“Fraudulent emails designed to make recipients hand over sensitive information, extort money or trigger malware installation on shore-based or vessel IT networks remains one of the biggest day-to-day cyber threats facing the maritime industry.”
Dryad Global’s cyber security partners, Red Sky Alliance, perform weekly queries of backend databases, identifying all new data containing Motor Vessel (MV) and Motor Tanker (MT) in the subject line of malicious emails. Email subject line Motor Vessel (MV) or Motor Tanker (MT) keyword usage is a common lure to entice users in the maritime industry to open emails containing malicious attachments.
With our cyber security partner we are providing a weekly list of Motor Vessels where it is observed that the vessel is being impersonated, with associated malicious emails.
The identified emails attempted to deliver malware or phishing links to compromise the vessels and/or parent companies. Users should be aware of the subject lines used and the email addresses that are attempting to deliver the messages.
Malicious Email collectino 22 Aug-29 Aug 2020
| First Seen | Subject Line Used | Malware Detections | Sending Email | Targets |
| Aug 22, 2020 | MV FIRSTEC – PORT CALL FOR BUNKERING AT ZHOUSHAN ANCHORAGE | Trojan:MSIL/AgentTesla.YP!MTB | Yidance Singapore – Operation Team <fix1@yidance.sg> | yidance.sg |
| Aug 22, 2020 | RE: JEBEL ALI LCL SHIPMENT | TrojanDownloader:O97M/Emotet!rfn | “megha.borade” <965dbaa@26dd9f2.com> | 2010546c.biz |
| Aug 22, 2020 | Re: [SPAM] RE: 38363 ==== RE: JEBEL ALI LCL SHIPMENT | TrojanDownloader:O97M/Emotet!rfn | Naved Ahmad <3e722a825d56a@2dd400a53b39.com> | 2010546c.biz |
| Aug 22, 202029 | RE: Sea Shipment from Viraj..to Alpinex..// Nhava Sheva India to Poland..// Booking Import N. P379702020 S/ VIRAJ SYNTEX (P) LT |
VBA/Agent.GC!tr.dldr |
“MAHALAXMI BL” <a1b29@dc93e335d7395e99221a2be.tr> | 2010546c.biz |
| Aug 22, 2020 | Fwd:RE: LCL SHIPMENT HAMBURG BL DRAFT | VBA/Agent.GC!tr.dldr | Megha Borade <ad76@44eb3fa638a5.com> | 2010546c.biz |
| Aug 22, 2020 | RE: JEBEL ALI LCL SHIPMENT | VBA/Agent.GC!tr.dldr | “Megha Borade” <20c90ad@d9b7f1cb73.bw> | 2010546c.biz |
| Aug 24, 2020 | Norstar Baltic // 10,000mt Benzene // PDA Request | Trojan:Win32/Woreflint.A!cl | Operation dept. <sm.ops@dowausa.com> | hansol.com |
| Aug 24, 2020 | pda request | port info | Trojan:Script/Wacatac.C!ml | “Afzal Dawood Exports”<afzal.Exports@dawoodtex.com> | fishandbait.com |
| Aug 25, 2020 | LCL sea freight from Croxley – Southern Lily V396 – ETA Apia 14/01/17 – 12 pallets | VBA/Agent.K!tr.dldr | “Triss-Ann Pomare” <1140d@0463f12adb.vn> | bb92.ws |
| Aug 25, 2020 | VESSEL LIST 24-08-2020 | TrojanDownloader:O97M/Powdow.PBL!MTB | shaalanco@interlink.com.eg | ntslog.com |
| Aug 25, 2020 | RE: Emu Debit Note – 884 // 354411 // Dammam Sea Port//(1×40’HC+) | VBA/Agent.GC!tr.dldr | “Geeta Pujari” <498dd9d0@791a19d5d69f6b.vn> | 2010546c.biz |
| Aug 25, 2020 | Re: Sea Freight for Zabou orders | VBA/Agent.GC!tr.dldr | “Mohammed Patel” <caf9@bffcc0115bf57.za> | 2028c41d.uk |
