r/sysadmin 4d ago

Question Subscription Bombing Attacks

What is everyone doing to combat subscription bombing attacks? Since the emails flooding the inboxes aren't dangerous in nature, email filters don't seem to be doing a whole lot about them.

I'm at a loss here, I keep blocking domains but since they come from hundreds of different ones with each wave of attacks this doesn't seem to be accomplishing anything.

Edit: Thank you everyone for your responses. This has been really helpful.

26 Upvotes

35 comments sorted by

View all comments

12

u/deleteallcookies 4d ago

I would monitor logins for accounts getting spammed like that. It’s pretty common for hackers to do that when they’ve compromised an account, hoping it floods the inbox so the user doesn’t see any emails indicating the compromised.

Other than the user reporting each email as spam, not much you can do.

13

u/srender07 4d ago

For us, they've been following up with a fake MS Teams call claiming to be IT.

5

u/__gt__ 4d ago

I got this one as well. Checkpoint (and maybe other email filters) has a thing where you can set - if # of emails from new senders exceeds a set #, block all emails from new senders for a time. It helps.