Email Bombing

In ATT&CK the technique sits under Impact, with Availability as the impact type, but in real intrusions it behaves like a pretext. MITRE notes it can precede Spearphishing Voice (T1566.004): the flood lands, then someone calls offering to fix the spam problem. That conversation ends with the victim granting remote access through a support tool (T1219, Remote Access Tools), which MITRE says can lead to stolen credentials, ransomware or Financial Theft (T1657).

MITRE lists Storm-1811 (G1046) as the procedure example, and Microsoft documented the pattern from mid-April 2024: a flood, a call from someone posing as IT support, then Quick Assist. At the end of May 2024 the actor added Microsoft Teams, using tenants whose display names read Help Desk, Help Desk IT, Help Desk Support or IT Support. The victim pressed Ctrl+Windows+Q, typed a security code and allowed screen sharing and control. A scripted cURL command then fetched batch files or ZIP archives, some dressed up as a spam filter update that asked for credentials. Microsoft tied this to Qakbot, ScreenConnect, NetSupport Manager and Cobalt Strike, and in several cases PsExec pushing Black Basta ransomware across the network.

The detection is the order of events. Flood, then outside contact, then a remote-support tool. Any two of the three on the same user is enough reason to call that user.

Plenty of benign events draw the same graph. A user registers for a conference and every exhibitor mails them in the same hour. A product launch, a tax deadline or a sale pushes mail to staff who subscribed years ago. Backscatter does it too: when someone spoofs an employee's address in a spam run, the bounces come back to that employee, although those messages come from mail servers and not from newsletters. Shared mailboxes such as billing@ or support@ sit above any per-user threshold all day.

Tune on the combination, not the count. Exclude shared and service mailboxes by name, baseline each user's own 30-day volume, and require sender diversity before alerting. Then add the second leg. A flood on its own is a ticket for the help desk, while a flood followed by an external chat or a remote-support tool is an incident. That split keeps the volume rule quiet enough that analysts still read it.

Start with the person. Reach the user over a channel the attacker does not control, such as a known phone number or in person, never a reply to the flood, and ask one question: has anyone called, messaged or offered to help with the spam? If yes, ask whether they let anyone connect. Keep it plain, because people are embarrassed to admit it. Then check the endpoint for a Quick Assist or other remote-support session, a cURL or BITSAdmin download and new scheduled tasks.

If a session was granted, treat it as hands-on-keyboard access. Isolate the device, end the session, reset the user's credentials and revoke their sessions, then hunt for the payloads Microsoft ties to Storm-1811: ScreenConnect or NetSupport Manager installs, Qakbot, Cobalt Strike beacons and PsExec use against other hosts. If nobody made contact, deal with the flood itself. Junk or quarantine the senders with a mail flow rule, and tell the user not to click unsubscribe links in mail they never asked for.

Then widen the lens. The same actor usually targets several people at once, and Microsoft names executives, HR and finance staff as common targets. Search for the same sender domains and subject patterns on other mailboxes, and warn the help desk so a real ticket from the victim is not mistaken for part of the attack. If your organization does not use Quick Assist, block or remove it. Microsoft notes it is installed by default on Windows 11.