Field Notes · Sheet 16 / 30 · Email security
Three mail bombs, contained in minutes
Three coordinated mail-bomb campaigns against 30 to 45 high-value mailboxes, each contained within 5 to 15 minutes, and what made that speed possible.
Bradley Baker · · 1 min read
I identified and contained three coordinated mail-bomb campaigns targeting 30 to 45 high-value mailboxes, each within 5 to 15 minutes of the first wave, with no business disruption. This is the longer version of Sheet 16.
What a mail bomb looks like
A mail bomb doesn't look like an attack at first. It looks like one person suddenly subscribed to hundreds of real newsletters and services, all confirming at once. Microsoft describes it the same way: a flood of legitimate mail meant to overwhelm the mailbox and the filters, often as a precursor to something worse.
What comes after the flood
The something worse is worth planning for. Microsoft Threat Intelligence has documented attackers following an email flood with phone calls and Teams messages from fake IT support, offering to fix the spam.
What made fast containment possible
- Seeing the pattern early. A sudden spike in inbound volume to a handful of recipients is the signal, not any single message.
- Gateway controls that were ready. With roughly 200 Mimecast policies already in place, blocking the pattern was an edit, not a project.
- Getting word to the affected users before anyone else did.
Mail bombing in Defender for Office 365
If you run Defender for Office 365, Microsoft added Mail bombing as a detection technology in June 2025. You can filter for it in Threat Explorer and query it in advanced hunting.
Does your help desk have a script for a user in the middle of a mail bomb?
Sources
From the field reports
- Incident response
- Mail bombing
- Mimecast
- Defender for Office 365
- Social engineering