A week of cyberattacks and bomb threats: What do we know?

At 8.33am on Friday, an email was sent to publicly listed email addresses at media organisations across Ireland and the UK. Its subject line read: "MESSAGE TO THE WEST".

The sender claimed responsibility for bomb threats that had disrupted European flights earlier in the week. Now, the message alleged, an explosive device had been planted in the recipients' buildings.

Within the hour, staff were being evacuated from Irish newsrooms and broadcasting schedules were disrupted.

An Garda Síochána said it was liaising with the affected media organisations and that the threats would be investigated.

It followed a week in which supermarket refrigeration systems were hacked and passenger flights were diverted following bomb threats.

The incidents involved different methods. Claims about who was responsible have added to the uncertainty, but their occurrence in the same week does not establish a common source.

What do we know about what happened? And what can investigators establish about those responsible?

What can the sender’s address actually tell us?

The email received by RTÉ displayed a sender address using a domain associated with a school in Lithuania. Initial checks of its technical headers indicate it passed through Microsoft email infrastructure authorised to send messages for that domain.

That makes simple spoofing, where an email is made to appear as though it came from an address it was not actually sent from, less likely. But authenticating an email is not the same as identifying its author.

Cybersecurity researcher Maciej Makowski, who spent almost 13 years in An Garda Síochána, including as a detective in the Garda National Cyber Crime Bureau, examined the account.

He found that credentials associated with the email address appeared in at least two previous data breaches.

The records indicate that the same password was used for several online accounts and appeared in leaked data in a form anyone could read.

Mr Makowski said the exposed credentials provided a possible explanation for how someone else could have gained access to the account.

His assessment is that unauthorised access to the legitimate account is the most likely explanation for how the threat was sent.

That has not been independently established. RTÉ has contacted the school to establish whether it is aware of any unauthorised access.

Have similar accounts been used before?

Friday's threat was not the first of its kind examined by RTÉ in recent months.

In May and October, threatening emails sent to schools in Carlow displayed a Gmail address and an address associated with a named university in Thailand. RTÉ’s checks found that the Thai university address had previously appeared in a data breach.

When Mr Makowski examined the addresses used in the earlier school threats, his assessment was that they were most likely legitimate accounts that had been accessed without their owners' permission.

There is no evidence connecting the messages, but they share some broad characteristics.

Friday’s email and the October message to a Carlow school did not identify the recipient, name the building or explain why that particular organisation had been targeted.

Instead, both included broad threats framed around wider political or international grievances and imposed short deadlines.

Monday: Refrigeration systems attacked across Europe

Friday's message came at the end of four days of disruption across Europe.

On Monday, refrigeration systems in supermarkets in at least eight European countries were affected by a cyberattack.

In Ireland, 13 SuperValu stores were affected, forcing chilled and frozen produce to be removed from sale. Elsewhere in Europe, retailers reported refrigeration temperatures being set as high as 50C.

The National Cyber Security Centre later confirmed that refrigeration controller systems manufactured by Danfoss and Copeland/Dixell had been compromised.

RTÉ Clarity has learned that Danfoss systems were in use at some of the affected SuperValu stores.

Online posts attributed to pro-Russian hacking groups NoName057(16) and Z-Pentest Alliance claimed responsibility for a joint attack on Danfoss. Their involvement in the supermarket attacks has not been independently established.

Kremlin spokesperson Dmitry Peskov subsequently dismissed suggestions of Russian involvement as "absurd", saying no evidence had been presented.

Refrigeration systems at three regional blood banks in France were also affected by a cyberattack on Monday. French authorities said blood supplies were not affected.

Tuesday: Bomb threats disrupt European flights

At least seven European flights were affected by bomb threats on Tuesday.

They included a Ryanair flight from Dublin to Rome, which was escorted by the Italian Air Force before landing at Fiumicino Airport. The aircraft was searched and subsequently given the all-clear.

A Ryanair flight from Dublin to Sofia was also targeted. It landed safely and no explosives were found.

No viable devices were found following any of Tuesday's threats.

Thursday: Bomb threats disrupt more European flights

Just two days after bomb threats affected at least seven European flights, Europe's airspace was disrupted again.

This time, at least 27 flights were impacted.

They included an Aer Lingus flight travelling from Dublin to Rome, which was diverted to Évreux military air base in northern France after being escorted by French military aircraft.

Thursday's threats affected flights to and from Ireland, the UK, Spain, Finland, Austria, Poland, Bulgaria, Greece, Portugal, Denmark, Italy, France, Czechia, Romania, Serbia and Germany.

Many of the threats were reported by local media to have arrived by email, often sent directly to airports.

In Italy, a threat targeting two aircraft which landed at Rome's Fiumicino Airport, including one travelling from Dublin, was reported to have originated from a single anonymous email sent to the airport.

The email, seen by the BBC, invoked the Russian extremist movement Male State, claiming its "fighters" had planted explosives on two incoming flights.

A Telegram account linked to the movement subsequently denied involvement to the broadcaster.

Friday: Threats reach media organisations

Further bomb threats disrupted European flights on Friday, prompting military aircraft to escort some of the affected services.

The email sent to RTÉ and other media organisations claimed responsibility for earlier airline threats, but provided no independently verifiable evidence.

The Government said it was not yet known who was responsible for the threats or whether they were the work of individuals or a centralised or co-ordinated effort.

However, noting the disruption to European aviation from similar threats, it said "it seems likely that this is a co-ordinated campaign of disruption."

Gardaí and the Defence Forces are liaising with European security counterparts as authorities seek to establish who is responsible.

The statement also added that: "Gardaí have been alive to the risk of disruptive threats such as these in the context of planning for EU Presidency events."

Mr Makowski said it may be possible to establish links between incidents where accounts are suspected of having been compromised, but that this would depend on being able to distinguish the legitimate account owner's activity from activity carried out after an account had been taken over.

He said it would also depend on how long the accounts had been used without their owners' permission.

The disruption is clear.

Who caused it, and which incidents, if any, are connected, remains unresolved.