Starting from a single RedLine Stealer C2 server identified at IP 194.156.79.122 on port 55615, investigators used fingerprinting tools to uncover additional C2 infrastructure related to a targeted BEC campaign. The campaign targeted South Korean maritime companies, specifically Kangrim Heavy Industries, by sending spear-phishing emails that delivered Formbook malware. Further analysis revealed seven fraudulent domains hosted on TheHost LLC infrastructure, sharing naming patterns and TLS certificates, indicating coordinated attacker-owned infrastructure. This campaign demonstrates advanced tactics combining malware deployment with social engineering to compromise maritime sector businesses.

The campaign enables attackers to compromise targeted maritime industry organizations through spear-phishing and malware delivery, potentially leading to unauthorized access, data theft, and disruption of business operations. The use of RedLine Stealer and Formbook malware suggests credential theft and information exfiltration capabilities. The impersonation of legitimate maritime supply chain companies increases the likelihood of successful compromise.

No official patch or remediation is indicated for this threat. Organizations in the maritime sector, especially those involved in South Korea, should enhance email filtering and user awareness training to recognize spear-phishing attempts. Monitoring for suspicious domains and network traffic related to known C2 infrastructure can aid detection. Since this is a targeted BEC campaign leveraging social engineering, focus on validating email authenticity and implementing multi-factor authentication where possible is recommended.