Home Digitalisation Maritime Cyber Security & Threats Aug 2020 Week Four

Maritime Cyber Security & Threats Aug 2020 Week Four

“Fraudulent emails designed to make recipients hand over sensitive information, extort money or trigger malware installation on shore-based or vessel IT networks remains one of the biggest day-to-day cyber threats facing the maritime industry.”

Dryad Global’s cyber security partners, Red Sky Alliance, perform weekly queries of  backend databases, identifying all new data containing Motor Vessel (MV) and Motor Tanker (MT) in the subject line of malicious emails.  Email subject line Motor Vessel (MV) or Motor Tanker (MT) keyword usage is a common lure to entice users in the maritime industry to open emails containing malicious attachments.

With our cyber security partner we are providing a weekly list of Motor Vessels where it is observed that the vessel is being impersonated, with associated malicious emails.

The identified emails attempted to deliver malware or phishing links to compromise the vessels and/or parent companies.  Users should be aware of the subject lines used and the email addresses that are attempting to deliver the messages.

Malicious Email collectino 22 Aug-29 Aug 2020

 First Seen Subject Line Used Malware Detections Sending Email Targets
Aug 22, 2020 MV FIRSTEC – PORT CALL FOR BUNKERING AT ZHOUSHAN ANCHORAGE Trojan:MSIL/AgentTesla.YP!MTB Yidance Singapore – Operation Team <[email protected]> yidance.sg
Aug 22, 2020 RE: JEBEL ALI LCL SHIPMENT TrojanDownloader:O97M/Emotet!rfn “megha.borade” <[email protected]> 2010546c.biz
Aug 22, 2020 Re: [SPAM] RE: 38363 ==== RE: JEBEL ALI LCL SHIPMENT TrojanDownloader:O97M/Emotet!rfn Naved Ahmad <[email protected]> 2010546c.biz
Aug 22, 202029 RE: Sea Shipment from Viraj..to Alpinex..// Nhava Sheva India to Poland..// Booking Import N. P379702020 S/ VIRAJ SYNTEX (P) LT  

 

