A mysterious name, two different organizations, and thousands of threatening emails that have caused turmoil in many European countries.
The self-proclaimed “Mikhail Andropov” appears at times as the leader of “Vilayat di Misoginistan” (Vilayat of Misoginistan) and at other times as the leader of the “Red Owl” , signing messages containing threats of bombings and mass murders.
ΣΧΕΤΙΚΑ ΑΡΘΡΑ
On Wednesday (11/11) alone, approximately 6,300 public schools in Italy and more than 770 in Scotland and Northern Ireland received such messages. Authorities are seeking to identify the sender, though they have not yet determined whether it is a single individual, multiple perpetrators, or an organized intimidation campaign.
The name “Mikhail Andropov” is at the center of investigations by European security agencies, as it has been used in threatening messages sent to schools, airlines, and news organizations.
SEE ALSO: Bomb threat call to a school in Paphos turns out to be a hoax; students and teachers return to class
The use of the same signature but different organizational identities is one of the elements investigators are examining. In Italy, the sender identifies himself as the leader of the “Vilayet of Misogynistan,” while in messages to schools in the United Kingdom he refers to a plan called “Red Owl.”
According to Rai News, the surname Andropov refers to Yuri Andropov, former leader of the Soviet Union, while previous messages had used the title “Message to the West.” The choice of these references does not, however, prove any connection to Russia.
Similarly, the term “vilayet” is also used by jihadist organizations to refer to their regional structures, while “Misogynistan” is a satirical online name. It may refer to “Male State,” a Russian ultra-nationalist and misogynistic movement that has been designated as extremist in Russia. Similar references have appeared in previous bomb threats in Europe. However, no organizational link has been proven.
The emails containing threats of bombings and mass murders
The messages contain extreme threats, with the sender claiming to have planted explosive devices in school buildings.
In the version sent to schools in Scotland and Northern Ireland, which the BBC examined, the author identifies himself as the head of the “Red Owl” project. ““I am Mikhail Andropov, head of the ‘Red Owl’ project. We have come to destroy you. We will commit genocide against your people,” the message states at the beginning.
He then claims to have left a powerful explosive device with a remote-controlled detonator inside a plastic bag in the building, threatening that the explosion will destroy the premises.
The sender also claims to have planted a bomb in the engine of the prime minister’s car and concludes by threatening that any survivors will be attacked with knives.
Police authorities who investigated the incidents found no evidence of a real threat and treated the emails as hoaxes.
From schools to airports and television networks
The activity attributed to “Mikhail Andropov” appears to extend beyond schools.
According to reports, on November 6, threatening messages bearing the same signature were sent to media organizations in Ireland and Bulgaria, including Ireland’s public broadcaster RTÉ and the Nova TV network. The British broadcaster Sky News had also received a similar threat.
RTÉ evacuated its facilities, while police searches, aided by specially trained dogs, found no explosives.
At the same time, a series of bomb threats caused disruption to European air travel, with flights being rerouted, making emergency landings, or undergoing security checks.
Among the incidents was a Finnair flight from Helsinki to Rome, which was escorted by Croatian and Italian fighter jets before landing safely. Aegean flights also received threats, though no actual danger materialized.
Although some of the incidents were accompanied by messages bearing the same signature, it has not been proven that all the threats originated from a single source.
— Rai Radio1 (@Radio1Rai) November 11, 2026
Allarmi bomba nelle scuole italiane. La rivendicazione è arrivata da un sedicente #MikhailAndropov, riconducibile a un dominio di Taiwan della Dayeh University “Siamo venuti per annientarvi” si legge nel messaggio pieno di minacce. 300 gli istituti interessati in tutta Italia. https://t.co/whhY3hCQQc
Digital Traces in Lithuania, Thailand, and Taiwan
The different email addresses used to send the messages are a key focus of the investigations.
According to Rai News, some appear to be linked to educational institutions in different countries, though this does not necessarily mean that the actual senders are located there.
In the case of Ireland’s RTÉ, one of the email addresses was linked to a school in Lithuania, while a threatening message sent to schools in County Carlow reportedly originated from a university address in Thailand.
In Milan, school principal Anna Bertato reported that when she searched online for the sender’s email address, she discovered that it had already been marked as spam by a university student in Taiwan.
These details raise questions about the possible use of compromised accounts or techniques to spoof the sender’s address, though it has not been confirmed how the messages were distributed.
