The case for pre-emptive defence
Vessel Impersonation Report
Tactical Cyber Intelligence Reporting
|First Seen||Subject Line Used||Malware Detections||Sending Email||Targets|
|Jun 13, 2020||FW: MV Premier - Spare Parts Request 11.06.2020||Exploit:O97M/CVE-2017-11882!MTB||“Bayu-Dwi PUJI-WIDODO” firstname.lastname@example.org||“EP-ID-IST SECURITY” email@example.com|
|Jun 13, 2020||CONTAINER FOR YOUR GOODS||Trojan:HTML/Phish.JK!MTB||"firstname.lastname@example.org"email@example.com||Targets Not Disclosed|
|Jun 15, 2020||RE : URGENT!!! 2 x 20ft - SHIPPING DOC BL,SI,INV#462345 // MAERSK\r\n KLEVEN V.949E // CLGQOE191781 //||HEUR:Exploit.MSOffice.Generic||"A.P. Moller - Maersk" firstname.lastname@example.org||Targets Not Disclosed|
|Jun 15, 2020||Re: Request for Quotation - MV EVIAPETROL V TRADER||Trojan:Win32/Wacatac.C!ml||"CHLOE LI" email@example.com||Recipients firstname.lastname@example.org|
|Jun 16, 2020||***SPAM*** Maersk Line : Arrival Notice||Probably Heur.HTMLUnescape||autonotificationimports@Maersk.email@example.com|
|Jun 16, 2020||M/V ASPL TBN / PDA ENQUIRY||Exploit:O97M/CVE-2017-8570.JB!MTB||“PLATIN SHIPPING TRADING CO. / ISTANBUL” firstname.lastname@example.orgemail@example.com|
|Jun 16, 2020||MV ASPL TBN / PDA INQUIRY||Exploit:O97M/CVE-2017-8570.JB!MTB||PLATIN SHIPPING TRADING CO. / ISTANBULf7235a61f@firstname.lastname@example.org|
|Jun 16, 2020||MV CHINALAND TBN AGENCY NORMINATION||Exploit:O97M/CVE-2017-8570.JB!MTB||"CHINALAND SHIPPING"email@example.comfirstname.lastname@example.org|
|Jun 16, 2020||MV Sider Capri - PDA||Exploit:O97M/CVE-2017-8570.JB!MTB||"INTERTRANS"email@example.com||Targets Not Disclosed|
|Jun 17, 2020||RE: MV TBN - PORT INQUIRY FOR LOADING DAP IN BULK||Trojan:Win32/Sonbokli.A!cl||"INTER-OCEAN KOREA CO., LTD." firstname.lastname@example.org||Targets Not Disclosed|
|Jun 17, 2020||Port information - Discharge Rice in Jumbo bags||Exploit:O97M/CVE-2017-11882.ARJ!MTB||Thoresen Shipping Singapore email@example.comfirstname.lastname@example.org|
|Jun 17, 2020||Shipping documents for Cargo Down ( ETD SHA : 6/17, ETA JKT : 6/25)||Trojan:Win32/FormBook.CR!MTB||Ella email@example.comfirstname.lastname@example.org|
|Jun 18, 2020||Cargo is prepared for sending.||TrojanDropper:O97M/Powdow.J!MTBemail@example.comfirstname.lastname@example.org|
|Jun 18, 2020||Quote # 5780 -LCL-AS/PO/- PR#61007114||HEUR:Exploit.MSOffice.CVE-2017-0199.a||"Jenny Rose V. Enerio" email@example.comfirstname.lastname@example.org|
|Jun 18, 2020||MV DS FAVOUR V.S20087-SHIP PARTICULARS||Trojan:Win32/Wacatac.Cemail@example.com||me firstname.lastname@example.org|
|Jun 18, 2020||[Port Info - 38K] Kharis - Discharge about 50, 000mt of Clinker at Fangcheng, China||Trojan:Win32/Wacatac.C!ml||Yejin Park_KHARIS email@example.com||Yejin Park_KHARIS firstname.lastname@example.org|
|Jun 18, 2020||Re: Purchase Purse seiner. Tuna vessel||Trojan:Win32/Sonbokli.A!cl||Kim Chun Geuk email@example.com||Targets Not Disclosed|
|Jun 18, 2020||Re: M.V. Su May/M.V. Yong May - inquiry||Trojan:Win32/Obfuscator.TX!MTB||Sales Bogerd Martin HK firstname.lastname@example.orgemail@example.com|
|Jun 18, 2020||Fuji Trading(Marine) REQUEST FOR QUOTATION||Trojan:Win32/Wacatac.C!ml||"Fuji Trading(Marine) B.V. Rotterdam" firstname.lastname@example.org||Targets Not Disclosed|
|Jun 18, 2020||RE: AW: TH MARTIN 2486 MV Grace Previous shipment Documents / Arrival\n Notify||Trojan:Win32/Occamy.C67||"Mark E. Ocampo" email@example.com||Targets Not Disclosed|
|Jun 18, 2020||MAERSK LINE PRE-NOTIFICATION ALERT DOC#HO8524501N00083||Trojan.Win32.Crypt.akjh||MAERSK LINE SERVICE firstname.lastname@example.orgemail@example.com|
|Jun 19, 2020||[External]MV TBN // EPDA AT QINZHOU||Trojan.SpamMalware-RAR.Gen||"firstname.lastname@example.org" email@example.com||ops/OPAL firstname.lastname@example.org|
In the above collection, we see malicious actors attempting to use vessel names to try to spoof companies in the maritime supply chain. This week we observed a wide variety of maritime-related subject lines. Some of the new vessel names used this week include “MV Sider Capri” and “MV Premier” among others. “Maersk Kleven” was used again this week. It is still unclear as to why this specific vessel is being leveraged in so many subject lines. The owners of the vessel appear to work closely with leading maritime financing banks and export credit agencies. Often targets like this are leveraged to attack others which they may provide services to, or other associated companies in the supply chain.
