Dryad and cyber partners RedSkyAlliance continue to monitor the stark upward trend in attempted attacks within the maritime sector.
“Fraudulent emails designed to make recipients hand over sensitive information, extort money or trigger malware installation on shore-based or vessel IT networks remains one of the biggest day-to-day cyber threats facing the maritime industry.”
Dryad Global’s cyber security partners, Red Sky Alliance, perform weekly queries of backend databases, identifying all new data containing Motor Vessel (MV) and Motor Tanker (MT) in the subject line of malicious emails. Email subject line Motor Vessel (MV) or Motor Tanker (MT) keyword usage is a common lure to entice users in the maritime industry to open emails containing malicious attachments.
With our cyber security partner we are providing a weekly list of Motor Vessels where it is observed that the vessel is being impersonated, with associated malicious emails.
The identified emails attempted to deliver malware or phishing links to compromise the vessels and/or parent companies. Users should be aware of the subject lines used and the email addresses that are attempting to deliver the messages.
Malicious Email collection 14-17 Sep 2020
|First Seen||Subject Line Used||Malware Detections||Sending Email||Targets|
|Sep 14, 2020||Re: Bulk Cargo Shipment for saaten-union.de||HackTool:Win64/Mimikatz.A||“Chen Xin” <firstname.lastname@example.org>||saaten-union.de|
|Sep 14, 2020||Re: Re: Purchase Purse seiner. Tuna vessel||Trojan:Win32/Woreflint.A!cl||Lei Yang <email@example.com>||de8041c.com|
|Sep 14, 2020||Fwd:RV and Boat Storage Future Add-on||Trojan-Downloader.VBA.Emotet||“Charles Shajari” <firstname.lastname@example.org>||42f15e645c23f02ff1dad28eb.com|
|Sep 14, 2020||RE: Final Permit set – Boat Storage||Trojan-Downloader.VBA.Emotet||“charles shajari” <email@example.com>||42f15e645c23f02ff1dad28eb.com>|
|Sep 14, 2020||Fwd:Swain Boat House||TROJ_FRS.VSNW0EI20||“Brittney Phillips” <firstname.lastname@example.org>||27cde66c2a.com|
|Sep 15, 2020||MV GENCO STAR / ARRIVAL REPORT AT MIRI PORT||W97M/Downloader.dbv||“email@example.com” <firstname.lastname@example.org>||kwship.com|
|Sep 15, 2020||MOL HIROSHIMA – REMINDER Counter-measure for Soot damage to cargo vehicles in MAZDA stock yard-2||Trojan.W97M.POWLOAD.THIADBO||“FUKUSHIMA, Hajime” <email@example.com>||cidoship.com>|
|Sep 15, 2020||MV DIVINEGATE / Owners husbandry matter appointment – Yantai Port||Trojan:Win32/Wacatac.C!ml||“Nicholas Chin” <firstname.lastname@example.org>||epshipping.com.sg|
|Sep 15, 2020||MV. OCEAN LEADER – ARRIVL REPORT AT MIRI||TrojanDownloader:O97M/Emotet.PEE!MTB||“email@example.com” <firstname.lastname@example.org>||kwship.com|
|Sep 15, 2020||MV KMTC INCHEON – SBP for off Signer –||TrojanDownloader:O97M/Emotet.RKC!MTB||“KMTC INCHEON” <email@example.com>
“Lee Won-gun” <firstname.lastname@example.org>
|Targets Not Disclosed|
|Sep 15, 2020||Re: RE: MV KMTC TOKYO – 3/O’s BIO DATA & CRD FORM||TrojanDownloader:O97M/Emotet.RKC!MTB||“CrewYGN” <email@example.com>||withuskor.com|
