“Warm Greetings” (or not) : Saudi Aramco Impersonation

Researchers at Malwarebytes warn of a phishing campaign that’s targeting the oil and gas industry by impersonating Saudi Aramco.

“The email pretends to be from Saudi Aramco, a Saudi Arabian public petroleum and natural gas company, and one of the largest companies in the world by revenue,” the researchers write. “The email asks the receiver to provide an offer for refinery renovations that requires a swift response.”

The phishing email states:

            “Dear Sir,

“Warm Greetings From Saudi Aramco.

“We request you to furnish your best, complete, exclusive and competitive techno-commercial offer to our esteemed company for the supply of below mentioned item(s) on or before 10-March-2022.

“Your offer should conform to all the specifications (FIT, FORM and FUNCTION) mentioned in our requisition including the following information:

“1. Manufacturer's Name and Country of Origin.

“2. Latest Delivery Date and Shipment Terms.

“3. Estimated Weight / Volume or Dimensions of the quoted item(s) / Final Package.

“4. Cost of attestation of documents from chamber of commerce shall be borne by the Supplier.

“5. Warranty Period.

“6. Product Specifications / Data Sheet, Drawings, and Catalog (if available)

“7. Payment Terms

“8. Partial Order acceptable or not acceptable.

“9. Offer Validity: 90 Days.

“If you need any more information, please don't hesitate to contact us. Please acknowledge the email along with the attachment (download below) and confirm your willingness to quote.”

If the user downloads the attachment and enables macros, their device will be infected with the FormBook malware.

“The attached pdf file contained an embedded Excel object,” the researchers write. “The embedded object downloaded a remote template that exploits CVE-2017-11882 to download and execute the FormBook malware. This vulnerability exists in Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 and allows an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory. If the current user is logged on with administrative user rights, this means an attacker could take control of the affected system.”

New-school security awareness training can teach your employees to recognize social engineering attacks so they can avoid falling for phishing attacks.