Analysts observed two similar subject lines “M/V ASPL TBN / PDA ENQUIRY” and “M/V ASPL TBN / PDA INQUIRY” being used in two malicious emails this week. The sender email was the same for both emails, but the targeted email addresses were unique. The difference in the word “inquiry” indicates that the attacker was likely targeting Canadian or American targets with the “inquiry” subject line and targeting victims in the United Kingdom with the “enquiry” subject line.
The above email messages were sent from, ““PLATIN SHIPPING TRADING CO. / ISTANBUL” <email@example.com>.” Although an alias obscures the sending domain, the sending email is likely impersonating platinship[.]net which is the domain for Platin Shipping & Trading Co. LTD in Turkey.
The message body is redacted in both emails, so no additional context is provided. However, the malicious attachments for both emails are the same. The first is a “DOCX.doc” Word document and the second is “Q88.xlsm” Excel spreadsheet with macros enabled. Both documents contain Exploit:O97M/CVE-2017-8570.JB!MTB malware. When executed, the malware infects the victim device and deletes copies of itself to make analysis more difficult. Intelligence gathered from previous Red Sky Alliance reporting indicates these victims have been targeted in the past with trojan downloader malware.
Analysts observed another malicious email which appears to impersonate Systems Controls Instrumentations, Inc. (SCII). The malicious email subject line used is “Quote # 5780 -LCL-AS/PO/- PR#61007114.” SCII is a specialized trading company located in the Philippines with over $2.2mil in “total turnover” in 2018.
The sending email “firstname.lastname@example.org” appears to be a valid email domain used by the company. Also, the person associated with the sending email “Jenny Enerio” appears to be the In-House Sales Coordinator for SCII. Although this specific user does not show up in Red Sky Alliance collections, there are other employees at the company with credentials listed in our Breach Data collections.
The signature in the email confirms the sender is impersonating Jenny Enerio, the In-House Sales Coordinator for the company. The message body consists of an RFQ and asks for a re-sale price and lead-time for a list of attached items. The fact that the message has no greeting makes it generic enough to send to multiple targets.
The recipient in the email is “email@example.com” which is listed publicly on a website for the Controller Area Network in Automation (CiA) group which is an international users and manufacturers group. The group works to enhance and develop the CAN protocol and “promote the image of the CAN technology.” The group appears to have headquarters in Nuremberg, Germany. Camille Bauer Metrawatt AG (which owns the target domain) appears to be a member of this group. The company provides system solutions for energy generation, distribution, and consumption. These types of companies are often targeted for profit and trade secrets.
When the victim opens the attached spreadsheet named “RFQ_34234651.xlsx”, they are actually activating Exploit:O97M/CVE-2017-0199!MTB malware. This malware is one of the most common exploits seen in malicious emails. It exploits a memory corruption vulnerability in Microsoft Office products. This allows attackers to extract sensitive and private information from the victim’s device. If successful, an attacker could cause this malware to spread to other user accounts that would likely have better access to sensitive/private information. For example, users who are part of the firstname.lastname@example.org email group may end up downloading the malware which would result in the attacker’s access to the network.
Our Experts Say
Weekly Maritime Watchlist
Top 5 Malicious Maritime Subject Lines
The more convincing an email appears, the greater the chance employees will fall for a scam. To address this residual risk, software-based protection should be treated as one constituent of a wider strategy that also encompasses the human-element as well as organizational workflows and procedures.
It is imperative to:
- Train all levels of the marine supply chain to realize they are under constant cyber-attack.
- Stress maintaining constant attention to real-world cyber consequences of careless cyber practices or general inattentiveness.
- Provide practical guidance on how to look for a potential phishing attempt.
- Use direct communication to verify emails and supply chain email communication.
- Use Red Sky Alliance RedXray proactive support, our Vessel impersonation information and use the Maritime Black Lists to proactively block cyber attacks from identified malicious actors.