For the past two days, one user per day has been flooded with large numbers of non-English messages saying they were subscribed to various services. The flood has continued for more than 30 minutes at a time and is getting through our existing mail filters. I changed our domain's DMARC policy to reject with strict SPF alignment, but that has not helped. What is the best way to contain this attack without missing legitimate security or financial notifications?
4 Answers
DMARC, SPF, and DKIM mainly tell other mail systems which messages are authorized to come from your domain. They do not prevent your users from receiving legitimate messages sent by outside services. Check the headers and delivery logs to confirm the mail is external, then use your filtering provider’s quarantine, rate controls, bulk-mail detection, and pattern-based rules. Avoid blindly blocking all foreign-language mail, since legitimate messages can be caught too.
There is no universal way to make the subscriptions stop immediately. The volume usually declines after a day or two, but you can route likely newsletters and subscription confirmations into a review folder or quarantine them using your mail platform’s bulk-mail controls. Have the user change reused passwords and review important third-party accounts for unauthorized logins, purchases, password changes, and forwarding settings. If the address is repeatedly targeted, replacing it may eventually be necessary.
The flood often comes with a social-engineering follow-up. Tell the affected user not to trust unexpected calls or chat messages from someone claiming to be IT and asking to connect to their computer. Attackers may say they can fix the email problem, then install remote-access software. Consider temporarily placing the user in a stricter filtering or quarantine policy and restricting unsolicited external chat or calling requests.
Treat this as an email bombing or distraction attack, not ordinary spam. Carefully search the mailbox and security logs for password resets, MFA or phone-number changes, new forwarding rules, account changes, purchases, and banking or cryptocurrency alerts. Do not bulk-delete the messages until you have checked what they may be hiding. The attacker may be trying to bury one important notification.
I checked several headers and the messages are coming from external servers rather than from inside our organization. I’m also working with our filtering provider to see why so many are being delivered.