| Aug 25, 2020 | RE: 38363 ==== RE: JEBEL ALI LCL SHIPMENT | VBA/Agent.GC!tr.dldr | “Megha Borade” <4acdf0f1f8b@c81.af> | 2010546c.biz |
| Aug 25, 2020 | Re: Freight / Savannah | VBA/Agent.GC!tr.dldr | “FUMATEX,INC” <263bc@d70612cc.com> | 8882cf4e69.com |
| Aug 25, 2020 | RE: CHECKLISTS // Lesotho / BY SEA // NOMINATION / UNICURE /INV. U1/242/20-21 | VBA/Agent.GC!tr.dldr | “Vinod Patidar” <aa4b6@12da95fa9a1f3a3.gt> | 2010546c.biz |
| Aug 25, 2020 | RE: RE: Freight quote for Daco | VBA/Agent.GC!tr.dldr | “Erin Ortolano” <21bf9510b3dfb7b@f7785.pl> | 753f0cc723d.com |
| Aug 25, 2020 | RE: JEBEL ALI LCL SHIPMENT | HEUR:Trojan.MSOffice.SAgent.gen | “Megha Borade” <608a105@380a499d9.com> | 2010546c.biz |
| Aug 25, 2020 | RE: JEBEL ALI LCL SHIPMENT | VBA/Agent.GC!tr.dldr | “Ibrahim@relianceuae.ae” <76a215e@b045717e.mx> | 2010546c.biz |
| Aug 25, 2020 | R: Re: Overweight container | HEUR:Trojan.MSOffice.SAgent.gen | “Aamir Khan” <957254c06ba7@283cb8ea271cc2.ar> | 8882cf4e69.com |
| Aug 27, 2020 | M.V. MURPHYLEE CTM REQUEST ETA 06th SEPT. 2020 | Fareit-FYV!B878C3A2D2AC | “pm@kcc.org.hk” <pm@kcc.org.hk> | Targets Not Disclosed |
| Aug 27, 2020 | RFQ for Offshore Drilling Equipment’s,Refineries & petrochemical plants,AHU,FCU, Pipe, Valve, Pump, Fittings and Heat Recovery Unit | Trojan:Win32/Woreflint.A!cl | Senders Not Disclosed | Targets Not Disclosed |
| Aug 27, 2020 | RE: 6630 ==== RE: [SPAM]- RE: A.J.IMPORT & EXPORTS VANCOUVER LCL | TrojanDownloader:O97M/Emotet!rfn | “MAHALAXMI BL” <515405dd1b68244@a37aae624.tr> | 2010546c.biz |
| Aug 27, 2020 | RE: 37674……………………RE: TORONTO LCL SHIPMENT | Trojan-Downloader.VBA.Emotet | “Satish Verkia” <86426b337@5afaa429.com> | 2010546c.biz |
| Aug 27, 2020 | Re: Hakata Queen- / ALTAMIRA / LOI FOR DISCHARGE CARGO | Trojan-Downloader.VBA.Emotet | “HAKATA QUEEN” <26674@a5e39b.com> | 29ec7f830831.mx |
| Aug 28, 2020 | RE: FW: WKW Ref:530/19/36696/C: TOMO REF : 067/19/INS/W- Permintaan survey kerusakan pulp ex Bg Marcopolo 212 ex MV Glory Forwarder | Trojan-Downloader.VBA.Emotet | “Sumardi” <abbec9b9d6f@39a9b313ab02c9595d0f.br> | b4bd8b7c1f5a.com |
| Aug 28, 2020 | Re: Request Survey Off Hire – LCT Victoria Jaya, Ciwandan Port | Trojan-Downloader.VBA.Emotet | “Daniel Onggang Siregar” <e010b3@e192e6d99fe557d6718.com> | b4bd8b7c1f5a.com |
| Aug 28, 2020 | Re: RE: LAB SURVEYOR Merak & Surabaya Vessel MT. TIGER SPRING | VBA/Agent.DDV!tr.dldr | “budi@tomosurveyor.com” <206c826040ede96a0@4e50c5d290d779dfcf2e.gh> | b4bd8b7c1f5a.com |
| Aug 28, 2020 | Re: Re: Cargo supervisor/surveyor di SPOB Lucinda | Trojan-Downloader.VBA.Emotet | “Aad .” <358bf@317dc2f001ed.br> | b4bd8b7c1f5a.com |
| Aug 28, 2020 | RE: RFQ No.19/2017-18 for Sea freight for Haz Consignment on EXW | VBA/Agent.DDV!tr.dldr | “Daksha Shinde” <d59b3112ff5b1d10@ed9080cb.eu> | 2010546c.biz |
| Aug 28, 2020 | RE: 38363 ==== RE: JEBEL ALI LCL SHIPMENT | TrojanDownloader:O97M/Emotet!rfn | “KIRAN Live” <cbb7b2fc2ef5bcaa@b09ef6a8348823.ao> | 2010546c.biz |
