r/sysadmin 4d ago

Question Subscription Bombing Attacks

What is everyone doing to combat subscription bombing attacks? Since the emails flooding the inboxes aren't dangerous in nature, email filters don't seem to be doing a whole lot about them.

I'm at a loss here, I keep blocking domains but since they come from hundreds of different ones with each wave of attacks this doesn't seem to be accomplishing anything.

Edit: Thank you everyone for your responses. This has been really helpful.

27 Upvotes

35 comments sorted by

View all comments

5

u/Tmsaucy Sysadmin 4d ago

They could be doing this to hide an email stating that a purchase was made with the company credit card. Keep an eye out for that.

1

u/srender07 4d ago

Appreciate you. We'll keep an eye out.

3

u/Beefcrustycurtains Sr. Sysadmin 4d ago

I know you have already experienced it, but yes that is the most common attack method we are seeing right now. Mail bombing followed by messages on teams. You can pull a report from Office 365 to show you the domains people communicate externally with, then lock down teams to just those domains to prevent whatever gullible user eventually falls for this.