A new email phishing scam related to shipping bills and export declaration forms has recently emerged, targeting businesses involved in international trade. This scam aims to infect recipients’ computers with dangerous malware known as Remcos RAT.
In this scam, victims receive an email appearing to come from a government agency or shipping company regarding supposed issues with shipping bills or export declaration forms. The email includes an attachment that supposedly contains important paperwork to resolve the alleged issues. However, if downloaded and opened, this attachment covertly installs Remcos Remote Access Trojan on the victim’s computer.
Remcos RAT allows cybercriminals to gain complete control over infected computers. They can access files, record keystrokes to steal passwords and other sensitive data, activate webcams and microphones to spy on users, and more. This gives them immense power to engage in identity theft, corporate espionage, and other damaging activities.
This article provides an in-depth examination of how the shipping bills and export declaration forms email scam operates. It outlines the scam overview, explains step-by-step how cybercriminals exploit victims, and offers advice on what to do if you have fallen prey to this scheme. Let’s dive in to better understand this threat.
This Article Contains:
The shipping bills and export declaration forms email scam is a targeted phishing attack affecting companies in the import/export industry. Phishing refers to emails crafted to appear as legitimate correspondence from a trustworthy source, with the aim of persuading recipients to share sensitive information or download malware.
This scam leverages the processes around shipping bills and export declaration forms to make recipients believe the message is urgent and requires immediate action. But in reality, it is from cybercriminals seeking to infiltrate company networks.
Anatomy of the Scam Email
The scam emails are carefully designed to convince recipients of their legitimacy. They will appear to come from government customs/revenue agencies or shipping companies and contain the agency/company logos.
Some examples of purported senders we have seen associated with this scam include:
- Customs and Revenue Department
- Directorate of Shipping
- XYZ Shipping Co.
The email subject line will be along the lines of:
- Issues Detected with Shipping Bill No. 1234567
- Problems with Export Declaration Form AWB123456789
The message will typically inform the recipient that issues or inaccuracies have been identified with a specific shipping bill or declaration form they submitted recently.
The text cites the relevant bill of lading/AWB number and claims that proper documentation must be filled again to avoid penalties, shipment delays, or other problems.
The email includes an attachment, usually a Word doc, PDF, or ZIP file, containing the paperwork to supposedly re-submit. Filenames include:
- Shipping Bill Refiling Form.doc
- Export Declaration Correction Notice.pdf
These elements lend an air of legitimacy and urgency to the scam message. But the true intent is to get recipients to open the attachment and activate the malware inside.
Examining the email headers and contents provides clues that the message is not what it seems. For instance:
- The sender email address likely comes from a free webmail provider and does not match the purported agency/company domain.
- Logos are often low-quality images copied from legitimate websites.
- Language may contain typos, grammar issues, or other signs of being written by a non-native speaker.
- The cited shipping bill or declaration form numbers are made up, not real references.
- The attachment is not a normal document type but rather contains embedded executable malware.
With technical analysis, the fraudulent nature of the email can be uncovered. However, most recipients will not scrutinize so closely before opening the attachment.
The attachments used in this scam have been found to contain the Remcos Remote Access Trojan (RAT). Once installed, Remcos RAT allows hackers to fully control the victim’s computer remotely.
- Activating webcam/mic for surveillance
- Logging keystrokes to capture sensitive data
- Downloading/uploading/deleting files
- Executing malicious programs
- Modifying system settings
- Exfiltrating passwords, contacts, and other private information
Remcos RAT represents a serious threat once activated on a device. The cybercriminals can leverage this access to infiltrate company networks, steal data, interrupt operations, and more.
Targets of the Scam
This scam predominantly targets small and medium businesses in the import/export industry. Major international companies likely have tighter email security controls that block such phishing attempts.
But smaller companies often lack the IT infrastructure and cybersecurity training to recognize red flags in scam emails. Especially if they are not versed on the processes for shipping bills and export declarations, the message may seem legitimate.
Personnel who handle logistics and documentation make prime targets. Cybercriminals hope the appearance of a customs/shipping issue will persuade these employees to open the email attachment without scrutiny.
This allows them to gain a foothold in the corporate network, putting the whole company at risk. All organizations involved in international trade should ensure proper email security and employee training to recognize phishing.
How the Scam Works
Cybercriminals employ a variety of tactics to distribute the fraudulent shipping bills and export declaration forms emails. By understanding the actions they take, we can better defend against this scam.
Stage 1 – Obtain Victim Email Addresses
The first step is compiling a list of target email addresses, typically from companies involved in importing/exporting goods.
Cybercriminals may gather these through:
- Accessing leaked/stolen company data dumps
- Scraping business directories, customs databases, shipping company client lists, etc.
- Monitoring industry forums, social media, and other public data sources
- Using email verification tools to validate addresses at targeted domains
This allows them to focus scam emails directly on personnel likely to handle logistics paperwork. Targeted phishing using real individual/company names adds to the appearance of legitimacy.
Stage 2 – Craft Fraudulent Emails
Next, the scammers compose the phishing emails using the standard format outlined previously.
Specific shipping bill and declaration form numbers are fabricated to reference each recipient company’s recent legitimate import/export activities. This makes the supposed issues appear credible and urgent.
The emails are crafted to avoid automatic spam filtering based on content, using clean text without obvious red flags. Attachments are specially packaged to bypass detection of the malware inside.
Stage 3 – Send Malicious Emails
Using the list of target email addresses, the scam messages are distributed en masse.
