Gone Phishing: Hunting for Malicious Industrial-Themed Emails to Prevent Operational Technology Compromises

Written by: Daniel Kapellmann Zafra, Ken Proska, Corey Hildebrandt, Keith Lunden, Nathan Brubaker

Phishing is one of the most common techniques used to deliver malware and gain access to target networks. This is not only because of its simplicity and scalability, but also because of its efficiency in exploiting vulnerabilities in human behavior. Despite the existence of sophisticated detection tooling and security awareness of phishing techniques, defenders across all industry verticals continue to struggle to avoid phishing compromises.

Mandiant regularly observes actors spreading phishing emails that contain terminology and concepts specific to industrial sectors, such as energy, manufacturing, and water utilities. The use of industrial-themed lures and phishing emails suggests that at least in some cases, actors are tailoring their attacks to target industrial organizations. While it may appear that the objectives of these threat actors pose little risk to operational technology (OT) systems, the fast-paced nature and professionalism of their techniques have broad implications for OT defenders.

In this blog post, we analyze a dataset of over 1700 unique, industrial-themed phishing samples that were delivered to organizations worldwide in 2022. We built this dataset using a tailored collection of industrial-related keywords to hunt through millions of samples and identify phishing emails mimicking email communications from personnel operating or handling OT and industrial processes. Defenders tasked with hunting for potential industrial-targeted attacks can sift out the noise of generic phishing attempts to focus on higher-risk threats and prevent simple compromises from branching out into more impactful events that affect critical production systems.

Phishing Emails Can Facilitate Various Threat Actor Objectives

For OT asset owners, phishing is often perceived as a threat only if it comes from cyber espionage campaigns targeting operators, engineers, and industrial subject matter experts. While attention to such targeted activity is important, this hyper-focused perspective can drift attention away from other simpler, yet massively distributed and potentially impactful phishing operations.

• Phishing campaigns vary in lure complexity, tooling, volume and objectives. However, what most phishing campaigns have in common is that they reveal little context about an actor’s end objectives given that they represent the earliest stages of a mission. Seemingly simple phishing that is not necessarily targeted to specific victims can branch out into entirely different post-compromise activity, such as Business Email Compromise (BEC), ransomware deployment, espionage, data leaks, or cyber physical attacks.
• Industrial-themed phishing emails are particularly risky as they use specialized language that is common for employees that work with OT. For example, an email with the subject “bill of lading” can appeal to personnel handling maritime shipments, while an email with the subject “bill of materials (BOM)” can appeal to an engineering project manager.
• Even if the threat actor conducting a phishing campaign does not have enough expertise to cause serious damage on their own, actors often share, sell, or distribute access for other actors to use. In the case of ransomware, we have frequently observed formal affiliation models, where different actors are responsible for different portions of an operation.
• While implementing phishing mitigations is typically out of scope for OT security personnel, recognizing which compromises have the potential to escalate can help defenders prevent actors from ever reaching high-value targets such as OT systems or assets.

Reeling in One Year of Industrial-Themed Phishing Emails

One method to hunt for phishing activity that poses a higher risk to OT is to investigate the contents of the lures and emails themselves to identify jargon employed across specific industries and domains. Using a tailored list of industrial-themed keywords, Mandiant filters data to find industrial-themed phishing emails and reports our findings in weekly OT Phishing Roundups. The keyword list contains various terms including OT process terminology, original equipment manufacturers (OEMs), technical equipment, and other industrial business terms.

In this blog post we discuss our collection of 1,733 unique phishing emails from 2022 acquired by hunting across a popular malware analysis repository (See Figure 1). From our samples, we recovered 1,017 different payloads and, whenever feasible, we determined the malware associated with each sample. We note that our collection only reflects findings from a single large source and as such, is not necessarily representative of the full volume of phishing distribution. The size of the collection is limited to instances that were submitted to the malware repository we utilized. Additionally, each of the samples we analyzed could have been used against one or multiple victims across one or multiple organizations.

The number of emails identified during the year did not seem to show a clear pattern. Although we identified a significant increase in activity during March, it is possible these results from extraneous factors such as the number of submitted emails. We did not perform analysis over time to determine the possibility of seasonality.

Using Simple Malware to Catch Large Phish

Our analysis of industrial-themed phishing samples revealed a total of 34 different malware families, many of which are broadly deployed and used in various types of compromises. Actors of all motivations regularly use these tools—such as AGENTTESLA, FORMBOOK, or REMCOS—because of their effectiveness and ease to acquire at low or no cost.

While defenders may be tempted to overlook some of the readily available malware families, we identified due to their perceived simplicity or lack of novelty, such malware is often packed using techniques to evade detection and enable actors to gain a foothold and move across target networks. This can provide more sophisticated actors with access and tools necessary to move closer to OT targets while also thwarting attribution efforts due to the generic nature of the malware.

The following chart shows the most common malware we observed deployed alongside industrial-themed phishing lures (see Appendix 1 for more details about the observed malware).

