How Hackers Combine Email Bombing and Vishing to Launch Ransomware Attacks

Two of the most talked about new methods are email bombing and vishing. Let’s learn what they are and why they’re so dangerous.

What Is Email Bombing?

Email bombing is a type of attack in which the victim receives a large number of messages in a short period of time. The goal here is to overwhelm the recipient’s inbox and make it difficult for them to distinguish between legitimate messages and spam. This is often seen as online harassment or denial-of-service attacks, but cybercriminals are also using these techniques against organisations.

What is Vishing (Voice phishing)

Voice phishing is just what it sounds like. Instead of sending unsolicited emails to trick people into giving up sensitive information or otherwise manipulating them, criminals actually call you and impersonate a trusted entity, just like phishing emails. And like phishing emails, callers create a sense of urgency or fear in victims to pressure them into complying with their demands.

And, unlike phishing emails, voice calls seem more personal and trustworthy, which is why many of them are successful.

How Attackers Use Email Bombing as a Setup for Voice Phishing

Like many cybercriminals’ techniques, they’re using a combination of both because it works. And in this case, email bombing is a pretext for voice phishing. As I said, users will receive a lot of emails in a short period of time. Then they’ll receive some kind of unsolicited call from their IT support department, and they’re usually spoofing some ID.
 
Either the caller ID or the messaging ID, and… they just want to make it appear as if it’s coming from within the organization. And so when they call you, they offer help dealing with the sudden influx of messages. In this way, they create a problem in the first stage and then exploit that fear to offer a solution in the second stage.

Which groups have used this technique?

As of last month, at least 55 attacks had been attempted using these techniques, including one by the 3:00 AM ransomware group, which has been active since 2023. In this case, the attacker used a real telephone call rather than a Teams message or Teams call, spoofing the organization’s numbers.
 
During that attack, the internal IT department, using Quick Assist, deployed a virtual machine on the infected computer, which gave the attackers an initial foothold in the network but also significantly concealed it from endpoint security software.

While the ransomware attack was stopped, the attackers remained on the network or inside the network for nine days before attempting to actually launch the ransomware.
 
They eventually managed to steal some data from the targeted organization’s network. But what’s interesting about this attack is that the 3:00 AM ransomware group actually conducted reconnaissance on the organizations they were targeting. This included looking for employee email addresses and phone numbers for the organization’s internal IT departments before the attack began.
 
And so they used that information to carry out their attack. Thankfully, the impact of the attack was very limited. It only affected one unmanaged host, from which some remote attacks could be launched. They were attempting to launch remote ransomware attacks across the entire network. All other attacks, including inbound remote ransomware, were blocked by CryptoGuard.

What can organizations do to protect themselves from ransomware and other similar keyboard-targeted attacks in 2025?

First and foremost, we should try to prevent these attacks as much as possible.
 
When we think about these specific techniques, organizations will likely want to restrict certain external access features in Teams and possibly even use something like application control to prevent unwanted execution of remote access tools like Quick As Assist.

And since these techniques aren’t typically included in traditional anti-phishing training, organizations should raise awareness of these new techniques among their employees now.
 
We also strongly recommend that you use Microsoft Office 365 integration with your security tools so you can monitor potentially malicious inbound Teams or Outlook traffic. This telemetry can help you detect them early, which is really important.
 
If you want to stop ransomware attacks before they reach the final stages. And then, after an identification, organizations should have a specific and tested response plan that can quickly and comprehensively remediate some of these attacks.

So, in other words, you need to limit risk by preventing as much as possible. You’ll need to constantly monitor your surroundings for suspicious events. And finally, you’ll need to be prepared to react.

Here are key steps to mitigate risk:

• Train employees to recognize and report unusual email influxes or suspicious calls.
• Lock down communication tools like Microsoft Teams, disable or restrict external contact where not necessary.
• Keep systems updated to address vulnerabilities in software and remote access points.
• Use strong authentication (MFA) and implement tamper protection on endpoint agents.
• Limit remote access devices’ use permission lists, monitor sessions, and disable unused accounts.
• Implement email and voice security filters to detect anomalies.
• Have an incident response plan in place in case a credential compromise or ransomware is detected.