Email Bombing (T1667) floods a target address with messages. MITRE lists it under the Impact tactic, on Linux, macOS, Windows and Office Suite.
The aim is to overwhelm a mailbox so that legitimate messages disappear in the noise, whether they are security alerts, help desk tickets or client mail. It can also simply be used to harass someone.
How attackers use it
MITRE describes an automated bot that signs a target address up to email lists that do not validate new signups, such as online newsletters. The result can be thousands of messages in a short time.
The more serious use is as cover and as setup. Buried messages can hide security alerts or ongoing scams. MITRE also notes email bombing can precede Spearphishing Voice (T1566.004). An adversary bombs the target, then phones them and fraudulently offers help. That conversation can lead to Remote Access Software (T1663), credential theft, ransomware or Financial Theft (T1657). One documented group sent large volumes of non-malicious spam and then posed as IT support or the help desk to resolve the problem it had just created.
How to detect it
MITRE's detection strategy looks for volume and repetition aimed at one recipient:
- An abnormally high count of inbound messages, or repeated attachments, landing in a single mailbox within a short window.
- On mail servers such as Postfix or Sendmail, excessive connections or inbound message counts targeting one recipient, correlated with repetitive attachment storage in mail spool directories.
- On desktop mail clients, a mass arrival of messages or repeated attachments stored locally in cache directories.
- On macOS, large volumes of mail stored under the user's Mail folder with unusual timing or repeated subjects.
Pair the volume alert with a help desk workflow. If a user reports a flood and then an unexpected call from "IT" follows, treat the call as suspect.
How to reduce the risk
- Software Configuration. Use SPF and DKIM, enforced through DMARC, so recipients can filter on sender domain validity and message integrity. MITRE notes that extra filtering may be needed when mail arrives from legitimate sources, such as newsletters.
- User Training. Teach users to recognize manipulation attempts. A flood of mail followed by an offer of help is a pattern worth naming in training.
A good habit to add: tell staff that IT will not call unprompted to fix a mail flood, and give them a verified number to call back.
Quick check
Why does email bombing often come before a phone call?
The flood creates a problem and a reason to accept help. The caller then offers to fix it and tries to get remote access or credentials.
What simple signal does MITRE suggest watching?
A sudden spike in inbound messages, or repeated attachments, to a single mailbox in a short time.
Sources
- MITRE ATT&CK, Email Bombing (T1667): https://attack.mitre.org/techniques/T1667
