Builder of cool forts | vCISO | Trusted cybersecurity advisor | Serving the cybersecurity community
I've had a few clients mention the same weird email attack pattern, bounced messages that were never sent by the user. Turns out there's this ever so helpful Exchange behavior where spoofed emails from the attacker impersonating your domain get bounced back to real users - with the original attachments intact. Since these bounces come from the organization's own Exchange server, they often slip right through security controls. It looks like becoming a growing issue and security teams are definitely starting to notice an uptick in this attack pattern. The technical details are pretty straightforward: attackers spoof your domain, send malicious emails to internal users, delivery fails, and Exchange helpfully bounces everything back to your users. The attachments come along for the ride, and your security stack treats it as internal mail. Here's what's been working for the teams I've talked to: 1. Exchange admins can disable attachments in bounce messages entirely (PowerShell is your friend here). On-prem environments have more flexibility than Exchange Online. 2. Most email security vendors have bounce verification features - worth checking if yours is enabled. Some call it "bounce address tag validation" or similar. 3. Transport rules targeting bounce message patterns with attachments can catch a lot of these. Look for "undelivered mail returned" or "mail delivery failed" subjects. Nothing revolutionary, but sometimes the simple attacks are the ones that get through. Has anyone else been seeing more of these lately? Would love to hear what's working in your environments. #cybersecurity #exchange #emailsecurity