11 min read

Maritime Cyber Security & Threats Jun 2020 Week Three


Featured Image

Dryad Global's cyber security partners, Red Sky Alliance, perform weekly queries of  backend databases, identifying all new data containing Motor Vessel (MV) and Motor Tanker (MT) in the subject line of malicious emails.  Email subject line Motor Vessel (MV) or Motor Tanker (MT) keyword usage is a common lure to entice users in the maritime industry to open emails containing malicious attachments.

With our cyber security partner we are providing a weekly list of Motor Vessels where it is observed that the vessel is being impersonated, with associated malicious emails.

The identified emails attempted to deliver malware or phishing links to compromise the vessels and/or parent companies.  Users should be aware of the subject lines used and the email addresses that are attempting to deliver the messages.

Vessel Impersonation Report 
Jun 13, 2020 FW: MV Premier - Spare Parts Request 11.06.2020 Exploit:O97M/CVE-2017-11882!MTB “Bayu-Dwi PUJI-WIDODO” bayu-dwi.puji-widodo@phm.pertamina.com “EP-ID-IST SECURITY” ep-id-ist.security@phm.pertamina.com
Jun 13, 2020 CONTAINER FOR YOUR GOODS Trojan:HTML/Phish.JK!MTB "1e6a24e1c6@679.com"1e6a24e1c6@679.com Targets Not Disclosed
Jun 15, 2020 RE : URGENT!!! 2 x 20ft - SHIPPING DOC BL,SI,INV#462345 // MAERSK\r\n KLEVEN V.949E // CLGQOE191781 // HEUR:Exploit.MSOffice.Generic "A.P. Moller - Maersk" tacdmk4@transaircargo.com Targets Not Disclosed
Jun 15, 2020 Re: Request for Quotation - MV EVIAPETROL V TRADER Trojan:Win32/Wacatac.C!ml "CHLOE LI" sales@moton-electric.com Recipients sales@moton-electric.com
Jun 16, 2020 ***SPAM*** Maersk Line : Arrival Notice Probably Heur.HTMLUnescape autonotificationimports@Maersk.com hung.ttq@msv.com.vn
Jun 16, 2020 M/V ASPL TBN / PDA ENQUIRY Exploit:O97M/CVE-2017-8570.JB!MTB “PLATIN SHIPPING TRADING CO. / ISTANBUL” f7235a61f@3ae52877e0.net e84@963212c1fc.com
Jun 16, 2020 MV ASPL TBN / PDA INQUIRY Exploit:O97M/CVE-2017-8570.JB!MTB PLATIN SHIPPING TRADING CO. / ISTANBULf7235a61f@3ae52877e0.net 7f9d3@30718da8.eg
Jun 16, 2020 MV CHINALAND TBN AGENCY NORMINATION Exploit:O97M/CVE-2017-8570.JB!MTB "CHINALAND SHIPPING"e84@a7a9430ca6031bd7d.cn cd6c@5d104289d17.za
Jun 16, 2020 MV Sider Capri - PDA Exploit:O97M/CVE-2017-8570.JB!MTB "INTERTRANS"f7235a61f@df67164c739.co Targets Not Disclosed
Jun 17, 2020 RE: MV TBN - PORT INQUIRY FOR LOADING DAP IN BULK Trojan:Win32/Sonbokli.A!cl "INTER-OCEAN KOREA CO., LTD." interocean1@korea.com Targets Not Disclosed

 

In the above collection, we see malicious actors attempting to use vessel names to try to spoof companies in the maritime supply chain.  This week we observed a wide variety of maritime-related subject lines.    Some of the new vessel names used this week include “MV Sider Capri” and “MV Premier” among others. “Maersk Kleven” was used again this week. It is still unclear as to why this specific vessel is being leveraged in so many subject lines. The owners of the vessel appear to work closely with leading maritime financing banks and export credit agencies. Often targets like this are leveraged to attack others which they may provide services to, or other associated companies in the supply chain.

Analysts observed two similar subject lines “M/V ASPL TBN / PDA ENQUIRY and “M/V ASPL TBN / PDA INQUIRY” being used in two malicious emails this week. The sender email was the same for both emails, but the targeted email addresses were unique.  The difference in the word “inquiry” indicates that the attacker was likely targeting Canadian or American targets with the “inquiry” subject line and targeting victims in the United Kingdom with the “enquiry” subject line.

The above email messages were sent from, ““PLATIN SHIPPING TRADING CO. / ISTANBUL” <f7235a61f@3ae52877e0.net>.” Although an alias obscures the sending domain, the sending email is likely impersonating platinship[.]net which is the domain for Platin Shipping & Trading Co. LTD in Turkey.

The message body is redacted in both emails, so no additional context is provided.  However, the malicious attachments for both emails are the same.  The first is a “DOCX.doc” Word document and the second is “Q88.xlsm” Excel spreadsheet with macros enabled.   Both documents contain Exploit:O97M/CVE-2017-8570.JB!MTB malware.  When executed, the malware infects the victim device and deletes copies of itself to make analysis more difficult.  Intelligence gathered from previous Red Sky Alliance reporting indicates these victims have been targeted in the past with trojan downloader malware.[1]

Analysts observed another malicious email which appears to impersonate Systems Controls Instrumentations, Inc. (SCII).  The malicious email subject line used is “Quote # 5780 -LCL-AS/PO/- PR#61007114.” SCII is a specialized trading company located in the Philippines with over $2.2mil in “total turnover” in 2018.

