Maritime Cyber Security & Threats Jul 2020 Week One

"Fraudulent emails designed to make recipients hand over sensitive information, extort money or trigger malware installation on shore-based or vessel IT networks remains one of the biggest day-to-day cyber threats facing the maritime industry."

Dryad Global's cyber security partners, Red Sky Alliance, perform weekly queries of  backend databases, identifying all new data containing Motor Vessel (MV) and Motor Tanker (MT) in the subject line of malicious emails.  Email subject line Motor Vessel (MV) or Motor Tanker (MT) keyword usage is a common lure to entice users in the maritime industry to open emails containing malicious attachments.

With our cyber security partner we are providing a weekly list of Motor Vessels where it is observed that the vessel is being impersonated, with associated malicious emails.

The identified emails attempted to deliver malware or phishing links to compromise the vessels and/or parent companies.  Users should be aware of the subject lines used and the email addresses that are attempting to deliver the messages.

I

Top 5 Malicious Maritime Subject Lines

In the above collection, we see malicious actors attempting to use vessel names to try to spoof companies in the maritime supply chain. This week we observed a wide variety of maritime-related subject lines. Some of the new vessel names used this week include “MV Ocean Confidence” and “MV JK Pioneer” among others. “Maersk Kleven” was seen in the malicious email subject lines this week after not being observed last week. This vessel has been part of the subject line for at least 9 attack attempts in just the past 90 days. With 6418 twenty-foot equivalent units (shipping container space) onboard, there are numerous companies using this vessel as part of the supply chain. The vessel recently departed Genova, IT and Red Sky Alliance will continue to monitor malicious activity leveraging the vessel’s name.

Analysts observed subject line “SHIPPING DOCUMENTS / CARGO ARRIVAL NOTICE” being used in a malicious email this week. This is a generic enough subject line that it can be used on multiple different companies without the need for editing. Subject lines like these are often used for malware spam campaigns. If the attacker sends out a hundred emails and is only successful on a few of them, it is still a lower-risk, higher-return attack.

Notably, the attacker attempts to impersonate an employee at the company they are targeting. The malicious email sender is “MAERSK LINE <mdee_ram@yahoo.com>.” Notice how the email alias is “Maersk Line,” however the sender email is a generic Yahoo address. Attackers can easily spoof the email sender alias which will trick users who are not paying attention to the sending email.

Although the exact target is unclear, the email is targeting a user on the Maerskline[.]com domain. Training and implementation of good security policies will help make users aware of how to spot the actual sending address of a malicious email.

The message body claims the sender has been asked to “dispatch one of (the recipients) shipments” and to open the attached documents for tracking. The attached files are contained in a zip file called “MAERSK LINE.zip.” When the user decompresses the zip file, there is a “MAERSK LINE.exe” executable file which is actually Fareit password stealing malware. This malware is capable of stealing and exfiltrating the victim’s sensitive information including usernames and passwords.

Analysts observed a malicious email subject line, “RE: URGENT!!! SHIPPING DOC BL,SI,INV#462345 // MAERSK KLEVEN V.949E.” After a brief break from use as a malicious email subject line, the “Maersk Kleven” ship name is being seen again this week. One common method employed by the attackers this week is to use the phrase “urgent” and “re:” to indicate an ongoing conversation which requires an immediate reply.

The email listed as the sender " A.P. Moller - Maersk (Shanghai, Head Office) <eb6bceca@fd8e08.com>” indicating the attacker is attempting to impersonate A.P. Moller Maersk. Shanghai is the busiest port in the entire world, so it is unsurprising to see attackers impersonating one of the largest shipping companies from the largest port in the world. As the sending address is obfuscated, it is unclear if the attacker was attempting to impersonate a specific employee at the massive shipping port.

The message body of the email is redacted further obscuring the sender and target. All of the malicious emails, with the exception of one, list “A.P. Moller – Maersk” as part of the sender alias. The exception was described in previous reporting (TR-20-125-006). However, some choose to add the “(Shanghai, Head Office)” portion which would further entice targets who use Shanghai as part of their supply line.

Attached to the email is a file named, “Shipping Doc_Maersk Kleven V.949E.gz.” This is a gzip file which, when opened, deletes itself when downloaded. When the targeted user clicks the malicious file, it will drop Lokibot malware. First publicized in 2015, Lokibot trojan malware has the ability to infect Windows systems, steal, and then exfiltrate sensitive information, including but not limited to usernames and passwords. Red Sky analysts have observed most bad actors leveraging this vessel’s name sending Fareit and Lokibot malware while exploiting CVE-2017-11882.

These analysis results illustrate how a recipient could be fooled into opening an infected email.   Doing so could cause the recipient to become an infected member of the maritime supply chain and thus possibly infect victim vessels, port facilities and/or shore companies in the marine, agricultural, and other industries with additional malware.

Fraudulent emails designed to make recipients hand over sensitive information, extort money or trigger malware installation on shore-based or vessel IT networks remains one of the biggest day-to-day cyber threats facing the maritime industry.  These threats often carry a financial liability to one or all those involved in the maritime transportation supply chain.   Preventative cyber protection offers a strong first-line defence by preventing deceptive messages from ever reaching staff inboxes, but malicious hackers are developing new techniques to evade current detection daily.  Using pre-emptive information from Red Sky Alliance-RedXray diagnostic tool, our Vessel Impersonation reports, and Maritime Blacklists offer a proactive solution to stopping cyber-attacks.    Recent studies suggest cyber-criminals are researching their targets and tailoring emails for staff in specific roles.  Another tactic is to spoof emails from the chief executive or other high-ranking maritime contemporaries in the hope staff lower down the supply chain will drop their awareness and follow the spoofed email obediently.  Analysts across the industry are beginning to see maritime-specific examples of these attacks.

Pre-empt, don't just defend

Preventative cyber protection offers a strong first-line defense by preventing deceptive messages from ever reaching staff inboxes, but malicious hackers are developing new techniques to evade current detection daily. Using preemptive information from Red Sky Alliance RedXray diagnostic tool, our Vessel Impersonation reports and Maritime Blacklists offer a proactive solution to stopping cyber-attacks. Recent studies suggest cyber-criminals are researching their targets and tailoring emails for staff in specific roles. Another tactic is to spoof emails from the chief executive or other high-ranking maritime contemporaries in the hope staff lower down the supply chain will drop their awareness and follow the spoofed email obediently. Analysts across the industry are beginning to see maritime-specific examples of these attacks.

The more convincing an email appears, the greater the chance employees will fall for a scam.  To address this residual risk, software-based protection should be treated as one constituent of a wider strategy that also encompasses the human-element as well as organizational workflows and procedures.

It is imperative to:

• Train all levels of the marine supply chain to realize they are under constant cyber-attack.
• Stress maintaining constant attention to real-world cyber consequences of careless cyber practices or general inattentiveness.
• Provide practical guidance on how to look for a potential phishing attempt.
• Use direct communication to verify emails and supply chain email communication.
• Use Red Sky Alliance RedXray proactive support, our Vessel impersonation information and use the Maritime Black Lists to proactively block cyber attacks from identified malicious actors.