Loki Bot campaign targets maritime industry
DarkLab intelligence analysts detected a Loki Bot phishing campaign targeting the maritime and engineering sectors in Europe, Asia and the US from spoofed email addresses of legitimate organisations in Asia.
Figure 1 – Countries of origin of phishing recipients (blue) and legitimate organisations’ spoofed addresses (red)
Recipients of phishing emails – hard to see in the map above – were also located in Singapore.
The earliest phishing email detected dates back to October 2019. However, our previous research indicates that this threat actor is using maritime themes in their phishing campaigns since at least 2018, and is linked to other malware families including Pony.
The 2019 email was sent from a likely compromised subdomain of an Indonesian company and contained a malicious archive (.rar) attachment purportedly pertaining to a purchase order, a common theme of spam emails.
Since then, the actor behind the campaign refocused their phishing lures by spoofing emails of legitimate organisations linked to the maritime industry, and by referring to vessels and other naval themes in their emails.
Figure 2 – Example of phishing email spoofing a Singapore-based shipping company
Figure 3 – Example of phishing email sent to a Switzerland-based maritime consultancy
Some phishing emails showed a good knowledge of the shipping industry, including believable details of existing ships and ports locations.
Figure 4 – Example of phishing email sent to a Japanese shipping company
Figure 4 – Example of phishing email sent to an Italian engineering contractor, purporting to be from a Chinese port authority
For instance, both vessels mentioned in the email above, Glovis Crown and Glovis Splendor, are 200m long cargo ships registered in the Marshall Islands. It remains unclear how criminals managed to obtain such details, although it seems likely that they derive from previously hijacked communications of potentially unrelated victims.
This second wave of phishing emails has been active between February and late June 2020, suggesting the campaign is likely still active.
Phishing emails switched to a malicious Microsoft Excel (.xlsx) attachment containing an exploit for CVE-2017-11882. This vulnerability in Microsoft Equation Editor lets attackers run remote code on a vulnerable machine when the victim opens a document. The exploit has been actively used by multiple cybercriminal groups due to the level of access it grants to the victim machine and the lack of user interaction needed.
Figure 5 – Screenshot of malicious xlsx attachment to email in Figure 4 [MD5: e7bb1284bf0e723b47435b0f70504b3f]
The malicious documents are downloaders for Loki Bot, an information stealer first seen in 2015. The malicious payloads observed, and additional ones found by pivoting on the attack infrastructure, are downloaded from duckdns.org subdomains likely created with domain generation algorithms (DGA).
The payload, Loki Bot, can steal credentials from browsers and email clients, among other programs, and has keylogging capabilities. The malware also sends identifying information about the victim’s hosts to a C2 to inform threat actors of the successful infection.
The current Loki Bot campaign highlights the ongoing threat of commodity malware and widespread phishing to organisations in the maritime and engineering sectors. Although the campaign exploits well-known threat vectors, lack of widespread adoption of anti-spoofing technologies like SPF and DMARC, or their incorrect implementation, means that criminals can continue sending credible phishing emails apparently from legitimate domains.
Indicators of Compromise
Emails Sender’s IP
103.253.115[.]37
Downloader Domains
russchine2specialplumbingwsdymaterialgh3.duckdns[.]org
chneswealthandorganisationstdy7joppl.duckdns[.]org
12chnesstdywealthandmoduleorganisationrn.duckdns[.]org
chnes14wealthandstdymoduleorganisationoo.duckdns[.]org
chnthreewealthsndy3andreinforcementagenc.duckdns[.]org
20chneswealthandsndymoduleorganisationvz.duckdns[.]org
chnes29sndyqudusisabadassniggainthebba.duckdns[.]org
united32wsdyfrkesokoriorimistreetsjkjd.duckdns[.]org
russchine2sndymapanxmenischangedone14ajb.duckdns[.]org
sndychnesprvlandofglorylandoflifeforle.duckdns[.]org
greenpegheedahatakankeadeshnaajaotawsdy.duckdns[.]org
sndychnesprvlandofglorylandoflifeforle.duckdns[.]org
Payloads
4ae5c9c199377980ebc558d27e7855960c69167138951378666421b9b3db09de
bcc826091ec71230947aa1916263434935a58ffe5977cf415b1d970633939652
58e0c4eef4236380167e9ea679e7885aebb5319dd0ea17365b90b5867cae7ff8
49107c228e38638d3b241bb5c4aa93ef68db20cc0c5a4157e00fc027635418bf
9ea2966982206d42cd8ad215f7a408bf7c1964134e3bef967e7bb93df6dc1f1a
b48f93828a970b7f2122b098cade1e1ab488ef557cf11ae0c44f5690f6c45185
83ba255722d5c337ce128b5e216fc1a4010849b3b4ac3e4841458d371ed757d6
Feel free to contact us at [darklab dot cti at hk dot pwc dot com] for any further information.