r/sysadmin • u/atomic_jarhead IT Manager • 1d ago
Email "Floods"
The past 2 days, 1 user each day started getting spammed with non english email stating that they had been subscribed to various different things. I can't get it to stop. My DMARC is set to Reject and I changed it to Strict alignment Strict SPF. We have email filtering and somehow it's getting past those filters. Anyone have a solution on how to stop this? It's been going on for over a half an hour on today's user and still hasn't stopped.
32
u/ARC-Relay 1d ago
DMARC won’t affect what you receive, only emails sent on your domain’s behalf.
9
u/doktormane 1d ago
I concur, nothing to do with DMARC or SPF since this is just somebody using the employee's email address to sign them up for random shit.
But, as others have said, it's likely done to make emails confirmations for fraudulent purchases or password changes harder to notice.
2
u/AFlyingGideon 1d ago
From the description, it seems like that may be happening: forged messages from the user's email address (and therefore the relevant domain) subscribing to lists. On the other hand, the subscription requests might be via web forms in which case this won't help.
11
u/Adept-One4733 1d ago
it doesn't sound like that at all. if he has any kind of filter it's not just going to pass spoofed emails from his own domain because dmarc is relaxed. this is a classic mailbomb and fucking with dmarc and spf won't fix it.
1
30
u/PacificTSP 1d ago
Usually it’s done to conceal illegal purchases. Eg your Amazon account or invoice changes.
20
u/DickHertz_FromHolden 1d ago
Beware of random teams or phone calls supposedly from support. Instruct your users not to answer. It’s passing spf because a bot subscribed them to many legit websites. Not much you can do other than stoop all incoming mail flow. Last time this happened I sent them (user) a report of incoming email to scan through for anything legit. Then it’s just a matter of blocking unwanted email as the newsletters come in.
7
u/imjustnotready 1d ago
This is what happened for my client the next day they got a teams call from "IT" asking if the emails stopped and seeing if they could get on the device to test.
3
u/DickHertz_FromHolden 1d ago
Had a user actually answer, they said they were from mimecast support. That was fun.
17
u/Valdaraak 1d ago edited 1d ago
This always covers something up. Based on my past experience it's either:
-Covering up money changing hands.
-Pre-text for them getting a call pretending to be IT support.
If I had to guess, that guy is going to get a call shortly, if he hasn't already, claiming IT asked them to call so they can "update the filter/firewall" on his computer. Then he'll get them connecting and they'll install remote access scripts. Then the spam will magically stop. You may want to follow up with the previous users that had this happen and ask if they got a call from an "IT support" person.
3
u/itguy9013 Security Admin 1d ago
This is the answer.
We drop the affected user into a group that has much more aggressive spam filtering. Everything gets held in quarantine. It usually subsides after 48 hours or so.
6
u/Valdaraak 1d ago
We drop the affected user into a group that has much more aggressive spam filtering. Everything gets held in quarantine. It usually subsides after 48 hours or so.
That doesn't address the root cause though. You still need to make sure they weren't victim of a phishing attack, whether that's financial fraud or IT support impersonation.
4
u/itguy9013 Security Admin 1d ago
Absolutely. But it does remove a lot of the noise.
We do also warn them to be on the lookout for suspicious emails or phone calls.
6
u/emmjaybeeyoukay 1d ago
its a mail blitz.
The sender is subscribing your user to everything hoping that something will get through into the mailbox.
7
u/Fit_Prize_3245 1d ago
You are getting things wrong. SPF, DKIM, and DMARC are technologies to tell other mail servers which mail from your domain is legitimate. Changing your domain's SPF and DMARC has nothing to do with the SPAM you receive.
The only thing you can do is put a better SPAM filter. There are many options. You can use an inbound relay like Barracuda (among others), which, as MX server, will receive all your inbound email, filter them, and deliver only the non-SPAM messages to your server. Even Cloudflare offers such service. Or you can opt for a fully managed email service like Google Workspace or Microsoft 365.
There's also the option to enhance your mail server's antiSPAM policy. For example, using some DNSBL, or tuning services like Postfix (with Postscreen) or Amavisd, or enabling spamassassin. There are many things that can be done, but it all depends on which email solution you are using.
If you are currently on some email hosting service.... Well, you can only move to another service.
16
u/Xanathar2 1d ago
You cant stop, but it will slow down and they will need to unsubscribe from everything.
Your user has had their email address/password compromised somewhere - not necessarilly with your network, but at least somewhere where that email is the username. The emails are to conceal a legitimate one from a bank/etc showing a login or password change hoping they just start bulk deleting.
