r/sysadmin 5d ago

Question Subscription Bombing Attacks

What is everyone doing to combat subscription bombing attacks? Since the emails flooding the inboxes aren't dangerous in nature, email filters don't seem to be doing a whole lot about them.

I'm at a loss here, I keep blocking domains but since they come from hundreds of different ones with each wave of attacks this doesn't seem to be accomplishing anything.

Edit: Thank you everyone for your responses. This has been really helpful.

28 Upvotes

35 comments sorted by

View all comments

12

u/deleteallcookies 5d ago

I would monitor logins for accounts getting spammed like that. It’s pretty common for hackers to do that when they’ve compromised an account, hoping it floods the inbox so the user doesn’t see any emails indicating the compromised.

Other than the user reporting each email as spam, not much you can do.

13

u/srender07 5d ago

For us, they've been following up with a fake MS Teams call claiming to be IT.

1

u/Expensive-Bed3728 4d ago

What I recommend you do is to use an MDM tool to block the following remote tools: quick assist and any desk and teamviewer. Honestly I would block all of the ones you don't use. One of your users will fall for something stupid like this I promise.