The flight emails come from the same operator as the schools and newsrooms. Low to moderate confidence: the link is a claim and a verb.
- The names on the messages say nothing reliable about the sender. High confidence.
- A state directs the campaign. Insufficient information.
On the last point the record holds one lead and one warning. The lead comes from anonymous European intelligence officials who told the Financial Times that pro-Kremlin activists or hackers are their leading hypothesis, that some of them see Russia as the most likely origin, and that whether Russian services directed, encouraged or authorised the operation is an open question; Italian investigators quoted by ANSA see a trail toward Moscow but warn that it may have been laid to mislead them. The Kremlin calls the accusations "stupid" and "baseless"; no government has attributed the campaign and no arrest has been linked to it. The warning comes from the precedents. When European governments have named a state behind mass hoax-email waves it has usually been Russia, mostly in hedged terms: the head of Czech counter-intelligence saw a "clearly visible Russian trace" behind the school threats of 2024, and the sender identified ten months later was a young man in Ukraine, most likely paid from Russia according to Czech intelligence. Yet many comparable waves ended with teenagers or small domestic groups, in Britain in 2018, at French airports in 2023, in Germany and Austria, Poland and Croatia, some of them hiding behind Islamist decoys; in 2022 Serbia blamed Ukraine, and India's wave of hoaxes against airlines in 2024 was traced to individuals.
The dashboard therefore weighs seven explanations. Two stand out, and they are not mutually exclusive: an operation serving Russia, run directly or through paid proxies, and hoaxers after chaos or attention with no state behind them. Both rate low to moderate, and the Czech case shows how they can coincide. Followers of the Male State acting on their own, the movement itself, Iran and money all rate low; copycats explain the incidents at the margins, not the core waves. The correlation matrix and the episode register show, message by message, what supports each reading.
A dashboard that will follow the investigation
The dashboard brings the whole investigation together: the key figures; the register of episodes, with each statement and its status; a board of the flights named in the reporting; a map of where the threats landed, by target; the timeline from the precedents to 12 November; the signatures in the order they appeared; the messages, quoted as the press published them, with the matrix of what they share; the assessment, the actors and seventeen precedents; message indicators, advice for airports, schools and newsrooms and five Sigma rules for mail systems; the open questions; and a searchable ledger of 152 sources. Every item links to its sources, and every source lists the places that cite it.
It is built to grow. With each research cycle BackBox AI will produce a new database, and a comparison tool will list the new or changed records, which go through the same checks before they reach the dashboard. Identifiers never change, a superseded record stays visible with the reason, and every version has its own changelog entry. The next cycles start from the open questions: who sent the messages and through which accounts; whether the flight emails come from the same hand as the school emails; whether a government attributes the campaign; how the school mailing lists were obtained; where the campaign goes after its political demand of 12 November.
Where open sources stop
Without headers, servers or account records, the links between waves rest on wording, timing and targets, not on infrastructure. The sending accounts are known from single reports and one university's statement, and finding their credentials in infostealer data does not show that those credentials were used; first-day counts kept changing and will change again; some texts are known only in part, and the full British text of 11 November has been published by one outlet only. Several sources are paywalled or closed to automated access and were read through the outlets that quote them. And every message is itself a claim: what a sender says about himself is the least reliable part of the record.
The dashboard names institutions and roles, not people: the founder of the movement whose name was borrowed, the holders of the hijacked accounts, the crews and the school staff stay anonymous. It is not an attribution tool and not evidence for court, but a reasoned picture of what is public, with the degree of certainty of each statement.
Who it is for, and what to do now
Airports, airlines, schools and newsrooms can take a few cheap lessons from these weeks. Do not let the name in a threat drive the response or the public statement, because these names are public and copied; report each message with its full headers to the police and, for aviation, to the national security authority. Education authorities should agree with the police in advance when a mass email does not require evacuation, as the police in Scotland and Ireland's education department did on 11 November and as Italy's protocol of 12 November now provides, and treat central mailing lists as part of their attack surface. Newsrooms should check before calling a signature a claim of responsibility. And any institution can become the sender, through credentials stolen years earlier: resetting the passwords that turn up in infostealer leaks, alumni accounts included, phishing-resistant multi-factor authentication and an eye on mass outbound mail might have spared a hospital network in Bogotá and two universities their part in this story. The dashboard lists the message indicators and offers five Sigma rules, tested on the published texts, as a starting point for mail filters.
For analysts, CERTs and journalists we offer a reproducible, up-to-date record in which every figure has a source and every attribution has a confidence level. If you need to follow the campaigns and threats that reach your organization, get in touch.
Updates
- 12 November 2026, 12:30 UTC. Version 1.1 of the dashboard data, with research cycles five and six: the second email to Italian schools and the campaign's first demand, the Italian no-evacuation protocol, the October wave in Bulgaria, a possible seventh signature on the 3 November threat to Rome, the senders of 11 November and their leaked credentials, and a fifth Sigma rule.
- 11 November 2026, 17:30 UTC. First publication, with version 1.0 of the dashboard data.