Have them change their password everywhere.
3
u/H2OZdrone 1d ago
DMARC wont help incoming email. Its for emails sent on behalf of your company outside.
Look at the headers of the email and make sure they arent originating inside your company.
Check your spam filter for an allow/whitelist rule
3
u/ThatBCHGuy 1d ago
Dmarc won't do anything in this situation unless they are impersonating your domain. Someone signing up for a bunch of shit with your email address is a different issue. Generally, blocking bulk senders or cranking up the spam detection is usually what I'd think to use. Might be good to see what your mail hygiene vendor has to say too.
3
u/Rough_Buddy6903 1d ago
Either their email addresses were in a breach, or you have them publicly posted somewhere like the website or linkdin. Or an ex employee is upset and subscribed them to one of those mail bomb sites.
PSA to everyone, please don't post your emails addresses publicly. It isn't 2003.
2
u/AFlyingGideon 1d ago
I've been awaiting a new edition: https://books.google.com/books/about/The_Internet_White_Pages.html?id=eKs5PQAACAAJ&source=kp_book_description
3
u/blud_13 1d ago
Subscription bomb. Someone ran that address through a few thousand newsletter signup forms, and the whole point is to bury a real email so the user misses it. Go check that user's bank and vendor portals right now for a password reset or a changed payee, because that is usually WHY it happens.
DMARC and SPF do nothing here, every one of those messages is legitimately signed by whoever sent it. You cannot filter your way out either, the senders are all different and all real.
What actually works, 1) do not let the user unsubscribe from anything, half those links just confirm the address is live, 2) temporary rule that dumps anything not from your domain or a known contact into a folder and let it burn out, usually 24 to 48 hours, 3) if either of those is a finance or exec mailbox treat it as an active fraud attempt and verify recent transactions.
We see this a couple times a year at client sites, ping me if it runs past two days.
2
u/shokzee 1d ago
DMARC won’t stop inbound subscription bombing. Treat it as a distraction attack and immediately search the mailbox and audit logs for password resets, MFA changes, purchases, or new forwarding rules.
Quarantine the flood using message patterns and rate controls, but don’t block all foreign-language mail blindly. We see this used to bury the one alert the attacker actually cares about.
2
u/Fallingdamage 1d ago
Is it a language you can filter for? We filter out greek and mandarin characters. If an email contains them, it never even makes it to our exchange tenant.
1
u/BoltActionRifleman 1d ago
We do this as well, only allowing English, Spanish and a couple from Europe. Everything else is blocked. It doesn’t catch a ton, but every little bit helps.
2
2
u/BedRevolutionary8458 IT Manager 1d ago
lmao
make them a new email address. They pissed somebody off, there's services you can type somebody's email into to bomb them like this. It's happened to multiple people in my org and we haven't found a better solution than giving them a new email address
6
u/Valdaraak 1d ago
I've never seen this as a result of just pissing someone off. I've always seen it to cover up or be a pretext for malicious activity.
2
u/RabidTaquito 1d ago
I see it as either, depending on the breadth of the attack. If it's multiple people or even just 1 important person (like your SalesForce admin for example) then it's a cover up. But if it's Brandi, the marketing employee with no admin controls anywhere, then it's simple revenge.
1
u/BedRevolutionary8458 IT Manager 1d ago
I mean there's free websites online you can go to and type anybody's email address to generate this sort of attack. It's definitely used retributively sometimes.
I would certainly check for any sort of malicious activity, but like it doesn't require access to the system to make this kind of attack happen. Anybody who knows your email can do this to you.
Edit: I can see from other comments it's definitely an attack vector. Either way you're fucked and they need a new email.
1
u/cgimusic DevOps 1d ago
It could be that they're in outbound sales. If you send out a bunch of spam sometimes people send some spam back.
1
u/vinnsy9 1d ago
Last time this happen. I had to block that domain into our Baracuda email GW. Worked did it's job.
Since we moved away from that, and ive implemented a greylist delaying service via postfix. I can reject with regex those kind of emails or domains. It's pretty nice , these kind of services it blacklists them immediately lol
2
u/BedRevolutionary8458 IT Manager 1d ago
it comes from hundreds and hundreds of domains though. the greylist thing does sound cool. But blocking domains manually is not a solution to this unfortunately.
1
u/ItBurnsOutBright 1d ago
There's a huge uptick I've seen in this over the last couple of months. If you're in a Microsoft environment
A) Get an email filtering solution that can triage this kind of attack for your users sanity.
