Infostealers, a type of malware designed to steal sensitive information from an infected system, has marked significant rise in the first half of 2024 in the maritime domain, Marlink’s Security Operations Center (SOC) has reported.
The whole process involves six steps – starting from initial infection to the exploitation of acquired data, which can have serious consequences for the maritime industry, which relies heavily on interconnected systems and digital platforms.
The initial infection of the system occurs when a malicious file is downloaded by the victim after clicking on malvertising unwillingly while web browsing. Then, the payload executes the malicious code, using an automated script that avoids detection by security software.
The next step is the credential and data collection, when the infostealer searches the system for stored credentials and sensitive information (passwords, autofill data, cookies): web browsers, FTP clients, cryptocurrency wallets, and e-mail. The data exfiltration takes place by sending the encrypted stolen data to a remote command and control (C2) server controlled by the attacker.
The infostealer then installs persistence mechanisms to remain on the device and continue stealing information over time, as the attacker uses the stolen credentials for further attacks or selling the data on the dark web for profit.
The U.S. Coast Guard (USCG) plans to introduce new cyber security rules soon, which will have an impact on maritime and offshore energy industries.
If you are in New Orleans on November 13, 2024, sign up now for a free lunch and moderated conference discussion to learn more about the new USCG cyber security rules and their impact on the vessel owner/operators, OEMs and shipyards. Featured speakers include: