I HATE SCUMBAG HACKERS!!!!! ESPECIALLY THE PIECE OF SHIT RUSSIANS!!!!!!!!!!!!!!!
My institution was attacked a year or two ago by bitmining scum in Russia relaying through France, and today I was friggin subscription bombed by mostly Russian sites!
I verified no weird financial activity on my accounts, and reset passwords on all accounts. I am confident things are ok, but it was still a crappy way to spend several hours. At least I'm off the next 3 days, so I can clean out my mailbox regularly. I HATE HACKERS!!!!!!!!!!!!!
I saw an article today that seems to indicate it's not just me. A lot of Google mail users are getting hit right now. Seems like a Russian hacker group might have gotten hold of email lists and is running them through a bot that is circumventing Google's firewall/spam protection.
Subscription bombing can be part of a coordinated phishing campaign. The first thing is to gather credentials, and identifying information of as many random people as you can. Then you run people's information through your bots, which start signing users up for any, and every web site resource it can find.
On our end it looks like our mailbox is suddenly flooded with emails welcoming us to random forums, or as a client to random etailers, etc. However, hidden in those subscriptions could be legitimate contacts from business sites (credit providers, loan handlers, etc.) where either someone is trying to steal your identity, or (much worse) they have actually found the way to get a password reset sent to them, and they proceed to steal from your accounts that are accessible online. It can be straight money taken from a bank account, or fraudulent charges, or things like expensive cell phones sent to completely different countries than where you live.
Bottom line is that by flooding your mailbox with subscriptions to random crap, the attacker hopes to hide that one breach that actually gets them into your accounts. So the right response if you get submission bombed, is to go look at all your online ecommerce and other financial accounts, make sure there is NO unauthorized activity. Just for good measure, I also recommend cycling your password on all your financial sites. Save that password list in some kind of safe format. There are highly secure flash cards you can buy, which self-delete if too many unauthorized attempts are made.
](./images/smilies/eusa_wall.gif "Brick wall"){kind=small}
