Maritime Cyber Security & Threats Jun 2020 Week Three

In the above collection, we see malicious actors attempting to use vessel names to try to spoof companies in the maritime supply chain.  This week we observed a wide variety of maritime-related subject lines.    Some of the new vessel names used this week include “MV Sider Capri” and “MV Premier” among others. “Maersk Kleven” was used again this week. It is still unclear as to why this specific vessel is being leveraged in so many subject lines. The owners of the vessel appear to work closely with leading maritime financing banks and export credit agencies. Often targets like this are leveraged to attack others which they may provide services to, or other associated companies in the supply chain.

Analysts observed two similar subject lines “M/V ASPL TBN / PDA ENQUIRY” and “M/V ASPL TBN / PDA INQUIRY” being used in two malicious emails this week. The sender email was the same for both emails, but the targeted email addresses were unique.  The difference in the word “inquiry” indicates that the attacker was likely targeting Canadian or American targets with the “inquiry” subject line and targeting victims in the United Kingdom with the “enquiry” subject line.

The above email messages were sent from, ““PLATIN SHIPPING TRADING CO. / ISTANBUL” <f7235a61f@3ae52877e0.net>.” Although an alias obscures the sending domain, the sending email is likely impersonating platinship[.]net which is the domain for Platin Shipping & Trading Co. LTD in Turkey.

The message body is redacted in both emails, so no additional context is provided.  However, the malicious attachments for both emails are the same.  The first is a “DOCX.doc” Word document and the second is “Q88.xlsm” Excel spreadsheet with macros enabled.   Both documents contain Exploit:O97M/CVE-2017-8570.JB!MTB malware.  When executed, the malware infects the victim device and deletes copies of itself to make analysis more difficult.  Intelligence gathered from previous Red Sky Alliance reporting indicates these victims have been targeted in the past with trojan downloader malware.[1]

Analysts observed another malicious email which appears to impersonate Systems Controls Instrumentations, Inc. (SCII).  The malicious email subject line used is “Quote # 5780 -LCL-AS/PO/- PR#61007114.” SCII is a specialized trading company located in the Philippines with over $2.2mil in “total turnover” in 2018.

The sending email “pcpd@scii.com.ph” appears to be a valid email domain used by the company.  Also, the person associated with the sending email “Jenny Enerio” appears to be the In-House Sales Coordinator for SCII.  Although this specific user does not show up in Red Sky Alliance collections, there are other employees at the company with credentials listed in our Breach Data collections.

The signature in the email confirms the sender is impersonating Jenny Enerio, the In-House Sales Coordinator for the company.  The message body consists of an RFQ and asks for a re-sale price and lead-time for a list of attached items.  The fact that the message has no greeting makes it generic enough to send to multiple targets.

The recipient in the email is “info@camillebauer.com” which is listed publicly on a website for the Controller Area Network in Automation (CiA) group which is an international users and manufacturers group.  The group works to enhance and develop the CAN protocol and “promote the image of the CAN technology.”[2]  The group appears to have headquarters in Nuremberg, Germany.  Camille Bauer Metrawatt AG (which owns the target domain) appears to be a member of this group. The company provides system solutions for energy generation, distribution, and consumption.  These types of companies are often targeted for profit and trade secrets.

When the victim opens the attached spreadsheet named “RFQ_34234651.xlsx”, they are actually activating Exploit:O97M/CVE-2017-0199!MTB malware.[3]  This malware is one of the most common exploits seen in malicious emails.  It exploits a memory corruption vulnerability in Microsoft Office products.  This allows attackers to extract sensitive and private information from the victim’s device.  If successful, an attacker could cause this malware to spread to other user accounts that would likely have better access to sensitive/private information. For example, users who are part of the info@camillebauer.com email group may end up downloading the malware which would result in the attacker’s access to the network.

[1] https://redskyalliance.org/transportation/vessel-impersonation-08-18-2019

[2] https://www.can-cia.org/about-us/

[3]https://www.virustotal.com/gui/file/c241e93e03a9d89d8ff72361657bdcd47361a9ba664c698d1d13b5f75ab9fcbc/detection