VBA/Agent.GC!tr.dldr

“MAHALAXMI BL” <[email protected]> 2010546c.biz
Aug 22, 2020 Fwd:RE: LCL SHIPMENT HAMBURG BL DRAFT VBA/Agent.GC!tr.dldr Megha Borade <[email protected]> 2010546c.biz
Aug 22, 2020 RE: JEBEL ALI LCL SHIPMENT VBA/Agent.GC!tr.dldr “Megha Borade” <[email protected]> 2010546c.biz
Aug 24, 2020 Norstar Baltic // 10,000mt Benzene // PDA Request Trojan:Win32/Woreflint.A!cl Operation dept. <[email protected]> hansol.com
Aug 24, 2020 pda request | port info Trojan:Script/Wacatac.C!ml “Afzal Dawood Exports”<[email protected]> fishandbait.com
Aug 25, 2020 LCL sea freight from Croxley – Southern Lily V396 – ETA Apia 14/01/17 – 12 pallets VBA/Agent.K!tr.dldr “Triss-Ann Pomare” <[email protected]> bb92.ws
Aug 25, 2020 VESSEL LIST 24-08-2020 TrojanDownloader:O97M/Powdow.PBL!MTB [email protected] ntslog.com
Aug 25, 2020 RE: Emu Debit Note – 884 // 354411 // Dammam Sea Port//(1×40\’HC+) VBA/Agent.GC!tr.dldr “Geeta Pujari” <[email protected]> 2010546c.biz
Aug 25, 2020 Re: Sea Freight for Zabou orders VBA/Agent.GC!tr.dldr “Mohammed Patel” <[email protected]> 2028c41d.uk
Aug 25, 2020 RE: 38363 ==== RE: JEBEL ALI LCL SHIPMENT VBA/Agent.GC!tr.dldr “Megha Borade” <[email protected]> 2010546c.biz
Aug 25, 2020 Re: Freight / Savannah VBA/Agent.GC!tr.dldr “FUMATEX,INC” <[email protected]> 8882cf4e69.com
Aug 25, 2020 RE: CHECKLISTS // Lesotho / BY SEA // NOMINATION / UNICURE /INV. U1/242/20-21 VBA/Agent.GC!tr.dldr “Vinod Patidar” <[email protected]> 2010546c.biz
Aug 25, 2020 RE: RE: Freight quote for Daco VBA/Agent.GC!tr.dldr “Erin Ortolano” <[email protected]> 753f0cc723d.com
Aug 25, 2020 RE: JEBEL ALI LCL SHIPMENT HEUR:Trojan.MSOffice.SAgent.gen “Megha Borade” <[email protected]> 2010546c.biz
Aug 25, 2020 RE: JEBEL ALI LCL SHIPMENT VBA/Agent.GC!tr.dldr [email protected]” <[email protected]> 2010546c.biz
Aug 25, 2020 R: Re: Overweight container HEUR:Trojan.MSOffice.SAgent.gen “Aamir Khan” <[email protected]> 8882cf4e69.com
Aug 27, 2020 M.V. MURPHYLEE CTM REQUEST ETA 06th SEPT. 2020 Fareit-FYV!B878C3A2D2AC [email protected]” <[email protected]> Targets Not Disclosed
Aug 27, 2020 RFQ for Offshore Drilling Equipment\’s,Refineries & petrochemical plants,AHU,FCU, Pipe, Valve, Pump, Fittings and Heat Recovery Unit Trojan:Win32/Woreflint.A!cl Senders Not Disclosed Targets Not Disclosed
Aug 27, 2020 RE: 6630 ==== RE: [SPAM]- RE: A.J.IMPORT & EXPORTS VANCOUVER LCL TrojanDownloader:O97M/Emotet!rfn “MAHALAXMI BL” <[email protected]> 2010546c.biz
Aug 27, 2020 RE: 37674……………………RE: TORONTO LCL SHIPMENT Trojan-Downloader.VBA.Emotet “Satish Verkia” <[email protected]> 2010546c.biz
Aug 27, 2020 Re: Hakata Queen- / ALTAMIRA / LOI FOR DISCHARGE CARGO Trojan-Downloader.VBA.Emotet “HAKATA QUEEN” <[email protected]> 29ec7f830831.mx
Aug 28, 2020 RE: FW: WKW Ref:530/19/36696/C: TOMO REF : 067/19/INS/W- Permintaan survey kerusakan pulp ex Bg Marcopolo 212 ex MV Glory Forwarder Trojan-Downloader.VBA.Emotet “Sumardi” <[email protected]> b4bd8b7c1f5a.com
Aug 28, 2020 Re: Request Survey Off Hire – LCT Victoria Jaya, Ciwandan Port Trojan-Downloader.VBA.Emotet “Daniel Onggang Siregar” <[email protected]> b4bd8b7c1f5a.com
Aug 28, 2020 Re: RE: LAB SURVEYOR Merak & Surabaya Vessel MT. TIGER SPRING VBA/Agent.DDV!tr.dldr [email protected]” <[email protected]> b4bd8b7c1f5a.com
Aug 28, 2020 Re: Re: Cargo supervisor/surveyor di SPOB Lucinda Trojan-Downloader.VBA.Emotet “Aad .” <[email protected]> b4bd8b7c1f5a.com
Aug 28, 2020 RE: RFQ No.19/2017-18 for Sea freight for Haz Consignment on EXW VBA/Agent.DDV!tr.dldr “Daksha Shinde” <[email protected]> 2010546c.biz
Aug 28, 2020 RE: 38363 ==== RE: JEBEL ALI LCL SHIPMENT TrojanDownloader:O97M/Emotet!rfn “KIRAN Live” <[email protected]> 2010546c.biz
Aug 28, 2020 RFQ for Offshore Drilling Equipment\’s,Refineries & petrochemical\r\n plants,AHU,FCU, Pipe, Valve, Pump, Fittings and Heat Recovery Unit Trojan:MSIL/AgentTesla.YP!MTB “Muhannad Attalla” <[email protected]> ana-iq.com
Aug 28, 2020 Fwd: Planing Vessel & local Batam Maret 2020 VBA/Agent.DDV!tr.dldr [email protected]” <[email protected]> 726bfbd.com
Aug 29, 2020 RE: Request flight booking for MV. SEA FUTURE off signers at INCHEON, KOREA TrojanDownloader:O97M/Emotet.PEC!MTB “Ms. San San” <[email protected]> withuskor.com
Aug 29, 2020 Mix container 2 purchase orders Exploit.RTF-ObfsStrm.Gen [email protected] argomarine.co.kr

I


Top 5 Malicious Senders

Sender Malware Sent
[email protected] TrojanDownloader:O97M/Emotet.PEC!MTB
[email protected] HEUR:Trojan.MSOffice.SAgent.gen
[email protected] HTML/Agent.6B99!tr
[email protected] Trojan:MSIL/AgentTesla.YP!MTB
[email protected] VBA/Agent.DDV!tr.dldr

 


In the above collection, we see malicious actors attempting to use vessel names to try to spoof companies in the maritime supply chain. This week we observed a wide variety of maritime-related subject lines. Some of the new vessel names used this week include “MT Tiger Spring” and the “MV Glory Forwarder” among others. Analysts continue to see multiple malicious emails from different senders using “JEBEL ALI LCL SHIPMENT” as part of the subject line. It is still unclear why this specific port is being leveraged in malicious email subject lines, but the specific use of “LCL” (Less than a Container Load) is appearing more often in malicious email subject lines.

Analysts observed the malicious subject line “Mix container 2 purchase orders” being used this week. This email appears to be a purchase order coming from a German food company to a Korean marine company. Emails coming from foreign countries can prevent a targeted victim from becoming immediately suspicious when there is incorrect spelling and/or grammar in the malicious email.