| Aug 28, 2020 | RFQ for Offshore Drilling Equipment’s,Refineries & petrochemicalrn plants,AHU,FCU, Pipe, Valve, Pump, Fittings and Heat Recovery Unit | Trojan:MSIL/AgentTesla.YP!MTB | “Muhannad Attalla” <mohannad@moiss.ae> | ana-iq.com |
| Aug 28, 2020 | Fwd: Planing Vessel & local Batam Maret 2020 | VBA/Agent.DDV!tr.dldr | “port.batam@cemindo.com” <7577e@9daf.vn> | 726bfbd.com |
| Aug 29, 2020 | RE: Request flight booking for MV. SEA FUTURE off signers at INCHEON, KOREA | TrojanDownloader:O97M/Emotet.PEC!MTB | “Ms. San San” <accounts2@princehr.com> | withuskor.com |
| Aug 29, 2020 | Mix container 2 purchase orders | Exploit.RTF-ObfsStrm.Gen | kelly.mfc.china@mikado-foods.de | argomarine.co.kr |
I
Top 5 Malicious Senders
| Sender | Malware Sent |
| accounts2@princehr.com | TrojanDownloader:O97M/Emotet.PEC!MTB |
| crew@withuskor.com | HEUR:Trojan.MSOffice.SAgent.gen |
| info@baltic-sea-forum.org | HTML/Agent.6B99!tr |
| h.lobian@ana-iq.com | Trojan:MSIL/AgentTesla.YP!MTB |
| katiegoldsbury@ravalliheadstart.org | VBA/Agent.DDV!tr.dldr |
In the above collection, we see malicious actors attempting to use vessel names to try to spoof companies in the maritime supply chain. This week we observed a wide variety of maritime-related subject lines. Some of the new vessel names used this week include “MT Tiger Spring” and the “MV Glory Forwarder” among others. Analysts continue to see multiple malicious emails from different senders using “JEBEL ALI LCL SHIPMENT” as part of the subject line. It is still unclear why this specific port is being leveraged in malicious email subject lines, but the specific use of “LCL” (Less than a Container Load) is appearing more often in malicious email subject lines.
Analysts observed the malicious subject line “Mix container 2 purchase orders” being used this week. This email appears to be a purchase order coming from a German food company to a Korean marine company. Emails coming from foreign countries can prevent a targeted victim from becoming immediately suspicious when there is incorrect spelling and/or grammar in the malicious email.
The malicious email appears to be sent from “kelly.mfc.china[at]mikado-foods[.]de” which does not appear anywhere publicly in open source data. However, Mikado Foods has “bonnie.mfc.china[at]mikado-foods[.]de” listed as a contact for Mikado Foods China Co., Ltd. The malicious sender appears to have sent malicious emails in July 2019 as well. At that time, attackers were targeting a Belarusian Bank BelVEB OJSC. The sender does not have any name listed in the email signature, only contact details.
Notably, the email greets the specific target by their name which makes it more likely that this is a spearphishing attack. In the email message, the attacker tells the target to find 2 attached purchase orders, but there is only one attachment. The email also instructs the target to “please load (the first purchase order) and then (the second purchase order).” Often malware works in stages, so it is possible the attackers are attempting to get the target to activate the malware in a certain order.
