Red Sky Alliance performs weekly queries of our backend databases, identifying all new data containing Motor Vessel (MV) and Motor Tanker (MT) in the subject line of malicious emails. Email subject line Motor Vessel (MV) or Motor Tanker (MT) keyword usage is a common lure to entice users in the maritime industry to open emails containing malicious attachments. Red Sky Alliance is providing this weekly list of Motor Vessels in which Red Sky Alliance directly observed the vessel being impersonated, with associated malicious emails. The identified emails attempted to deliver malware or phishing links to compromise the vessels and/or parent companies. Users should be aware of the subject lines used and the email addresses that are attempting to deliver the messages.
Significant Vessel Keys Words:
very large crude carrier
ultra large crude carrier
floating production storage & offloading
Table 1: List of subject lines, motor vessel, type of malware sent and sender data that was seen in Red Sky Alliance’s malicious email collection from November 1, 2019 to November 7, 2019.
Subject Line Used
Nov 4, 2019
RE : MV SERIANA voy-32 possibility discharging of H.F.O
Trojan:Win32/Azorult.PA!MTB - Microsoft
"CHUBU KAIUN KAISHA, LTD." <firstname.lastname@example.org>
Nov 4, 2019
MV SUN GRACE / Port Agency Appointment
Trojan.Win32.Agentb.jrem - Kaspersky
"CHIBA MARINE KOREA CO., LTD"
Nov 4, 2019
MV TOROS-M//DRAFT SHIPPING DOCUMENTS
HEUR:Exploit.MSOffice.Generic - Kaspersky
"Standard Shipping Co., Ltd"
In the above collections for MV Seriana, MV Sun Grace and MV Toros M we see malicious actors using these vessel names to try and spoof companies in the maritime supply chain.
MV Seriana is an actual oil and chemical tanker operating under the flag of Malta, an island country located south of Italy. Analysis reveals that a malicious email was sent to the domain railquip.com.au, which is owned by the Australian branch of the company Railquip Inc., a manufacturer of transportation and portable hydraulic rerailing equipment. The malware that was attempted to be sent to this company is Trojan:Win32/Azorult.PA!MTB. The subject line of the malicious email is: “RE : MV SERIANA voy-32 possibility discharging of H.F.O”.
Figure 4. Website for Railquip, Inc.
An unsuspecting employee at Railquip, Inc. would see an email with this Subject Line, possibly tempting them to open the email to see the details of an apparent heavy fuel oil discharge. If this malware is delivered, with any of these exploits, the chemical company could then become an infected member of the maritime supply chain and thus possibly infect victim vessels, port facilities and/or shore companies in the marine / oil and gas supply chain with additional malware.
In another example, we see a subject line of: “MV TOROS-M//DRAFT SHIPPING DOCUMENTS” The intended targets of this malicious email was a Korean logistics company / provider. The MV Toros M is a real bulk carrier vessel sailing under the flag of Panama, currently sailing in the Red Sea West of Saudi Arabia. At first glance by any recipient of this email, a bulk carrier vessel is appearing to provide shipping documents. To any employee of a shipping or logistics company expecting that may be expecting the arrival of the MV Toros M, this would appear to be a legitimate email and would likely entice them to click on the email and thus download malware like the listed HEUR:Exploit.MSOffice.Generic malware detected by Kaspersky.
Fraudulent emails designed to make recipients hand over sensitive information, extort money or trigger malware installation on shore-based or vessel IT networks remains one of the biggest day-to-day cyber threats facing the maritime industry. These threats often carry a financial liability to one or all those involved in the maritime transportation supply chain. Preventative cyber protection offers a strong first-line defense by preventing deceptive messages from ever reaching staff inboxes, but malicious hackers are developing new techniques to evade current detection daily. Using preemptive information from Red Sky AllianceRedXray diagnostic tool, our Vessel Impersonation reports and Maritime Blacklists offer a proactive solution to stopping cyber-attacks. Recent studies suggest cyber-criminals are researching their targets and tailoring emails for staff in specific roles. Another tactic is to spoof emails from the chief executive or other high-ranking maritime contemporaries in the hope staff lower down the supply chain will drop their awareness and follow the spoofed email obediently. Analysts across the industry are beginning to see maritime-specific examples of these attacks.
The more convincing an email appears, the greater the chance employees will fall for a scam. To address this residual risk, software-based protection should be treated as one constituent of a wider strategy that also encompasses the human-element as well as organizational workflows and procedures.
It is imperative to:
- Train all levels of the marine supply chain to realize they are under constant cyber-attack.
- Emphasize maintaining constant attention to real-world cyber consequences of careless cyber practices or general inattentiveness.
- Provide practical guidance on how to identify a potential phishing attempt.
- Use direct communication to verify emails and supply chain email communication.
- Use Red Sky Alliance RedXray proactive support, our Vessel impersonation information and use the Maritime Blacklists to proactively block cyber attacks from identified malicious actors.
About Red Sky Alliance
Red Sky Alliance is located in New Boston, NH. We are a Cyber Threat Analysis and Intelligence Service organization. For questions, comments or assistance, please contact the lab directly at 1-844-492-7225, or email@example.com.