What is Our Process for Stopping a Spam Bomb Attack?
Spam emails used to be a minor annoyance, but what if they were a sign of an impending cyberattack?
A new attack aims to flood their victim with spam emails and texts to cover up fraudulent activity, and one of Hungerford’s clients was a recent victim.
It’s called a spam bomb attack, and we recently discussed how it works. The attacker’s goal is to cover their tracks, so you don’t realize they stole your financial information.
If your inbox suddenly contains hundreds or thousands of emails from unknown senders, there are a couple of things you should do immediately.
Let’s dive into the details of what happened with our client, how we resolved the issue and what steps you should take if this happens to you.
Spam Bomb Attack Background
An employee of one of our clients recently noticed her work inbox was flooded with spam, including newsletters and other subscriptions she never signed up for. On top of that, she received several text messages from unknown numbers.
“My first thought was, ‘What is this?’” the employee said. “(The HT technician) was very understanding and told me what he would do to stop them from coming in.”
This employee wasn’t selected at random; her financial information already had been stolen, and the attacker was attempting to cover up any emails or notifications from the victim’s credit card company alerting them to the fraudulent activity.
Luckily for the employee, she received an alert that her credit card had been used to purchase thousands of dollars in merchandise at Best Buy, even though she hadn’t been to any Best Buy stores in years or had ever purchased anything on the retailer’s website.
As soon as she noticed an unusual number of emails, she emailed our support team, and we got to work identifying the problem.
How We Halted a Spam Bomb Attack
Step 1: We contacted the employee immediately to let her know what was going on, how we would fix it, and what she could do on her end. Normally, we’d advise the victim to check their bank accounts and credit cards to ensure no fraudulent charges were made, but she already was aware of it at this point.
Step 2: We set up rules in her email that blocked specific keywords commonly used in these newsletter subscriptions and emails written in foreign languages. These two rules blocked the bulk of the spam she was receiving. Lastly, we have a list of websites attackers commonly use to send these newsletters, and we have blocked them.
Step 3: We informed her that she would have to clean up her inbox manually, deleting the emails sent before the rules were enacted. At this point, we advised her to manually block senders that get past the spam filters and new rules. We warned her not to click the unsubscribe button at the bottom of these emails, as they often contain weaponized fake links.
A spam bomb attack aims to flood their victim with spam emails and texts to cover up fraudulent activity, and one of Hungerford’s clients was a recent victim.
After the Spam Bomb Attack
Once the rules were in place and the domains had been blocked, we checked in with the employee to ensure the spam didn’t come back.
She reported no further spam, had the fraudulent charge removed and had her credit card canceled before the attacker could make any more purchases.
How to Protect Yourself in a Spam Bomb Attack
If your inbox suddenly contains hundreds or thousands of emails from unknown senders, there are a couple of things you should do immediately. The Hungerford incident response team, which helped our client, had these recommendations.
- Check your bank account, credit cards and credit score for unusual activity. If your bank hasn’t alerted you at this point, make sure you tell them about any transactions you did not make.
- Contact your IT team or managed service provider. We can reduce the number of emails you receive by implementing rules and blocking domains.
- Be wary of unexpected messages. If someone reaches out to you on Microsoft Teams offering to help, do not engage with them and contact your IT team yourself. Oftentimes, attackers reach out to gain trust and use a remote support application to disable security controls, steal sensitive data or deploy malware.
While it can be stressful and overwhelming to see your inbox littered with unknown messages, it’s essential to stay calm and follow the steps above.
“They want you to panic,” the team said.
Protect Your Organization from Spam Bomb Attacks
Hackers are getting cleverer at conducting their attacks, and it’s only going to get worse with the rise of AI.
Our quick response was possible because this employee knew to contact us. This is why it’s important to enroll your organization in phishing training, so your employees know about new attacks and how to protect themselves.
Don’t wait until a or cyberattack to improve your organization’s security posture. Contact us today to schedule a consultation, and let’s secure your business before the next threat hits.
Stay updated! Get tips and insights delivered to your inbox weekly by subscribing to our newsletter.
