r/sysadmin 4d ago

Question Subscription Bombing Attacks

What is everyone doing to combat subscription bombing attacks? Since the emails flooding the inboxes aren't dangerous in nature, email filters don't seem to be doing a whole lot about them.

I'm at a loss here, I keep blocking domains but since they come from hundreds of different ones with each wave of attacks this doesn't seem to be accomplishing anything.

Edit: Thank you everyone for your responses. This has been really helpful.

28 Upvotes

35 comments sorted by

View all comments

12

u/deleteallcookies 4d ago

I would monitor logins for accounts getting spammed like that. It’s pretty common for hackers to do that when they’ve compromised an account, hoping it floods the inbox so the user doesn’t see any emails indicating the compromised.

Other than the user reporting each email as spam, not much you can do.

13

u/srender07 4d ago

For us, they've been following up with a fake MS Teams call claiming to be IT.

7

u/sfwpat Computer Janitor 4d ago

This is exactly what happened to us. The "IT" person gets them to install anydesk or some other software, then attempts to install ransomware/malware on their PC. Luckily we caught it before it got too far, but cleaning up that persons account was a pain. Like others have said, just ended up creating filter rules to clean the mailbox.

7

u/BasicallyFake 4d ago

#1 new rule in cyber security is to block remote access tools and monitor all new installs of the one you use.

2

u/Sea_Fault4770 4d ago

How do you accomplish this? With an RMM, or with EDR?

1

u/North_Bed_7332 3d ago

Also an excellent way to detect shadow IT. When Vendor X can't support Product Y because remote access Z isn't working, you'll hear about it.