cyber.hendryadrian.com
Cyber Attack & Data Breach · darktrace.com

Email Bombing and Fake IT Calls Lead to Credential Theft and Network Reconnaissance

· Original article ↗

Summary

Darktrace reports that email bombing and fake Microsoft Teams calls led a customer employee to disclose credentials via Quick Assist. The attacker then performed network reconnaissance and attempted SMB/NTLM access; security teams intervened.

Key points

  • In February 2025, a user received more than 150 subscription and confirmation emails from 107 domains in under five minutes.
  • The emails bypassed a security email gateway; Darktrace detected the unusual volume and variety of messages.
  • The attacker followed the email flood with Microsoft Teams calls while impersonating the organization’s IT department.
  • The customer confirmed that the attacker targeted more than 10 additional internal users and persuaded one user to disclose credentials through Microsoft Quick Assist.
  • Darktrace’s investigation found LDAP reconnaissance, network scanning, and attempted SMB/NTLM connections to internal devices; the SMB/NTLM attempts failed.
  • Autonomous Response was configured to require human approval, so suspicious internal connections continued until the customer’s security team intervened.

Article Details

Victim Organization
Unknown
Victim Domain
Unknown
Incident Type
Email bombing followed by voice phishing and credential theft; subsequent network reconnaissance and attempted lateral movement were observed.
Disclosure Date
2025-04-10
Affected Records
Unknown
Affected Data Size
Unknown
Operational Impact
A user received over 150 emails from 107 unique domains in under five minutes. The attacker obtained the user's credentials, and the compromised device performed network reconnaissance and attempted internal SMB/NTLM connections, which failed. The customer confirmed that more than 10 additional internal users were targeted with email bombing and fake IT calls.
Ransom Or Extortion
None reported.
Claim Status
confirmed

Threat Actors

Black BastaNamed as a ransomware group observed using email bombing; not specifically attributed to the incident described.Storm-1811Identified by the source as another name for Black Basta; not specifically attributed to the incident described.

Vendors

DarktraceDarktrace detection of email bombing attackMailchimpAdditionally, many of the emails were sent using reputable marketing tools, such as Mailchimp’s Mandrill platform, which was used to send almost half of the observed emails, further adding to their legitimacy.Microsoftemail bombing, the malicious actor made multiple attempts to engage the recipient in a call using Microsoft Teams, while spoofing the organizations IT department in order to establish a sense of trust and urgency

Products

Cyber AI AnalystDarktrace’s Cyber AI Analyst was able to identify these activities and group them together into one incident, while also highlighting the most important stages of the attack.Darktrace / EMAILclassified as spam, due to the assumption that the recipient has subscribed to the service. Darktrace / EMAIL's behavioral analysis identified the mass of unusual, albeit not inherently malicious, emails thatDarktrace / NETWORKFigure 6: Device event log in Darktrace / NETWORK, showing the large volume of connections attempts over port 445.MandrillAdditionally, many of the emails were sent using reputable marketing tools, such as Mailchimp’s Mandrill platform, which was used to send almost half of the observed emails, further adding to their legitimacy.Microsoft Quick Assistmalicious actor successfully convinced the user to divulge their credentials with them using the Microsoft Quick Assist remote management tool. While such remote management tools are typically used for legitimateMicrosoft Teamsemail bombing, the malicious actor made multiple attempts to engage the recipient in a call using Microsoft Teams, while spoofing the organizations IT department in order to establish a sense of trust and urgency –

Related Articles