The case for pre-emptive defence
Vessel Impersonation Report
Red Sky Alliance, perform weekly queries of backend databases, identifying all new data containing Motor Vessel (MV) and Motor Tanker (MT) in the subject line of malicious emails. Email subject line Motor Vessel (MV) or Motor Tanker (MT) keyword usage is a common lure to entice users in the maritime industry to open emails containing malicious attachments.
With our cyber security partner we are providing a weekly list of Motor Vessels where it is observed that the vessel is being impersonated, with associated malicious emails.
The identified emails attempted to deliver malware or phishing links to compromise the vessels and/or parent companies. Users should be aware of the subject lines used and the email addresses that are attempting to deliver the messages.
In the above collection, we see malicious actors attempting to use vessel names to try to spoof companies in the maritime supply chain. This week we observed a wide variety of maritime-related subject lines. Some of the new vessel names used this week include “MV Sider Capri” and “MV Premier” among others. “Maersk Kleven” was used again this week. It is still unclear as to why this specific vessel is being leveraged in so many subject lines. The owners of the vessel appear to work closely with leading maritime financing banks and export credit agencies. Often targets like this are leveraged to attack others which they may provide services to, or other associated companies in the supply chain.
Analysts observed two similar subject lines “M/V ASPL TBN / PDA ENQUIRY” and “M/V ASPL TBN / PDA INQUIRY” being used in two malicious emails this week. The sender email was the same for both emails, but the targeted email addresses were unique. The difference in the word “inquiry” indicates that the attacker was likely targeting Canadian or American targets with the “inquiry” subject line and targeting victims in the United Kingdom with the “enquiry” subject line.
The above email messages were sent from, ““PLATIN SHIPPING TRADING CO. / ISTANBUL” <f7235a61f@3ae52877e0.net>.” Although an alias obscures the sending domain, the sending email is likely impersonating platinship[.]net which is the domain for Platin Shipping & Trading Co. LTD in Turkey.
The message body is redacted in both emails, so no additional context is provided. However, the malicious attachments for both emails are the same. The first is a “DOCX.doc” Word document and the second is “Q88.xlsm” Excel spreadsheet with macros enabled. Both documents contain Exploit:O97M/CVE-2017-8570.JB!MTB malware. When executed, the malware infects the victim device and deletes copies of itself to make analysis more difficult. Intelligence gathered from previous Red Sky Alliance reporting indicates these victims have been targeted in the past with trojan downloader malware.
Analysts observed another malicious email which appears to impersonate Systems Controls Instrumentations, Inc. (SCII). The malicious email subject line used is “Quote # 5780 -LCL-AS/PO/- PR#61007114.” SCII is a specialized trading company located in the Philippines with over $2.2mil in “total turnover” in 2018.
The sending email “pcpd@scii.com.ph” appears to be a valid email domain used by the company. Also, the person associated with the sending email “Jenny Enerio” appears to be the In-House Sales Coordinator for SCII. Although this specific user does not show up in Red Sky Alliance collections, there are other employees at the company with credentials listed in our Breach Data collections.
The signature in the email confirms the sender is impersonating Jenny Enerio, the In-House Sales Coordinator for the company. The message body consists of an RFQ and asks for a re-sale price and lead-time for a list of attached items. The fact that the message has no greeting makes it generic enough to send to multiple targets.
The recipient in the email is “info@camillebauer.com” which is listed publicly on a website for the Controller Area Network in Automation (CiA) group which is an international users and manufacturers group. The group works to enhance and develop the CAN protocol and “promote the image of the CAN technology.” The group appears to have headquarters in Nuremberg, Germany. Camille Bauer Metrawatt AG (which owns the target domain) appears to be a member of this group. The company provides system solutions for energy generation, distribution, and consumption. These types of companies are often targeted for profit and trade secrets.
When the victim opens the attached spreadsheet named “RFQ_34234651.xlsx”, they are actually activating Exploit:O97M/CVE-2017-0199!MTB malware. This malware is one of the most common exploits seen in malicious emails. It exploits a memory corruption vulnerability in Microsoft Office products. This allows attackers to extract sensitive and private information from the victim’s device. If successful, an attacker could cause this malware to spread to other user accounts that would likely have better access to sensitive/private information. For example, users who are part of the info@camillebauer.com email group may end up downloading the malware which would result in the attacker’s access to the network.
These analysis results illustrate how a recipient could be fooled into opening an infected email. Doing so could cause the recipient to become an infected member of the maritime supply chain and thus possibly infect victim vessels, port facilities and/or shore companies in the marine, agricultural, and other industries with additional malware.
Fraudulent emails designed to make recipients hand over sensitive information, extort money or trigger malware installation on shore-based or vessel IT networks remains one of the biggest day-to-day cyber threats facing the maritime industry. These threats often carry a financial liability to one or all those involved in the maritime transportation supply chain. Preventative cyber protection offers a strong first-line defense by preventing deceptive messages from ever reaching staff inboxes, but malicious hackers are developing new techniques to evade current detection daily. Using preemptive information from Red Sky Alliance-RedXray diagnostic tool, our Vessel Impersonation reports, and Maritime Blacklists offer a proactive solution to stopping cyber-attacks. Recent studies suggest cyber-criminals are researching their targets and tailoring emails for staff in specific roles. Another tactic is to spoof emails from the chief executive or other high-ranking maritime contemporaries in the hope staff lower down the supply chain will drop their awareness and follow the spoofed email obediently. Analysts across the industry are beginning to see maritime-specific examples of these attacks.
Pre-empt, don’t just defend
Preventative cyber protection offers a strong first-line defense by preventing deceptive messages from ever reaching staff inboxes, but malicious hackers are developing new techniques to evade current detection daily. Using preemptive information from Red Sky Alliance RedXray diagnostic tool, our Vessel Impersonation reports and Maritime Blacklists offer a proactive solution to stopping cyber-attacks. Recent studies suggest cyber-criminals are researching their targets and tailoring emails for staff in specific roles. Another tactic is to spoof emails from the chief executive or other high-ranking maritime contemporaries in the hope staff lower down the supply chain will drop their awareness and follow the spoofed email obediently. Analysts across the industry are beginning to see maritime-specific examples of these attacks.
Weekly Maritime Watchlist
The more convincing an email appears, the greater the chance employees will fall for a scam. To address this residual risk, software-based protection should be treated as one constituent of a wider strategy that also encompasses the human-element as well as organizational workflows and procedures.
It is imperative to:
- Train all levels of the marine supply chain to realize they are under constant cyber-attack.
- Stress maintaining constant attention to real-world cyber consequences of careless cyber practices or general inattentiveness.
- Provide practical guidance on how to look for a potential phishing attempt.
- Use direct communication to verify emails and supply chain email communication.
- Use Red Sky Alliance RedXray proactive support, our Vessel impersonation information and use the Maritime Black Lists to proactively block cyber attacks from identified malicious actors.
Source: Dryad Global
