A phishing campaign aimed at the energy sector in Turkey used ransom emails that claim the sender has infected the recipient’s computer with RAT software. The message looks like the user mailed it to themselves. The headers show it was sent in bulk through an SMTP relay service, so no computer was compromised. A strict DMARC policy helps stop this kind of spoofing.
Ransom emails were detected that target company employees in the energy sector in Turkey. They rely on worry and intimidation. However, the campaign does not have general characteristics such as accessing the system of the targeted people. Instead, the attacker threatens the target directly, asking for the ransom amount to be deposited within a short time.
The attacker claims to have infected the target’s computer with malicious RAT software. The message says the attacker has taken over the computer, the accounts stored on it and all the information in them. The target is told to pay the ransom. The attacker leaves a message in the target’s e-mail inbox by preparing an e-mail text explaining this situation. The email appears to come from the targeted user’s own address. But the actual situation is very different from what the attacker states in the statement.
The e-mail header shows that the sender and the receiver are the same account. The mail server used to send it, however, belongs to the domain js-hpbs.jp. The domain in question is registered under JustSystems Corporation, a software development company operating in Japan.
The e-mail transmission path shows the points through which the e-mail sent to the destination passes to the destination. In the detected campaign, it is seen that the output source of the e-mail is the SMTP server of the js-hpbs.jp domain. This does not match the header and forwarding path the attacker would have if he had really left the threatening email in the target’s inbox.
The e-mails used in this campaign are not transmitted using a computer compromised with RAT software. Still, they are delivered in bulk to large audiences using an SMTP Relay Service. Therefore, the action taken by the attacker in this scenario is sending the e-mail on behalf of someone else by abusing SMTP Relay Service.
In summary, the campaign tries to scare the target into believing that malicious software has caused a breach. The message then asks the target to transfer the ransom to a Bitcoin account to stop the spread of the allegedly stolen information. The breach is fake.
- Target
- Employees in the energy sector in Turkey
- Claim in the email
- RAT software has taken the computer and accounts
- Actual method
- Bulk sending through an SMTP relay service
- Relay domain in headers
- js-hpbs.jp
- Demand
- Ransom paid to a Bitcoin account
What’s SMTP Relay Service?
Companies use the SMTP Relay Service to send large-scale marketing emails without managing an external email server of the SMTP Relay service. Thus, email servers do not fall into a blocklist.
SMTP relay abuse is also a type of phishing email spoofing. It uses the Simple Mail Transfer Protocol (SMTP) to illegally send emails on behalf of another person or organization. This is done by gaining access to an SMTP server and using it to send emails that appear to come from a different sender.
How was the energy sector in Turkey hit by SMTP relay abuse?
This type of phishing attack is generally used to target senior executives or others who may have access to sensitive information. In the cases seen in Turkey, the email claims that malicious RAT software has taken personal information and images from the user’s computer. It then demands a ransom to stop them from being published.
The attacker usually composes an email that appears to come from a trusted source, such as the company CEO or president. In some cases, an email with a ransom demand is left in the inbox. It claims that the RAT software gave the attacker access to the user’s email. This looks like the user is sending an email to himself. The email usually contains some form of urgency, such as a request for urgent action or a warning about a security breach.
- Bulk email via relaySent to large audiences through an SMTP relay service
- Sender looks like the recipientThe message seems to come from the user
- RAT story and threatClaims the computer and accounts are taken
- Bitcoin ransom demandPay within a short time to stop release
How do you prevent SMTP relay spoofing?
Users exposed to SMTP relay spoofing have one thing in common. Their domains do not have a DMARC policy set to the “Reject” directive.
DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email authentication protocol. It lets domain owners decide what should happen if an email spoofs their domain.
In addition, to protect yourself from SMTP Relay attacks, it’s important to be aware of phishing emails and to never respond to them. If you’re unsure about the legitimacy of an email, you can always contact the sender directly to confirm its authenticity. You should also make sure that your anti-virus software is up-to-date and that you have a firewall in place to help block suspicious emails.