What are the signs that an email bombing campaign is underway?

Why an Email Bombing Campaign Is Easy to Miss at First

Email bombing is noisy, but the first stage often looks like ordinary inbox churn rather than a direct compromise. The key clue is not just volume, it is the pattern: many messages arrive in a short window, often from broadly legitimate senders or sign-up forms, and the normal signal-to-noise ratio in the mailbox collapses. That is why users may miss important mail before anyone realises a campaign is in progress.

When the flood begins, the practical test is whether the mailbox is becoming unusable for normal business. If important notifications are being buried, help desk queues begin to fill with confused users, or message volume spikes without a clear business cause, treat it as an active incident rather than routine spam. The operational impact matters because the attack is often designed to create distraction before a second action follows.

That second action is frequently social engineering. In many real campaigns, the inbox flood is followed by a caller or chat contact claiming to be IT or security and urging immediate action. The timing is a clue: the bombardment creates urgency and lowers user skepticism, making the follow-on lure more believable than it would be on its own. Email Bombing and Help Desk Impersonation over Teams Guide explains the pattern in more depth.

What Else to Look For Beyond the Mail Flood

Volume alone is not enough to diagnose the campaign. A stronger indicator is a cluster of symptoms: users reporting missed mail, unexpected subscription confirmations, and sudden pressure from someone asking them to approve access, reset credentials, or install remote support. That combination suggests the attacker is moving from inbox disruption to impersonation or account takeover rather than simply causing annoyance.

Another useful signal is whether the flood is paired with messages that look like routine service traffic but arrive in an unusual burst. A campaign is more convincing when the messages are diverse, coming from many legitimate sites and domains, because that makes it harder for users and filters to separate harmless mail from the attacker’s follow-up lure. If the event is tied to a specific user, mailbox, or department, the response should focus on that target’s exposure and the surrounding access paths.

Callback Phishing (TOAD) Guide is useful because email bombing is often the setup step for a callback or help desk scam, not the final objective. That same pattern is reflected in Storm-1811 Threat Actor Profile Guide, which shows how the flood, impersonation and remote access lure fit together.

One more thing practitioners should watch is whether the volume spike coincides with abnormal user reports about inbox rules, forwarding, login prompts or account recovery messages. Those are not required for an email bombing campaign, but when they appear alongside the flood they raise the likelihood that the event is part of a broader identity abuse attempt rather than a standalone nuisance.

How to Distinguish a Bombing Campaign from Ordinary Spam Noise

The practical distinction is context. Ordinary spam is usually broad, steady and low urgency. Email bombing is abrupt, concentrated and operationally disruptive. It creates a visible change in mail behaviour, often affects a specific user or small set of users, and is frequently followed by a human interaction that tries to exploit confusion.

Security teams should also distinguish between a mailbox being overloaded and a mailbox being abused. If the user can still access mail normally, but the inbox is flooded with false subscriptions or junk, the campaign may be limited to nuisance and distraction. If the user also reports suspicious requests, unexpected verification prompts, or loss of visibility into real business messages, the incident has likely crossed into active social engineering territory.

Black Basta Threat Actor Profile and External Collaboration and Federation Abuse Guide are relevant here because they show why email flooding is often paired with chat-based impersonation and why teams should treat the combination as a single campaign, not two unrelated annoyances.

Risk and Threat Considerations

Email bombing is risky because it can hide the real target event behind noise, delay reporting, and create the urgency needed for a convincing help desk impersonation. The main threat is not the volume itself, but the way the volume suppresses normal user judgment and makes a follow-up lure more credible.

Failure mechanism: The attacker overwhelms the mailbox first, then exploits the confusion to push the victim toward a malicious callback, remote support session, credential reset, or similar action that feels time-sensitive.

Impact: Organisations can lose message visibility, miss legitimate business mail, and hand an attacker a better chance of gaining access through social engineering or remote access abuse.

Practitioner Guidance

What to prioritise: Confirm whether the spike is isolated or whether multiple users are being hit at once, then check whether any user has also received a follow-up call, chat message, or urgent support request. That pairing is the clearest sign that the campaign has moved beyond nuisance.

What to verify: Validate whether the flooded mail came from many independent senders rather than one source, and whether the affected user has missed legitimate internal or customer messages. If the mailbox is now functionally unusable, treat it as an incident with possible social engineering follow-through, not as a simple spam problem.

Practitioner takeaway: The decisive signal is not just inbox volume, it is volume plus a credible human lure, because that combination usually means the attacker is trying to turn distraction into access.

Related resources from NHI Mgmt Group

• What are the signs that a phishing or spear phishing campaign is designed to evade traditional email controls?
• What are the signs that a phishing campaign is using PhaaS infrastructure instead of a simple spoofed email?
• What are the signs that a loader campaign is evolving to bypass modern email defenses?
• What are the signs that a business email is part of a targeted phishing campaign?