Investigation Reveals Targeted Spear-Phishing and BEC Campaign in Maritime Sector
A routine alert from a threat-feed regarding a specific command-and-control (C2) IP associated with RedLine Stealer quickly escalated into an extensive investigation. This in-depth inquiry unveiled an intricately crafted ecosystem dedicated to maritime spear-phishing and business email compromise (BEC) operations, revealing the evolving complexities of cyber threats.
The investigation commenced upon the identification of an entry from UniqueSignal suggesting that IP address 194[.]156.79.122:55615 was linked to RedLine’s activities. This singular indicator, when analyzed alongside targeted forensic pivots across several platforms—such as VirusTotal, FOFA, and Censys—culminated in a robust cluster of domains owned by attackers, their mail infrastructure, and delivery servers. This interconnected web was specifically aimed at South Korean maritime supply-chain targets, highlighting a narrow yet impactful cyber campaign.
The workflow undertaken by the analysts reflected a modern approach to threat intelligence. It depicted a systematic method: starting with the ingestion of a timestamped indicator of compromise (IOC) from a reputable feed, validating its relevance through sandbox runtime artifacts, and then expanding on selective fingerprints, rather than merely relying on existing blocklists.
As the investigation progressed, another confirmed C2—85[.]17.40.98:55615—came to light. Its relevance was not due to further RedLine infections but because it led to essential artifacts on VirusTotal, particularly email samples (.eml/.msg) that were directly linked to concentrated spear-phishing attempts against Kangrim Heavy Industries, a major supplier of marine and industrial boilers.
According to VMRay, UniqueSignal continuously provides fresh and unique indicators, with each entry timestamped and accompanied by contextual information. This timely data is crucial, especially as RedLine and its counterpart, META, were responsible for compromising over 64% of infostealer-infected devices in 2024. This staggering figure translates to over 451 million stolen credentials, making them a prominent threat in the cyber landscape.
The emails unearthed during the investigation were emblematic of sophisticated BEC tactics. They involved impersonating genuine maritime suppliers, employing shipment-specific pretexts, and delivering malicious payloads, including FormBook and other infostealers, concealed within attached ZIP archives.
Maritime Phishing and BEC Infrastructure
Several submissions traced back to South Korea, revealing that the sender addresses comprised both legitimate corporate domains, which were likely spoofed or compromised, and those registered specifically to imitate genuine maritime suppliers. Noteworthy among these was the domain krysegroupllc[.]online.
In this investigation, a unique fingerprint emerged, combining an unusual high port (55615), a distinct Microsoft-HTTPAPI/2.0 server banner, and a SOAPAction that pointed toward tempuri.org. This combination proved effective in unveiling additional RedLine C2s through FOFA.
The domains used for impersonation emerged as pivotal assets. While malware binaries tend to change quickly, the underlying mail-sending infrastructure and impersonation domains tend to remain stable, making them prime candidates for mitigation efforts if identified promptly.
Digging deeper into krysegroupllc[.]online revealed a consistent hosting and certificate pattern, providing further insights. Although some records were fronted by Cloudflare, additional queries through FOFA and Censys connected the domain to TheHost LLC. This connection, along with the revealed Apache/OpenSSL HTTP server banner, constituted a secondary fingerprint that proved invaluable during the investigation.
The search for this specific provider-plus-banner combination uncovered seven more fraudulent domains hosted across a limited array of IPs, displaying a pattern evident in the naming conventions of these domains—short names, “llc” suffixes, and the impersonation of well-known suppliers—confirming a strategic operator playbook centered around supply-chain impersonation and narrowly scoped BEC attempts.
This investigation has highlighted three critical operational insights for defenders in the cybersecurity space. Firstly, the significance of high-quality live feeds, such as those provided by VMRay’s UniqueSignal, cannot be overstated; the timeliness of such data enables analysts to act proactively before operators can change their infrastructure.
Secondly, implementing pivoting based on contextual artifacts, including server banners, TLS certificates, passive DNS, and file submissions, transforms isolated IOCs into clusters that provide more extensive detection and mitigation targets.
Finally, focusing on the distribution infrastructure surrounding impersonation domains, mail servers, and the hosting providers enables the establishment of enduring controls. These elements are more likely to persist beyond transient payloads, thereby enhancing longer-term cybersecurity strategies.
In conclusion, the unearthing of this tailored maritime spear-phishing and BEC ecosystem underscores the necessity for vigilant threat intelligence practices, as adversaries continually adapt and refine their tactics in the ever-evolving landscape of cyber threats.