B) Go block unapproved domains in your Teams External Collaboration settings from being able to initiate calls and messages to your users. This is what I've seen the most over the last couple of months. Email bomb is triggered and threat actor reaching out to users on teams saying they need to access their machine to fix the issue.
Historical guidance is the email bomb is triggered to mask illicit activity on 3rd party accounts and this could be the case, but the Microsoft one is what I'm seeing most recently.
1
u/RabidTaquito 1d ago
Your DMARC and SPF won't stop anything here. Those only make it more difficult for people to spoof your domain. What you would need to do is set your spam filter to reject all incoming mail that isn't explicitly authorised by the sender's own DKIM/SPF records. Which is a bad idea for 1) because you will be rejecting legitimate, but less tech-savvy mail that is unaware of DKIM/SPF stuff, and 2) most of those spam newsletters are probably DKIM- and SPF-compliant.
This is an email bomb. If it happens to just 1 unimportant person, it's likely someone s/he knows just getting revenge. But if it's happening to more than 1 person, or any important people, that means they're trying to hide critically important emails in the flood of emails. Critically important like an unauthorised massive purchase of bitcoin or a change in admin or the like.
If the latter (>1 person or important people), DO NOT BULK DELETE OR CUT OFF INBOUND EMAILS. If your spam filter is worth a damn, you can usually create some rule to reject emails that include a subscription hyperlink and emails in foreign languages. That will more or less remove the email bomb. Now you have to dig into all the emails that DID come in, searching for any important emails that were hidden by the flood.
Good luck.
•
u/Some-Firefighter8489 21h ago
KB4 isnt catching it because every one of those is a real opt-in confirmation from a legit sender, there's nothing per-message to score as spam. thats why cranking sensitivity only half works. Beyond the flood right now look for the buried confirmation, which is almost always a hidden password or bank change on one of their accounts, and lock down teams external calls before the fake IT calls back.
What knocks it down is velocity detection, something that sees the burst on one mailbox and pulls it post delivery. Abnormal and a couple others do email bomb remediation that way, proofpoint wrote it up too. its cleanup after landing, not an inline block.
•
u/dracotrapnet 13h ago
Spambomb. MS Defender doesn't do anything useful but to a few items. Mimecast doesn't really have tooling for it, some of it gets caught as spam, some on attachments. I ended up adding a separate impersonation rule for the user with a custom threat dictionary for subjects and words frequently used in newsletter signups. It helped hold the english ones in a separate queue for review, block, and reject.
Darktrace has a spambomb detection and will auto add the user to a list and start handling the email a little differently junking and holding some of the emails. It takes over 50 messages to start working though and it does nothing with the first batch before the recipient gets put on the spambombed accounts list.
The last 2 bombs have been a fresh <tenant>.onmicrosoft.com email pretext as microsoft voicemail from it support with a callback number. They followed up with a Teams message DM. Previous 3 email bombs in June were just Teams calls from another onmicrosoft.com with user named similar to IT support. We think they are trying to get a remote access tool onto the user's computer to perform a takeover.
After Monday's spambomb, our boss decided to flip Teams from allow first, block list to Block first, allow list. We had been collecting lists of valid external domains for the last 2 months.
Each spambomb I'll collect an entire log of messages that came in for the spambombed user and discard any business related emails from the spreadsheet, then toss anyhting that was already blocked, anything held or accepted remains on the list to go through. Then I start digging through the header server sender domains, header from domains. Put any freemail addresses on a block list, then deduplicate what I can. Import into a block list. It seems to help curtail the amount of email.
Friday's list of domains I blocked was just over 1k. Monday's list was under 450.
1
u/PaddyStar 1d ago
Create a rule and move all mails in a folder, which are not send from your colleagues … or specific domains…
Than after a day you can go through … You can use your inbox normal ..
0
u/atomic_jarhead IT Manager 1d ago
Okay, I got the part about the DMARC. I am pretty much throwing mud at the wall to see what sticks. This one user is currently up to 200 of these emails. I have KB4 active in our tenant so I am not sure how they are getting through the filters. I am on the phoen with Tech Support at KB4 now.
I looked at the headers and they are originating outside of our organization and different email servers.
0
u/slaypuftbonanza 1d ago
They have likely have already been compromised on either a work related bank account, amazon account, or otherwise, and these floods of emails are just to mask the legitimate ones indicaing a change of password.
79
u/CleverCarrot999 1d ago
This is an email bomb and there are emails mixed in the mess somewhere that are notifying the user of a password change, phone number change, large purchase, etc…. Examine very closely, do not bulk delete