Vessel Impersonation Report

Dryad Global’s cyber security partners, Red Sky Alliance, perform weekly queries of  backend databases, identifying all new data containing Motor Vessel (MV) and Motor Tanker (MT) in the subject line of malicious emails.  Email subject line Motor Vessel (MV) or Motor Tanker (MT) keyword usage is a common lure to entice users in the maritime industry to open emails containing malicious attachments.

With our cyber security partner we are providing a weekly list of Motor Vessels where it is observed that the vessel is being impersonated, with associated malicious emails.

The identified emails attempted to deliver malware or phishing links to compromise the vessels and/or parent companies.  Users should be aware of the subject lines used and the email addresses that are attempting to deliver the messages.

his week Red Sky Alliance observed vessel impersonation traffic attempting to deliver the Trojan:Win32/Sonbokli.A!cl malware.

In the above collection for MT MAERSK TORSHAVN we see a malicious actor using the vessel name to try and spoof companies in the maritime supply chain.

MT MAERSK TORSHAVN is a Generic Tanker Vessel under the Singapore flag. Analysis reveals that a malicious email was sent to an unreported target domain. The message contains the subject line “MT MAERSK TORSHAVN // ONLINE PORT CLEARANCE CERTIFICATE” and an attachment identified by Microsoft as the Trojan:Win32/Sonbokli.A!cl malware[1].

An unsuspecting employee receiving this email would see nothing out of the ordinary in the Subject Line, which may cause them to open the email. The body of the email prompts the recipient to open the attachment named “PORT_CLEARANCE_CERTIFICATE_MT_MAERSK.xlsx” which would trigger malware delivery. Opening any infected email, could cause a recipient to become an infected member of the maritime supply chain and thus possibly infect victim vessels, port facilities, shore companies, and/or other organizations in the maritime supply chain with additional malware.

In the contents of the email using the subject line “MT MAERSK TORSHAVN // ONLINE PORT CLEARANCE CERTIFICATE” we see the author enticing the recipient to open an attachment. The attachment attempts to impersonate a legitimate, Port Clearance Certificate (PCC) form which is required by the Singapore Maritime and Port Authority for vessels departing Singapore[2]. However, doing so could trigger the attached malware to be installed. Knowledge and impersonation of specific port procedures for the flagged vessel’s country of origin adds to the message’s credibility.

[1]https://www.virustotal.com/en-gb/file/3639e2df9325299fbf2f3396736aeeb3fa76c4074d357297772d5d82d515ea5b/analysis/

[2] https://www.mpa.gov.sg/web/portal/home/port-of-singapore/circulars-and-notices/port-marine-circulars/detail/pc03-32

Dryad Assessment

Fraudulent emails designed to make recipients hand over sensitive information, extort money or trigger malware installation on shore-based or vessel IT networks remains one of the biggest day-to-day cyber threats facing the maritime industry. These threats often carry a financial liability to one or all those involved in the maritime transportation supply chain.

Pre-empt, don’t just defend

Preventative cyber protection offers a strong first-line defense by preventing deceptive messages from ever reaching staff inboxes, but malicious hackers are developing new techniques to evade current detection daily. Using preemptive information from Red Sky Alliance RedXray diagnostic tool, our Vessel Impersonation reports and Maritime Blacklists offer a proactive solution to stopping cyber-attacks. Recent studies suggest cyber-criminals are researching their targets and tailoring emails for staff in specific roles. Another tactic is to spoof emails from the chief executive or other high-ranking maritime contemporaries in the hope staff lower down the supply chain will drop their awareness and follow the spoofed email obediently. Analysts across the industry are beginning to see maritime-specific examples of these attacks.

The more convincing an email appears, the greater the chance employees will fall for a scam.  To address this residual risk, software-based protection should be treated as one constituent of a wider strategy that also encompasses the human-element as well as organizational workflows and procedures.