|Sep 15, 2020||Re: [Operation] – GFO(V090) – Sailing Report at Kashima, Japan – 200316||TrojanDownloader:O97M/Emotet.CSK!MTB||“GFOREVER” <firstname.lastname@example.org>||skshipping.com|
|Sep 15, 2020||RE : RE : URGENT!!! 2 x 20ft – SHIPPING DOC BL,SI,INV#462345 // MAERSK KLEVEN V.949E // CLGQOE191781 //||Trojan-Downloader.MSWord.Agent.buh||“A.P. Moller – Maersk” <email@example.com>||Targets Not Disclosed|
|Sep 15, 2020||RE: CMA CGM CHRISTOPHE COLOMB – Bridge||Trojan-Downloader.VBA.Emotet||“CMA CGM CHRISTOPHE COLOMB – Bridge <firstname.lastname@example.org>” <email@example.com>||eae0ec1d660.com|
|Sep 16, 2020||MV TBN CALL AT DAFENG port / EPDA||Trojan:Win32/Agenttesla.TB!MTB||“OPS”<firstname.lastname@example.org>||royaleg.co.kr|
|Sep 16, 2020||Re: Re: MV DARYA KIRTHI/YANGZHONG -EPDA||Trojan:Win32/Agenttesla.TB!MTB||“email@example.com”<firstname.lastname@example.org>||cnshipping.com|
|Sep 17, 2020||PRE ARRIVAL FORMS FOR SUBJECT VESSEL||Trojan:Win32/Wacatac.D7email@example.com||pacificpatent.com|
|Sep 17, 2020||Re: [Operation] – GFO(V093) – Sailing report at Port Elizabeth, South Africa – 200805||TrojanDownloader:O97M/Emotet.CSK!MTB||“GFOREVER” <firstname.lastname@example.org>||skshipping.com|
|Sep 17, 2020||Various spare parts to M.V. Sunrise Ace through Norton Lilly Inter=||Trojan.W97M.EMOTET.TIOIBELH||“Donald Young” <email@example.com>||amosconnect.com>|
|Sep 17, 2020||One piece of coupling spare part to be delivered to M.V. Heroic Ac=||TrojanDownloader:O97M/Emotet.RKC!MTB||“Atlas Marine Services” <firstname.lastname@example.org>||amosconnect.com|
|Sep 17, 2020||[PR259 BIO-MEG] OIL AND MARINE / RFQ / Toyo Engineering &||Trojan:Win32/Woreflint.A!cl||nmw_ikram <email@example.com>||Targets Not Disclosed|
|Sep 17, 2020||Re: : PO 646900 – freight charge – New York Power||TrojanDownloader:O97M/Donoff!MSR||<firstname.lastname@example.org>||safeguard-technology.com|
|Sep 17, 2020||HAPAG ,MSC PAYMENT JOB NO:1419-1421-1422-1524-1525–1541||TrojanDownloader:O97M/Emotet.CSK!MTB||“Vinod Mudaliar” <email@example.com>||2010546c.biz|
|Sep 17, 2020||RE: [Operation] – GFO(V093) – Sailing report from Taixing, China – 200607||TrojanDownloader:O97M/Emotet.CSK!MTB||“GFOREVER” <firstname.lastname@example.org>||skshipping.com|
Top 5 Malicious Senders
|Mr. Astley Huang / MOLSHIP(S)<BR>r||Trojan.W97M.EMOTET.TIOIBELH|
|“A.P. Moller – Maersk” <email@example.com>||Exploit-GBW!3D4258FDCC47, W97M/Downloader.bjx|
In the above collection, we see malicious actors attempting to use vessel names to try to spoof companies in the maritime supply chain. This week we observed a wide variety of maritime-related subject lines. Some of the new vessel names used this week include “MV Divinegate” among others. Analysts observed bad actors leveraging “Maersk Kleven” in malicious email subject lines again this week. Actors have used this vessel name multiple times over the past year. Over the past year, this vessel has been observed in over a dozen malicious email subject lines. The sender continues to use the “’A.P. Moller – Maersk’ <noreply[at]Maersk[.]com>” email address in an attempt to trick the users into thinking they are receiving a legitimate email from the shipping company, Maersk.