The sending email pcpd@scii.com.ph” appears to be a valid email domain used by the company.  Also, the person associated with the sending email “Jenny Enerio” appears to be the In-House Sales Coordinator for SCII.  Although this specific user does not show up in Red Sky Alliance collections, there are other employees at the company with credentials listed in our Breach Data collections.

The signature in the email confirms the sender is impersonating Jenny Enerio, the In-House Sales Coordinator for the company.  The message body consists of an RFQ and asks for a re-sale price and lead-time for a list of attached items.  The fact that the message has no greeting makes it generic enough to send to multiple targets.

The recipient in the email is “info@camillebauer.com” which is listed publicly on a website for the Controller Area Network in Automation (CiA) group which is an international users and manufacturers group.  The group works to enhance and develop the CAN protocol and “promote the image of the CAN technology.”[2]  The group appears to have headquarters in Nuremberg, Germany.  Camille Bauer Metrawatt AG (which owns the target domain) appears to be a member of this group. The company provides system solutions for energy generation, distribution, and consumption.  These types of companies are often targeted for profit and trade secrets.

When the victim opens the attached spreadsheet named “RFQ_34234651.xlsx”, they are actually activating Exploit:O97M/CVE-2017-0199!MTB malware.[3]  This malware is one of the most common exploits seen in malicious emails.  It exploits a memory corruption vulnerability in Microsoft Office products.  This allows attackers to extract sensitive and private information from the victim’s device.  If successful, an attacker could cause this malware to spread to other user accounts that would likely have better access to sensitive/private information. For example, users who are part of the info@camillebauer.com email group may end up downloading the malware which would result in the attacker’s access to the network.

[1] https://redskyalliance.org/transportation/vessel-impersonation-08-18-2019

[2] https://www.can-cia.org/about-us/

[3]https://www.virustotal.com/gui/file/c241e93e03a9d89d8ff72361657bdcd47361a9ba664c698d1d13b5f75ab9fcbc/detection

 

Book a no-obligation Cyber Consultation

These analysis results illustrate how a recipient could be fooled into opening an infected email.   Doing so could cause the recipient to become an infected member of the maritime supply chain and thus possibly infect victim vessels, port facilities and/or shore companies in the marine, agricultural, and other industries with additional malware.

Fraudulent emails designed to make recipients hand over sensitive information, extort money or trigger malware installation on shore-based or vessel IT networks remains one of the biggest day-to-day cyber threats facing the maritime industry.  These threats often carry a financial liability to one or all those involved in the maritime transportation supply chain.   Preventative cyber protection offers a strong first-line defense by preventing deceptive messages from ever reaching staff inboxes, but malicious hackers are developing new techniques to evade current detection daily.  Using preemptive information from Red Sky Alliance-RedXray diagnostic tool, our Vessel Impersonation reports, and Maritime Blacklists offer a proactive solution to stopping cyber-attacks.    Recent studies suggest cyber-criminals are researching their targets and tailoring emails for staff in specific roles.  Another tactic is to spoof emails from the chief executive or other high-ranking maritime contemporaries in the hope staff lower down the supply chain will drop their awareness and follow the spoofed email obediently.  Analysts across the industry are beginning to see maritime-specific examples of these attacks.

Top 5 Malicious Senders

 

Pre-empt, don't just defend

Preventative cyber protection offers a strong first-line defense by preventing deceptive messages from ever reaching staff inboxes, but malicious hackers are developing new techniques to evade current detection daily. Using preemptive information from Red Sky Alliance RedXray diagnostic tool, our Vessel Impersonation reports and Maritime Blacklists offer a proactive solution to stopping cyber-attacks. Recent studies suggest cyber-criminals are researching their targets and tailoring emails for staff in specific roles. Another tactic is to spoof emails from the chief executive or other high-ranking maritime contemporaries in the hope staff lower down the supply chain will drop their awareness and follow the spoofed email obediently. Analysts across the industry are beginning to see maritime-specific examples of these attacks.


The more convincing an email appears, the greater the chance employees will fall for a scam.  To address this residual risk, software-based protection should be treated as one constituent of a wider strategy that also encompasses the human-element as well as organizational workflows and procedures.

It is imperative to:

  • Train all levels of the marine supply chain to realize they are under constant cyber-attack.
  • Stress maintaining constant attention to real-world cyber consequences of careless cyber practices or general inattentiveness.
  • Provide practical guidance on how to look for a potential phishing attempt.
  • Use direct communication to verify emails and supply chain email communication.
  • Use Red Sky Alliance RedXray proactive support, our Vessel impersonation information and use the Maritime Black Lists to proactively block cyber attacks from identified malicious actors.

Sign up for Cyber Threat Notifications