Thousands of emails in a single day, followed shortly after by a call from the supposed IT department to resolve the issue. Retarus warns of a combination of attacks that affects corporate security by using corporate email overload as a starting point to compromise the security of organizations.
Email security experts at Retarus are seeing an increasing number of so-called ‘inbox bombing’ attacks, in which cybercriminals flood specific mailboxes with technically legitimate messages. They then contact victims, often through chat tools such as MS Teams, posing as their internal help desk. Their goal is to obtain login credentials, obtain multi-factor authentication codes, or trick employees into installing remote access tools.
In one of the cases observed within corporate security, about twelve employees each received between 2,000 and 3,000 emails in a single day, which amounted to more than 30,000 messages per day for that single company.
“Email bombings are not only intended to hinder an employee’s work. Attackers create chaos and then present themselves as the only ones who can solve it. This technique turns an apparently operational problem into an opportunity to steal credentials or gain access to company systems,” says Yeray Fraga, general director of Retarus Spain.
Different phases that occur in attacks
The first phase of the attack is based on newsletter subscriptions, push notifications and other harmless messages. Attackers use various combinations of sender and recipient addresses, as well as variations of subdomains, to mask any common patterns.
Additionally, these messages can be successfully authenticated and do not contain dangerous links or malicious attachments. Therefore, filters that evaluate each email individually have difficulty recognizing that they are part of the same campaign. The resulting flood of messages then creates the context for the second phase: an external ‘help’ contact via phone call or chat.
Beyond the spam filter
For Retarus, this combination of channels requires a defense that goes beyond simple analysis of the content of the messages. Visibility into email traffic, rapid anomaly analysis, and responsiveness are essential to identifying and containing the incident.
Anti-spam and anti-phishing filters help reduce the arrival of suspicious or malicious content. However, when individual emails do not show clear signs of a threat, it is necessary to look at the bigger picture: a sudden increase in incoming emails can lead to an attack that would go undetected if each message were examined separately.
Retarus Email Security provides observability metrics that allow IT and security teams to identify changes in incoming email volume, quarantine rates or authentication errors. This data can be integrated into monitoring platforms such as Grafana, Splunk, Dynatrace or Elastic.
SIEM systems integration
In addition, myEAS Email Live Search allows you to analyze traffic by sender, IP address, subject and time periods. Likewise, integration with SIEM systems makes it easy to correlate this information with data from Microsoft Teams, identity systems, and corporate teams to identify email overloads and false support contacts as an incident.
Retarus Email Security provides observability metrics to identify changes in incoming email volume
Once the campaign is identified, the Retarus administration API allows you to block senders or domains using inbound restriction lists and anti-spam block lists, both for specific recipients and for the entire organization.
“The response must combine technology with clear procedures for employees. Quickly detecting and containing an avalanche of messages is as important as preventing urgency from leading people to trust a supposed technical expert. Established support channels must remain the source of reference, especially when someone requests credentials, authentication codes or remote access,” concludes Fraga.