Analysts observed the malicious subject line “RE: [Operation] – GFO(V093) – Sailing report from Taixing, China – 200607” being used this week. Notably, the phrase “Re: [Operation] – GFO(V093)” is contained in multiple malicious subject lines this week. This subject line mentions the Taixing Port in China, but the other subject lines reference ports in South Africa and Japan.
The email starts off with a generic “Good day” greeting. Typically, this would indicate that the attackers are using a generic spam template for use against multiple targets. However, in this case, there is a specific schedule laid out in the email indicating that this email is referencing a specific vessel/voyage. The message is signed by the “Master of M/V G. Forever Capt. Sin Jong Hwan.” This captain’s signature is listed in all three emails. This indicates that the captain is being impersonated to commit cyber-attacks and may potentially indicate that their account has been taken over by attackers to be used in cyber-attacks.
All these email look very similar and appear to use the voyage schedule as a lure to entice victims to open the malicious attached documents. Although the emails reference ports in different countries, the attachments are all titled with the following filenames written in Japanese:
• からの変更.doc (Changes from.doc)
• 変化-2020_09_16.doc (Change-2020_09_16.doc)
• に修_2020_09_15.doc (Osamu _2020_09_15.doc)
Although each email targets a separate employee at the company, all the emails target employees of SK Shipping, a major South Korean shipping company. The employees’ positions could not be identified using open source and the targeted email addresses do not appear anywhere on the company website.
The company is being targeted by Emotet malware (attached to all three malicious emails). This malware has evolved and become a significant threat to companies as it currently can steal sensitive information and leverage infected devices in attacks against other networks.
These analysis results illustrate how a recipient could be fooled into opening an infected email. Doing so could cause the recipient to become an infected member of the maritime supply chain and thus possibly infect victim vessels, port facilities and/or shore companies in the marine, agricultural, and other industries with additional malware.
Fraudulent emails designed to make recipients hand over sensitive information, extort money or trigger malware installation on shore-based or vessel IT networks remains one of the biggest day-to-day cyber threats facing the maritime industry. These threats often carry a financial liability to one or all those involved in the maritime transportation supply chain. Preventative cyber protection offers a strong first-line defence by preventing deceptive messages from ever reaching staff inboxes, but malicious hackers are developing new techniques to evade current detection daily. Using pre-emptive information from Red Sky Alliance-RedXray diagnostic tool, our Vessel Impersonation reports, and Maritime Blacklists offer a proactive solution to stopping cyber-attacks. Recent studies suggest cyber-criminals are researching their targets and tailoring emails for staff in specific roles. Another tactic is to spoof emails from the chief executive or other high-ranking maritime contemporaries in the hope staff lower down the supply chain will drop their awareness and follow the spoofed email obediently. Analysts across the industry are beginning to see maritime-specific examples of these attacks.
Pre-empt, don’t just defend
Preventative cyber protection offers a strong first-line defense by preventing deceptive messages from ever reaching staff inboxes, but malicious hackers are developing new techniques to evade current detection daily. Using preemptive information from Red Sky Alliance RedXray diagnostic tool, our Vessel Impersonation reports and Maritime Blacklists offer a proactive solution to stopping cyber-attacks. Recent studies suggest cyber-criminals are researching their targets and tailoring emails for staff in specific roles. Another tactic is to spoof emails from the chief executive or other high-ranking maritime contemporaries in the hope staff lower down the supply chain will drop their awareness and follow the spoofed email obediently. Analysts across the industry are beginning to see maritime-specific examples of these attacks.
The more convincing an email appears, the greater the chance employees will fall for a scam. To address this residual risk, software-based protection should be treated as one constituent of a wider strategy that also encompasses the human-element as well as organizational workflows and procedures.
It is imperative to:
- Train all levels of the marine supply chain to realize they are under constant cyber-attack.
- Stress maintaining constant attention to real-world cyber consequences of careless cyber practices or general inattentiveness.
- Provide practical guidance on how to look for a potential phishing attempt.
- Use direct communication to verify emails and supply chain email communication.
- Use Red Sky Alliance RedXray proactive support, our Vessel impersonation information and use the Maritime Black Lists to proactively block cyber attacks from identified malicious actors.