was successfully added to your cart.

Cart

Maritime Cyber Security & Threats December 2019 Week One

The case for pre-emptive defence

Vessel Impersonation Report

Dryad Global’s cyber security partners, Red Sky Alliance, perform weekly queries of  backend databases, identifying all new data containing Motor Vessel (MV) and Motor Tanker (MT) in the subject line of malicious emails.  Email subject line Motor Vessel (MV) or Motor Tanker (MT) keyword usage is a common lure to entice users in the maritime industry to open emails containing malicious attachments.

With our cyber security partner we are providing a weekly list of Motor Vessels where it is observed that the vessel is being impersonated, with associated malicious emails.

The identified emails attempted to deliver malware or phishing links to compromise the vessels and/or parent companies.  Users should be aware of the subject lines used and the email addresses that are attempting to deliver the messages.

Tactical Cyber Intelligence Reporting

First SeenSubject Line UsedMalware DetectionsSending EmailTargets
Nov 26, 2019[Warning]MV TBN - PORT INQUIRYBackdoor:MSIL/Bladabindi!MTBVeena Bankar ckm.co.jp
Nov 28, 2019MV. SEA MARK - FDA / OUTSTANDING BALANCETrojan:Win32/Emali.B!cl"L.P. Felperlaan Shipping
Trading B.V."
Target not reported
Dec 2, 2019MT GLOBAL GLORY V1901 AGENT NOMINATION FOR LOAD AT Pulau LautTrojan:Win32/Sonbokli.A!cl"JunzhengShipping" junzhenggroup.com
Dec 2, 2019Re: RE: MV LEONOR - /ETA TO ITALYTrojanDownloader:O97M/Emotet.RX!MTB"FALCON LOGISTICS.JSC" b315aee.mx
Dec 2, 2019CTM DELIVERY REQUEST- MT SUN GAIA AT ULSANTrojan:Win32/Wacatac.B!mlYukako Kobayashi sunavigation.com
Dec 2, 2019MV AL HANI PDA LINER OUT CHARGES - AGENT APPOINTMENT LOADINGTrojan:Win32/Tiggre!rfnIntermarine Shipping intermarine.com
Dec 2, 2019mv TBN / Inquiry pda / Due to Dischrgn/Port CallTrojan:Win32/Tiggre!rfn"Alex, Selena Shipping" selena-shipping.com
Dec 2, 2019MV TBN // PDA REQUESTBackdoor:MSIL/Bladabindi!MTBVeena Bankar ckm.co.jp
Dec 2, 2019MT. GLOBAL IRIS V145 - DRAFT BLTrojan:Win32/Predator.BC!MTBOCEAN EIGHT MARINE PTE LTD asedossa.com
Dec 2, 2019MV \"BOMAR OYSTER Loading 60000mt of MILESTONEJava/Kryptik.ZQ!tr"MILESTONE KOREA Co., Ltd." Target not reported
Dec 2, 2019MV Thor Magnhild - Request quotation for deck and engine storeTrojan:Win32/Predator.BC!MTBsales indra.es

In the above collections for MV TBN, MV Sea Mark, MT Global Glory and others, we see malicious actors using these vessel names to try and spoof companies in the maritime supply chain.

MT Global Glory is an oil and chemical tanker under the Hong Kong flag. Analysis reveals that a malicious email was sent to the domain junzhenggroup.com which belongs to Junzheng Energy & Chemical Group. The malware that was attempted to be sent is Trojan:Win32/Sonbokli.A!cl . The subject line of the malicious email is: “MT GLOBAL GLORY V1901 AGENT NOMINATION FOR LOAD AT Pulau Laut”.

An unsuspecting employee at Junzheng Energy & Chemical would see an email with this Subject Line, possibly tempting them to open the email to see the details of an apparent nomination for load. If this malware is delivered, with any of these exploits, any recipient could become an infected member of the maritime supply chain and thus possibly infect victim vessels, port facilities and/or shore companies in the marine / chemical industries with additional malware.
In another example, we see a subject line of: “MV AL HANI PDA LINER OUT CHARGES – AGENT APPOINTMENT LOADING” The MV Al Hani is a general cargo ship under the Togo flag, currently enroute to the port of Tripoli, Lebanon. At first glance, any recipient of this email would see a request for information regarding a potential shipping contract. This would likely appear to be a legitimate email and entice the recipient to open it and thus download malware like the listed Trojan:Win32/Tiggre!rfn malware detected by Fortinet.

In the contents of the email using the subject line “MV AL HANI PDA LINER OUT CHARGES – AGENT APPOINTMENT LOADING” we see the author of the malicious email asking the recipient to respond. However, the simple act of opening the email could trigger the attached malware to be installed. The language used in the email attempts to add to its legitimacy using shipping jargon such as “pda”, “cargo details”, “packing list”, and “vessel specs”.

Our Experts Say

Dryad Assessment

Fraudulent emails designed to make recipients hand over sensitive information, extort money or trigger malware installation on shore-based or vessel IT networks remains one of the biggest day-to-day cyber threats facing the maritime industry. These threats often carry a financial liability to one or all those involved in the maritime transportation supply chain.

Pre-empt, don’t just defend

Preventative cyber protection offers a strong first-line defense by preventing deceptive messages from ever reaching staff inboxes, but malicious hackers are developing new techniques to evade current detection daily. Using preemptive information from Red Sky Alliance RedXray diagnostic tool, our Vessel Impersonation reports and Maritime Blacklists offer a proactive solution to stopping cyber-attacks. Recent studies suggest cyber-criminals are researching their targets and tailoring emails for staff in specific roles. Another tactic is to spoof emails from the chief executive or other high-ranking maritime contemporaries in the hope staff lower down the supply chain will drop their awareness and follow the spoofed email obediently. Analysts across the industry are beginning to see maritime-specific examples of these attacks.

Global Dryad

Weekly Maritime Watchlist

Top 5 Malicious Maritime Email Senders

SenderMaware Sent
arnold1989@ncled.co.krTrojan:Script/Conteban.A!ml
dubai@intermarine.comMSIL/Kryptik.TXC!tr
info.sales@sea-sapphire.netTrojan:Script/Conteban.A!ml
l.marechal@fr.christianlouboutin.comTrojan:Script/Oneeva.A!ml
alex.s@selena-shipping.comTrojan:Win32/Tiggre!rfn

The more convincing an email appears, the greater the chance employees will fall for a scam.  To address this residual risk, software-based protection should be treated as one constituent of a wider strategy that also encompasses the human-element as well as organizational workflows and procedures.

It is imperative to:

  • Train all levels of the marine supply chain to realize they are under constant cyber-attack.
  • Stress maintaining constant attention to real-world cyber consequences of careless cyber practices or general inattentiveness.
  • Provide practical guidance on how to look for a potential phishing attempt.
  • Use direct communication to verify emails and supply chain email communication.
  • Use Red Sky Alliance RedXray proactive support, our Vessel impersonation information and use the Maritime Black Lists to proactively block cyber attacks from identified malicious actors.

Sign Up to Cyber Threats Notifications

Leave a Reply