• Some of the malware families we documented are fully capable backdoors that support a range of standard functions, while others fulfill only one or a couple functionalities such as credential harvesting, downloading additional resources, or data mining. For example, some families focus on credential theft, while others enable actors to directly interact with the target environment.
• These malware families are sometimes customizable and can be paired with external crypters or packers in order to evade detection from antivirus engines
• Some of this malware also includes capabilities such as video and microphone audio collection which have been available in remote access trojans (RATs) for a long time. The availability of such tooling challenges historical notions that only well-resourced threat actors have access to such comprehensive capabilities.

Industrial-Themed Phishing Emails Are Sometimes Sophisticated, Sometimes Not

We analyzed our sample of phishing emails by considering factors such as scope, scale, and complexity of a campaign, email narratives, and sophistication of the payloads, among other things. During our analysis, we observed phishing emails with different levels of sophistication. Some actors developed well-crafted content, assimilating real-life OT-themed communications, while others distributed messages with common phishing traits, such as grammatical mistakes or format errors. Some actors repurposed stolen email chains—also known as reply hijacking—using automated methods in attempts to expand victims and operations.

The vast majority of the samples demonstrated evidence of opportunistic en masse distribution, while only a small subset reflected the coordinated efforts of prolific, organized, and relatively sophisticated actors we refer to as distribution threat clusters. We did not identify any cyber espionage campaigns from this activity during this period of analysis, though we have in the past from actors such as APT1, APT3, APT10, APT17, TEMP.Isotope, Conference Crew (UNC39), UNC631, and UNC1151.

Distribution Threat Clusters: Sophisticated Phishing for Widespread Malware Deployment

A distribution threat cluster is a defined set of suspected cybercriminal activity whose primary objective is to deliver malware payloads to multiple victims. While distribution threat clusters only produced a small portion of the phishing emails we analyzed, these samples are especially risky for organizations as they open the door for follow on activity within the victim network.

Campaigns from distribution threat clusters have led to intrusions that resulted in the deployment of post-compromise ransomware. Despite its financial nature, this activity can disrupt the capability of organizations to sustain regular production flows. Some of the distribution threat clusters we observed in 2022 include:

Distribution threat clusters sometimes employ sophisticated TTPs to deliver payloads. Some common TTPs used by distribution threat clusters include:

• Frequent and fast-paced campaigns using subjects and themes that appear to reply to legitimate email chains to deliver payloads.
• Automated creation of high-quality phishing lures by, for example, using common, contemporaneous, or sensational phrases or topics.
• Use of modified or customized malware combined with heavy obfuscation or packing/encrypting of binaries.
• Use of multi-stage infection chains to deliver payloads.
• Adaptation of TTPs and infrastructure to attempt to evade detection and attribution.

Opportunistic Distribution: Low Quality Phishing for Unsuspecting Victims

Most of the phishing activity we observed across our industrial-themed phishing samples was distributed en masse. Opportunistic phishing attempts often use weaker methods that are easily detected and blocked by automated systems such as enterprise email scanning solutions or endpoint protection software. Most often, this activity is associated with common financial crime schemes such as BEC, credential phishing, money mule and shipping scams, IT remote access or individual extortion and fake blackmail.

Groups involved in opportunistic phishing typically hold no interest in specific industries or organizations. However, actors that succeed in compromising industrial victims could then take advantage by selling the access to other actors at a premium if they realize that it provides potential access to OT. Regardless of the complexity of a phishing compromise, a successful attack can help actors cross the initial borders of target networks without attracting attention.

Some examples of the TTPs in this category include:

• Attaching a payload, such as an executable, directly to an email with little or no obfuscation.
• Supplying simplistic lure content with little to no perceived relationship to the victim, often containing spelling and grammatical mistakes.
• Using freely available or off-the-shelf tools and malware payloads.

Hunting for Phishing Attempts Targeting Industrial Organizations

Both sophisticated and simple network intrusions require threat actors to identify a means of initial access, and these actors frequently turn to phishing attacks. As such, OT defenders need to reconsider how to detect and hunt for industrial-targeted phishing.

Setting up mechanisms to identify early compromises that pose a risk to OT helps defenders decrease the risk of minor threats evolving into impactful events that disrupt production processes. We suggest incorporating the following recommendations:

• Perform threat modeling in OT environments to identify users and groups with access to OT systems and resources that are high-value targets for threat actors.
• Leverage threat intelligence to learn about common initial access techniques, actor infrastructure, and ongoing campaigns targeting industrial organizations.
  • Track distribution of phishing emails and monitor your environment for related patterns including attachment names, toolmarks or phrases within document attachments or email bodies, and filenames. Pay attention to emails from untrusted entities that appeal to personnel in your field of specialization.
  • Understand which types of threat actors target your industry and gain familiarity with the TTPs they use.
• Using insights gained from threat intelligence and threat modeling, hunt within your environment to identify OT-specific phishing attempts. When feasible, deploy detection technologies in networks that are adjacent to your OT infrastructure focusing on TTPs used by the actors most likely to target your organization.
• Hunt for post-compromise indicators such as offensive tooling and evidence of privilege escalation or credential dumping that may indicate that a threat actor has evaded detection during the initial access phase.
• Establish response plans to counter instances where credentials may have been stolen – for example in the event of a data leak.

Appendix 1: Malware families deployed alongside industrial-themed phishing lures between October 2021 and September 2022