— Mario Nawfal (@MarioNawfal) November 6, 2026
BREAKING: BOMB THREATS in Ireland this AM were reportedly accompanied by an email sent out to media orgs, including RTE, Newstalk, and the Irish Independent: "Hello. I am Mikhail Andropov, one of the leaders of the group responsible for the bomb threats against airplanes in Europe over the past week. European authorities have once again shown that they are incompetent fools who are incapable of doing anything to stop us. We experimented with multithreading, and we succeeded in causing widespread panic, as well as forcing European authorities to spend a fortune on all these procedures. But this is only the beginning. What happened this week is just a small part of what awaits Europe in the near future. Right now, we’re preparing a new wave of attacks. Right now, we’re recruiting residents of your countries who are actively cooperating with us. We’ve also gained access to compromised devices, servers, and accounts belonging to residents of Europe, as well as those outside its borders—which will allow us to use this against you. Very soon, we will be blowing up your airplanes, cruise ships, subway stations, and trains. In the meantime, I recommend taking a vacation by plane while you still have the chance. We want the whole world to know about us, which is why one of our operatives has planted an explosive device in your building. It will detonate in 45 minutes. The clock is ticking." Source: Live 95 (Ireland) / Writer: Michael https://t.co/dmwc4Zrluk
Italy: Threats Sent to 84% of Public Schools
The largest-scale attack was recorded on Wednesday in Italy, where a threatening email reached approximately 6,300 of the country’s 7,476 public schools, according to data from the Ministry of Education.
Minister Giuseppe Valditarra asked the relevant IT departments to assess the extent of the incident. The investigation revealed that the messages had reached 84% of public schools, excluding private schools and adult education centers from the tally.
In several cases, precautionary evacuations were carried out; however, searches did not uncover any explosive devices, and most students returned to their classrooms.
Massimo Nuzio Barella, a school principal in Milan, said he immediately recognized the message as a possible hoax when he received it at 8:59 a.m., describing its content as almost comical. “It was like a message from Martians: ‘We’ve come to wipe you out,’” he said, explaining that he did not proceed with an evacuation but reassured the parents.
According to Italian media reports, approximately 280 school principals had received similar threats in recent days.
Prime Minister Giorgia Meloni assured that investigations so far have not revealed any indications of a specific threat, assessing that this is an attempt to instill fear and cause unrest. At the same time, she announced a meeting at the government headquarters to coordinate the relevant agencies.
Valditara argued that the incidents point more to a cyberattack than to a real threat.
“The repetition and variety of the incidents suggest a strategy rather than the work of a lone hoaxer,” he said, clarifying that this was his personal assessment and not an official conclusion of the investigation.
— NEXTA (@nexta_tv) November 11, 2026
Mikhail Andropov throws Italy into chaos — Meloni calls emergency meeting Thousands of bomb threats have been sent to Italian schools by someone calling himself “Mikhail Andropov, leader of the Misogynistan Vilayat”. According to Reuters, the messages were sent to 6,300 educational institutions. Hundreds of schools evacuated pupils and staff. Prime Minister Giorgia Meloni called an emergency meeting. Many schools in Scotland, Northern Ireland and the Republic of Ireland received similar threats.
Scotland and Northern Ireland: More Than 770 Schools Targeted
In the United Kingdom, 470 schools in Scotland and more than 300 in Northern Ireland received similar messages.
Scotland’s Education Minister, Mary McAllan, acknowledged the concerns of parents and teachers, assuring them that no danger to the public had been identified.
The Scottish police assessed the messages as hoaxes and clarified that there is no need to evacuate schools or keep students out of class solely because of their content. Some schools had already taken precautionary measures.
In Northern Ireland, police announced that the threatening email originated from a country outside the United Kingdom.
Deputy Police Chief Anthony McNally emphasized that the risk to the public is considered low, noting that investigations are ongoing.
Education authorities recommended that schools continue to operate as usual, unless otherwise instructed by the police.
Newsrooms in Ireland and Bulgaria received bomb threats from someone identifying themself as ‘Mikhail Andropov’, claiming responsibility for a wave of hoax threats that have disrupted dozens of flights across Europe this week. https://t.co/YvdABmny5B
— Al Jazeera English (@AJEnglish) November 6, 2026
Extremist references and investigators’ scenarios
The use of different names and organizational identities complicates efforts to assign responsibility.
In earlier threatening messages, the name of the Russian extremist organization “Male State,” which has been linked to ultra-nationalist and misogynistic views and was designated as extremist by Russian authorities in 2021.
Individuals linked to the organization denied any involvement. In other cases, even the name of Iran’s Revolutionary Guards was used.
Researcher Chiara Sulmoni of START InSight has pointed out that switching between different extremist symbols may be used as a method of deception.
Among the possibilities being examined are a coordinated intimidation campaign, the activities of online extremist groups, or the use of fake identities by individuals seeking publicity and disruption.
Suspicions have also been raised regarding a possible destabilization campaign involving foreign state involvement, though no evidence has been presented linking these specific threats to any government.
What the Authorities Are Investigating and What Questions Remain
The investigations are focusing on the technical origin of the messages, the email addresses used, and the similarities in their content.
Specialized cybercrime units in Scotland are collaborating with police agencies in the United Kingdom and other countries, while Italian authorities are examining the mass mailing of the emails. Investigators are working to determine whether there is a common mechanism behind the threats targeting schools, airlines, and media outlets, as well as whether the different signatures are being used by the same person or by multiple perpetrators.
So far, the true identity of “Mikhail Andropov” has not been confirmed, nor has it been established that all the threats are part of a single operation.
Despite the absence of actual explosive devices, the mass threats have already led to evacuations, school closures, disruptions to air travel, and the mobilization of security services in many European countries.
Source: Proto Thema