The targeted email address does not appear publicly in open source. The targeted domain is used by Argo Marine Total, which is a maritime inspections and logistics company out of Korea. It also does not clearly indicate which department/division the email would be sent to. It is common for these types of malicious “purchase orders” to target the billing/accounting department to steal sensitive data or commit other cyber-attacks against the company.
If the target were to open the document titled, “M I K A D O® foods.doc,” they would activate HEUR:Exploit.MSOffice.Generic malware on their machine which in this case exploits CVE-2017-11882. This is one of the most common observed exploits leveraged by attackers. The malware can surreptitiously receive commands from a command and control server run by attackers. Using this access, attackers can exfiltrate sensitive company information including passwords, and financial data.
Analysts observed another malicious email subject line being used “RE: Request flight booking for MV. SEA FUTURE off signers at INCHEON, KOREA.” This email is disguised as a “flight booking” request for the MV Sea Future off signers. This is likely a reference to travel arrangements for crew changes. Due to CoViD-19, this type of request would not be completely uncommon. This vessel is currently in the East China Sea.
The email is being sent from “Ms. San San” at accounts2[at]princehr[.]com. Prince HR Services is a staffing service based in Delhi, India. The sending email does not appear in the Red Sky Alliance breach data, so it is more likely that this user is being spoofed. The email seems relatively professional and addresses “Ms. So Mi” which indicates this is a targeted attack as opposed to a spam campaign template which typically addresses “Dear Sirs/Ma’am.” Because of COVID-19, international crew changes has been a contentious issue and is a very good lure.
The referenced document is titled “661081608860286.doc.” When opened, the file activates TrojanDownloader:O97M/Emotet!rfn which installs the infamous Emotet malware. Red Sky Alliance continues to observe an increase in Emotet activity since July. First identified in 2014, this malware can steal sensitive banking, financial, and user information including passwords. As with many of the Emotet samples observed, the malware deletes the original Word document to make detections more difficult.
The target email is “crew[at]withuskor[.]com”, yet is specifically addressed to “Ms. So Mi.” Analysts were unable to find this particular employee listed anywhere in open source. Often attackers will target users with elevated privileges, but in the case of Emotet malware, the attackers are often looking for employees with access to financial data in order to steal the data and turn a profit.
These analysis results illustrate how a recipient could be fooled into opening an infected email. Doing so could cause the recipient to become an infected member of the maritime supply chain and thus possibly infect victim vessels, port facilities and/or shore companies in the marine, agricultural, and other industries with additional malware.
Fraudulent emails designed to make recipients hand over sensitive information, extort money or trigger malware installation on shore-based or vessel IT networks remains one of the biggest day-to-day cyber threats facing the maritime industry. These threats often carry a financial liability to one or all those involved in the maritime transportation supply chain. Preventative cyber protection offers a strong first-line defence by preventing deceptive messages from ever reaching staff inboxes, but malicious hackers are developing new techniques to evade current detection daily. Using pre-emptive information from Red Sky Alliance-RedXray diagnostic tool, our Vessel Impersonation reports, and Maritime Blacklists offer a proactive solution to stopping cyber-attacks. Recent studies suggest cyber-criminals are researching their targets and tailoring emails for staff in specific roles. Another tactic is to spoof emails from the chief executive or other high-ranking maritime contemporaries in the hope staff lower down the supply chain will drop their awareness and follow the spoofed email obediently. Analysts across the industry are beginning to see maritime-specific examples of these attacks.
Pre-empt, don’t just defend
Preventative cyber protection offers a strong first-line defense by preventing deceptive messages from ever reaching staff inboxes, but malicious hackers are developing new techniques to evade current detection daily. Using preemptive information from Red Sky Alliance RedXray diagnostic tool, our Vessel Impersonation reports and Maritime Blacklists offer a proactive solution to stopping cyber-attacks. Recent studies suggest cyber-criminals are researching their targets and tailoring emails for staff in specific roles. Another tactic is to spoof emails from the chief executive or other high-ranking maritime contemporaries in the hope staff lower down the supply chain will drop their awareness and follow the spoofed email obediently. Analysts across the industry are beginning to see maritime-specific examples of these attacks.
Source: Dryad Global
