An investigation starting from a single RedLine Stealer C2 server (IP 194.156.79.122:55615) uncovered a complex BEC campaign targeting South Korean maritime infrastructure. Using fingerprinting tools like FOFA and VirusTotal, additional C2 infrastructure was identified. Spear-phishing emails delivered Formbook malware by impersonating maritime supply chain companies, specifically targeting Kangrim Heavy Industries. Further analysis revealed seven fraudulent domains hosted on TheHost LLC infrastructure, sharing naming patterns and TLS certificates, indicating coordinated attacker infrastructure. The campaign demonstrates advanced BEC tactics combining malware and social engineering within the maritime sector.

The campaign targets a critical maritime manufacturing company in South Korea, potentially compromising sensitive business communications and operational data through spear-phishing and malware infection. The use of Formbook malware can lead to credential theft, data exfiltration, and further network compromise. The impersonation of legitimate maritime supply chain companies increases the likelihood of successful social engineering attacks, posing significant risks to the targeted organization’s security and supply chain integrity.

No official patch or fix is applicable as this is a social engineering and malware delivery campaign. Organizations in the maritime sector, especially those in South Korea, should enhance email filtering, user awareness training focused on spear-phishing, and implement strong endpoint protection to detect and block Formbook malware. Monitoring for suspicious domain registrations and TLS certificates similar to legitimate partners can help identify fraudulent infrastructure. Incident response plans should be prepared for potential BEC and malware incidents.