The case for pre-emptive defence
Vessel Impersonation Report
Tactical Cyber Intelligence Reporting
|First Seen||Subject Line Used||Malware Detections||Sending Email||Targets|
|Feb 7, 2020||REQUEST FOR EPDA FOR SEA LONGITUDE CALLING LUBUK GAUNG FOR LOADING||Trojan:Win32/Dynamer!rfn||"Sandro Ginting DM" firstname.lastname@example.org||tck-shipping.co.id|
|Feb 7, 2020||RE: M.V FAITH =|
= c/p dd 19.02.2020 =
|Trojan:Script/Casur.A!cl, Trojan:Win32/Tiggre!rfn||SMC Marine Management Pte Ltd email@example.com||yamato-grp.com|
|Feb 9, 2020||Bunker nomination / DL Poppy / 8-10 Feb 2020 / 2kt BD / ABTD1101-16||Trojan:Win32/Esulat.A!ctv||Sang Gyoon Kim firstname.lastname@example.org||tandler.de|
|Feb 10, 2020||MV.CH DORIS bunker AT HK APPOINTMENT||TrojanDownloader:O97M/Obfuse!MTBemail@example.com" firstname.lastname@example.org||Target not disclosed|
|Feb 10, 2020||REQUEST FOR EPDA FOR SEA LONGITUDE CALLING LUBUK GAUNG FOR LOADING ABOUT 15, 000MT RBD PALM OLEIN||VBS/Agent.EC19!tr.dldr||"Sandro Ginting DM" email@example.com||tck-shipping.co.id|
|Feb 10, 2020||mv Eems Dollard voy 3 - agency nomination loading port||VBS/Agent.EC19!tr.dldr||Sender not disclosed||Target not disclosed|
|Feb 10, 2020||MV FRO LAS PALMAS PORT AGENCY APPOINTMENT||Trojan:Win32/Sonbokli.A!cl||Louis Dreyfus Company Asia Pte. Ltd firstname.lastname@example.org||Target not disclosed|
|Feb 10, 2020||MV Ivy Ocean - agency nomination||Exploit:O97M/CVE-2017-11882.ARJ!MTB||"Admin Smoothiedeck" email@example.com||Target not disclosed|
|Feb 11, 2020||MV MERCURIUS PORT AGENCY APPOINTMENT||Trojan-Downloader.MSWord.Agent.buh||"WOOSHIN MARINE CO., LTD." firstname.lastname@example.org||ligabue.it|
|Feb 10, 2020||NOMINATION//MV AQUILA V20004 PHG- CSU/ZJG DISH POSCO CARGO||Trojan:Win32/Sonbokli.A!cl||"china" email@example.com||Target not disclosed|
In the above collection we see malicious actors attempting to use vessel names to try to spoof companies in the maritime supply chain. This week we see malicious emails attempting to deliver a variety of different malware. Vessel names seen include “M.V Faith”, and “MV Aquila” among others.
Analysis reveals that a malicious email was sent from a South Korean IP address to a recipient at the yamato-grp.com domain. The target domain is owned by the Malaysian Courier, Freight, and Logistics company, YAMATO TRANSPORT(S) PTE. LTD. hosted by Vodien Internet Solutions Pte Ltd and protected by Cloudflare. We also saw this organization targeted last week.An email was observed attempting to impersonate “M.V Faith” using a subject line of “RE: M.V FAITH = = c/p dd 19.02.2020 = AGENCY APPOINTMENT”. According to maritimetraffic.com, the vessel is a bulk cargo carrier sailing under the Liberian flag. It is currently in port at Mariveles, Phillipines.
The message contains an attached Excel spreadsheet identified by Microsoft as the Trojan:Win32/Tiggre!rfn malware. The message body contains a request for the recipient to fill out and return the attached PDA form. However, opening the attachment could activate the malware. The malware uses the victim’s computer to perform crypto-currency mining.
In another example this week, we see an email attempting to impersonate the vessel “MV Aquila” using the subject line “NOMINATION//MV AQUILA V20004 PHG- CSU/ZJG DISH POSCO CARGO”.
“Aquila” is an extremely popular vessel name belonging to many sailing vessels and pleasure craft. It is also currently in use by several oil/chemical tankers and cargo vessels sailing under many different flags. It is unclear which if any specific vessel is being targeted for impersonation. “POSCO”, mentioned in the subject line could be referencing a South Korean steel producer with a global customer base. Although rooted in steel production, the company also produces coal chemicals and carbon materials. Because their range of products could be shipped using both cargo and oil/chemical tankers, it is difficult to determine a specific vessel from the subject line alone. Unfortunately, analysis of the email reveals that much of it has been redacted, including the Sending and receiving email address and the message body. An attachment titled “MV. Aquila V20004 PHG.rar” is identified by Microsoft as “Trojan:Win32/Sonbokli.A!cl”
The site any.run, a malware sandbox service, identifies a recent sample with the same filename identified as Lokibot, a credential stealing malware. Lokibot is known for the large number of applications it is able to target for credentials and information theft. Opening the attachment could trigger the malware.
Our Experts Say
Weekly Maritime Watchlist
Top 5 Malicious Maritime Email Senders
The more convincing an email appears, the greater the chance employees will fall for a scam. To address this residual risk, software-based protection should be treated as one constituent of a wider strategy that also encompasses the human-element as well as organizational workflows and procedures.
It is imperative to:
- Train all levels of the marine supply chain to realize they are under constant cyber-attack.
- Stress maintaining constant attention to real-world cyber consequences of careless cyber practices or general inattentiveness.
- Provide practical guidance on how to look for a potential phishing attempt.
- Use direct communication to verify emails and supply chain email communication.
- Use Red Sky Alliance RedXray proactive support, our Vessel impersonation information and use the Maritime Black Lists to proactively block cyber attacks from identified malicious actors.