International 'chaos' hackers charged with phony bomb threats to hundreds of schools

A pair of computer hackers have been arrested in an internet scheme to "sow chaos" by sending phony bomb threats to hundreds of schools and other places in the U.S. and Britain, a federal indictment alleged Tuesday.

Timothy Vaughn, 20, of Winston-Salem, North Carolina, and George Duke-Cohan, 19, of Hertforshire, United Kingdom, were both charged by the FBI this week. The men are members of Apophis Squad, a worldwide collective of hackers, the Department of Justice said in Los Angeles.

Vaughn, who used the online handles “WantedbyFeds” and “Hacker–R–US,” and Duke-Cohan made false threats of shootings and bombings last year that were intended “to cause fear of imminent danger and did cause the closure of hundreds of schools on two continents on multiple occasions,” the indictment said.

One phony threat targeted Los Angeles International Airport, the indictment alleges. In many of the school threats, authorities were contacted in mass emails and were told that pipe bombs had been planted in buildings.

Duke-Cohan is currently serving a prison sentence in Britain for the airliner hoax. His internet usernames included “DigitalCrimes” and "DoubleParallax," court papers show.

Britain's National Crime Agency reported that Duke-Cohan's bomb threats "resulted in over 400 schools in the UK being evacuated in March 2018." It's unclear how many U.S. schools received threats.

National Crime Agency investigators working with the FBI said that while on pre-charge bail for the threats to schools, Duke-Cohan made bomb threats to U.S.-bound flight UAL 949 via phone calls to San Francisco Airport. 

In a recording of one of the phone calls which was made while the plane was in the air, he takes on the persona of a worried father and claims his daughter contacted him from the flight to say it had been hijacked by gunmen, one of whom had a bomb, the National Crime Agency reported.

On arrival in San Francisco the plane was the subject of a significant security operation in a quarantined area of the airport. All 295 passengers had to remain on board causing disruption to onward journeys and financial loss to the airline.

Apophis Squad is well known for bragging about its ability to elude federal authorities, noted security journalist Brian Krebs wrote on his web site, KrebsOnSecurity. Krebs described the Apophis group as a band of "internet hooligans."

It wasn’t immediately known if the defendants have attorneys who could comment on the felony charges that include making threats to injure in interstate commerce and making interstate threats involving explosives.

The indictment alleges the Apophis Squad made false threats and engaged in “swatting,” in which a phony report is made to trigger deployment of emergency response teams.

Members of Apophis Squad used “spoofed” email addresses to make it appear some threats had been sent by innocent parties, including the mayor of London, according to court papers.

They also are accused of launching denial-of-service attacks, in which a hacker disables a computer network by flooding it with data, including ab attack that took down the website of a California motorsports company for three days.

Duke-Cohan is accused in the indictment of calling the FBI field office in Omaha, Nebraska, discussing the deployment of deadly pathogens in the building, and threatening to rape and kill the wife of an employee who answered the phone.

CONTRIBUTING: Associated Press