A phishing campaign aimed at the energy sector in Turkey used ransom emails that claim the sender has infected the recipient’s computer with RAT software. The message looks like the user mailed it to themselves. The headers show it was sent in bulk through an SMTP relay service, so no computer was compromised. A strict DMARC policy helps stop this kind of spoofing.
In 2022, ransom emails were detected that targeted company employees in the energy sector in Turkey. They relied on worry and intimidation. The attacker did not actually break into the targets’ systems. Instead, the email threatened the target directly and asked for the ransom to be paid within a short time.
The attacker claims to have infected the target’s computer with malicious RAT software. The message says the attacker has taken over the computer, the accounts stored on it and all the information in them. The target is told to pay the ransom.
An email that explains all this lands in the target’s inbox. The email appears to come from the targeted user’s own address. But the real situation is very different from what the attacker claims.
The email header shows that the sender and the receiver are the same account. The mail server used to send it, however, belongs to the domain js-hpbs.jp. The domain in question is registered to a software company in Japan.
The email’s delivery path shows each server it passed through on the way to the inbox. In this campaign, the email left from the SMTP server of the js-hpbs.jp domain. This does not match the path you would see if the attacker had really written the threat from inside the target’s mailbox.
The emails in this campaign were not sent from a computer infected with RAT software. Instead, they were sent in bulk to large audiences through an SMTP relay service. So the attacker’s real action was to send email in someone else’s name by abusing an SMTP relay service.
In summary, the campaign tries to scare the target into believing that malicious software has caused a breach. The message then asks the target to transfer the ransom to a Bitcoin account to stop the spread of the allegedly stolen information. The breach is fake.
- Target.
- Employees in the energy sector in Turkey.
- Claim in the email.
- RAT software has taken the computer and accounts.
- Actual method.
- Bulk sending through an SMTP relay service.
- Relay domain in headers.
- js-hpbs.jp.
- Demand.
- Ransom paid to a Bitcoin account.
What’s SMTP Relay Service?
Companies use an SMTP relay service to send large volumes of marketing email without running their own mail server. This keeps their own servers off blocklists.
SMTP relay abuse is also a type of phishing email spoofing. It uses the Simple Mail Transfer Protocol (SMTP) to illegally send emails on behalf of another person or organization. This is done by gaining access to an SMTP server and using it to send emails that appear to come from a different sender.
How was the energy sector in Turkey hit by SMTP relay abuse?
This type of email is usually sent in bulk to many employees at once. In the cases seen in Turkey, the email claims that malicious RAT software has taken personal information and images from the user’s computer. It then demands a ransom to stop them from being published.
In this campaign, the email appears to come from the recipient’s own address. In some cases, an email with a ransom demand is left in the inbox. It claims that the RAT software gave the attacker access to the user’s email.
This makes it look as if the user sent the email to themselves. The email also adds urgency, such as a short deadline or a warning about a security breach.
- Bulk email via relaySent to large audiences through an SMTP relay service
- Sender looks like the recipientThe message seems to come from the user
- RAT story and threatClaims the computer and accounts are taken
- Bitcoin ransom demandPay within a short time to stop release
How do you prevent SMTP relay spoofing?
The users targeted in this campaign had one thing in common. Their domains did not have a DMARC policy set to “reject”.
DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email authentication protocol. It lets domain owners decide what should happen if an email spoofs their domain.
To protect yourself from SMTP relay spoofing, learn to spot phishing emails and never respond to them. If you are unsure whether an email is genuine, contact the sender directly through a channel you already know. Also keep your anti-virus software up to date, and make sure email filtering is in place to help block suspicious emails.
Frequently Asked Questions
What was the phishing campaign against the Turkish energy sector?
Employees received emails claiming their computer was infected with RAT software and demanding a Bitcoin ransom. The claim was false.
Why does the email look like it came from the victim?
Sender and receiver show the same account, but the headers show the mail left a relay server on the js-hpbs.jp domain. The attacker abused an SMTP relay service to send it.
Should you pay the ransom?
The post says the infection claim is false, so there is nothing to pay for.
How can a company reduce this kind of spoofing?
The post notes affected domains lacked a DMARC policy set to reject. The UK NCSC says a reject policy on all domains is the best way to prevent spoofing of your email.