The malicious email appears to be sent from “kelly.mfc.china[at]mikado-foods[.]de” which does not appear anywhere publicly in open source data. However, Mikado Foods has “bonnie.mfc.china[at]mikado-foods[.]de” listed as a contact for Mikado Foods China Co., Ltd. The malicious sender appears to have sent malicious emails in July 2019 as well. At that time, attackers were targeting a Belarusian Bank BelVEB OJSC. The sender does not have any name listed in the email signature, only contact details.

Notably, the email greets the specific target by their name which makes it more likely that this is a spearphishing attack. In the email message, the attacker tells the target to find 2 attached purchase orders, but there is only one attachment. The email also instructs the target to “please load (the first purchase order) and then (the second purchase order).” Often malware works in stages, so it is possible the attackers are attempting to get the target to activate the malware in a certain order.

The targeted email address does not appear publicly in open source. The targeted domain is used by Argo Marine Total, which is a maritime inspections and logistics company out of Korea. It also does not clearly indicate which department/division the email would be sent to. It is common for these types of malicious “purchase orders” to target the billing/accounting department to steal sensitive data or commit other cyber-attacks against the company.

If the target were to open the document titled, “M I K A D O® foods.doc,” they would activate HEUR:Exploit.MSOffice.Generic malware on their machine which in this case exploits CVE-2017-11882. This is one of the most common observed exploits leveraged by attackers. The malware can surreptitiously receive commands from a command and control server run by attackers. Using this access, attackers can exfiltrate sensitive company information including passwords, and financial data.

Analysts observed another malicious email subject line being used “RE: Request flight booking for MV. SEA FUTURE off signers at INCHEON, KOREA.” This email is disguised as a “flight booking” request for the MV Sea Future off signers. This is likely a reference to travel arrangements for crew changes. Due to CoViD-19, this type of request would not be completely uncommon. This vessel is currently in the East China Sea.

The email is being sent from “Ms. San San” at accounts2[at]princehr[.]com. Prince HR Services is a staffing service based in Delhi, India. The sending email does not appear in the Red Sky Alliance breach data, so it is more likely that this user is being spoofed. The email seems relatively professional and addresses “Ms. So Mi” which indicates this is a targeted attack as opposed to a spam campaign template which typically addresses “Dear Sirs/Ma’am.” Because of COVID-19, international crew changes has been a contentious issue and is a very good lure.

The referenced document is titled “661081608860286.doc.” When opened, the file activates TrojanDownloader:O97M/Emotet!rfn which installs the infamous Emotet malware. Red Sky Alliance continues to observe an increase in Emotet activity since July. First identified in 2014, this malware can steal sensitive banking, financial, and user information including passwords. As with many of the Emotet samples observed, the malware deletes the original Word document to make detections more difficult.

The target email is “crew[at]withuskor[.]com”, yet is specifically addressed to “Ms. So Mi.” Analysts were unable to find this particular employee listed anywhere in open source. Often attackers will target users with elevated privileges, but in the case of Emotet malware, the attackers are often looking for employees with access to financial data in order to steal the data and turn a profit.

These analysis results illustrate how a recipient could be fooled into opening an infected email.   Doing so could cause the recipient to become an infected member of the maritime supply chain and thus possibly infect victim vessels, port facilities and/or shore companies in the marine, agricultural, and other industries with additional malware.

Fraudulent emails designed to make recipients hand over sensitive information, extort money or trigger malware installation on shore-based or vessel IT networks remains one of the biggest day-to-day cyber threats facing the maritime industry.  These threats often carry a financial liability to one or all those involved in the maritime transportation supply chain.   Preventative cyber protection offers a strong first-line defence by preventing deceptive messages from ever reaching staff inboxes, but malicious hackers are developing new techniques to evade current detection daily.  Using pre-emptive information from Red Sky Alliance-RedXray diagnostic tool, our Vessel Impersonation reports, and Maritime Blacklists offer a proactive solution to stopping cyber-attacks.    Recent studies suggest cyber-criminals are researching their targets and tailoring emails for staff in specific roles.  Another tactic is to spoof emails from the chief executive or other high-ranking maritime contemporaries in the hope staff lower down the supply chain will drop their awareness and follow the spoofed email obediently.  Analysts across the industry are beginning to see maritime-specific examples of these attacks.

Pre-empt, don’t just defend

Preventative cyber protection offers a strong first-line defense by preventing deceptive messages from ever reaching staff inboxes, but malicious hackers are developing new techniques to evade current detection daily. Using preemptive information from Red Sky Alliance RedXray diagnostic tool, our Vessel Impersonation reports and Maritime Blacklists offer a proactive solution to stopping cyber-attacks. Recent studies suggest cyber-criminals are researching their targets and tailoring emails for staff in specific roles. Another tactic is to spoof emails from the chief executive or other high-ranking maritime contemporaries in the hope staff lower down the supply chain will drop their awareness and follow the spoofed email obediently. Analysts across the industry are beginning to see maritime-specific examples of these attacks.

Source: Dryad Global