- Sending from spoofed email addresses matching real agencies/companies
- Making the messages come from domains with false registration info
- Adjusting transmission volume and timing to avoid spam filtering
- Taking over legitimate but poorly-secured email accounts to send from
Enable the phishing emails to effectively reach recipients’ inboxes.
Stage 4 – Recipients Open Attachment
For the scam to succeed, recipients must open the malicious attachment. Typical social engineering tactics promote this action:
- Pretending the email comes from a position of authority
- Citing urgent problems requiring the recipient’s action
- Offering a supposed simple solution to avoid negative consequences
- Embedding words/phrases to trigger emotional responses – “penalty,” “deadline,” “inspector review,” etc.
If effective, the recipient will hastily open the attached Word doc, PDF, or ZIP file, anxious to resolve the alleged issues. But this executes the Remcos RAT malware, creating the threat.
Stage 5 – Remote Access Achieved
Once installed via the attachment, Remcos RAT provides the hackers full remote access to infect the system. They can now:
- Modify software configurations
- Steal passwords, files, communications
- Install further malware
- Access connected systems on the network
With such capabilities, cybercriminals can deeply infiltrate a company’s IT infrastructure. All sensitive corporate data is now at risk.
This remote foothold is the scammers’ ultimate objective, allowing extensive identity theft, data exfiltration, and other fraud.
What to do if you have fallen victim
If your company has experienced a breach of its network security via this shipping bills/export declaration phishing scam, swift and thorough action is required to mitigate damage. Follow these steps:
Step 1: Isolate and Contain
- Immediately isolate any devices confirmed to be infected. Remove them from the network to prevent further spread.
- For any additional suspected infected systems, isolate until they can be verified malware-free. Limit access to sensitive data.
- Work systematically to confirm scope of infection. Identify which specific systems/data may have been compromised.
- Check for signs of unauthorized network activity that may indicate data exfiltration.
- Temporarily disable remote access capabilities to prevent reinfection.
Step 2: Eliminate the Threat
- On the confirmed infected devices, use antivirus scanners and anti-malware tools to remove all instances of Remcos RAT.
- Quarantine and submit malware samples to security firms/law enforcement for analysis.
- Completely wipe and reimage infected devices to factory settings after removing malware.
- Reset all account passwords and other credentials, enforce mandatory resets company-wide.
- Install OS/software security patches across all systems to fix potential vulnerabilities.
Step 3: Strengthen Security
- Update email security controls, enable stronger spam/phishing filters. Educate staff on identifying scam emails.
- Implement advanced endpoint detection and response (EDR) tools to prevent, detect, and isolate future malware threats faster.
- Review procedures around shipping bills, declarations, etc. Update to validate legitimacy before opening attachments.
- Conduct cybersecurity workforce training on the latest threats and response procedures.
- Hire external forensics experts to determine root cause and ensure all remnants of compromise are removed.
Step 4: Notify Authorities
- Alert relevant regulatory bodies related to international shipping and customs about the data breach.
- Contact law enforcement cybercrime units and report the malicious hacking activity targeting your company. Provide malware samples/forensic artifacts.
- Fully document incident details, timing, scope, containment/remediation actions, and damage assessment to support legal/regulatory investigations.
Step 5: Keep Customers Informed
- If personal information or other sensitive customer/partner data was compromised, promptly notify those individuals/organizations. Provide credit monitoring if identities may be at risk.
- Maintain transparency about the incident, your response actions, and measures taken to prevent future attacks. This upholds trust and compliance obligations.
Is Your Device Infected? Check for Malware
If your device is running slowly or acting suspicious, it may be infected with malware. Malwarebytes Anti-Malware Free is a great option for scanning your device and detecting potential malware or viruses. The free version can efficiently check for and remove many common infections.
Malwarebytes can run on Windows, Mac, and Android devices. Depending on which operating system is installed on the device you’re trying to run a Malwarebytes scan, please click on the tab below and follow the displayed steps.
Scan your computer with Malwarebytes for Windows to remove malware
Malwarebytes is one of the most popular and most used anti-malware software for Windows, and for good reasons. It is able to destroy many types of malware that other software tends to miss, without costing you absolutely nothing. When it comes to cleaning up an infected device, Malwarebytes has always been free and we recommend it as an essential tool in the fight against malware.
Download Malwarebytes for Windows.
You can download Malwarebytes by clicking the link below.MALWAREBYTES FOR WINDOWS DOWNLOAD LINK
(The above link will open a new page from where you can download Malwarebytes)
Double-click on the Malwarebytes setup file.
When Malwarebytes has finished downloading, double-click on the MBSetup file to install Malwarebytes on your computer. In most cases, downloaded files are saved to the Downloads folder.
You may be presented with a User Account Control pop-up asking if you want to allow Malwarebytes to make changes to your device. If this happens, you should click “Yes” to continue with the Malwarebytes installation.
Follow the on-screen prompts to install Malwarebytes.
When the Malwarebytes installation begins, you will see the Malwarebytes setup wizard which will guide you through the installation process. The Malwarebytes installer will first ask you what type of computer are you installing this program on, click either Personal Computer or Work Computer.
On the next screen, click “Install” to install Malwarebytes on your computer.
When your Malwarebytes installation completes, the program opens the Welcome to Malwarebytes screen.
Click on “Scan”.
Malwarebytes is now installed on your computer, to start a scan click on the “Scan” button. Malwarebytes will automatically update the antivirus database and start scanning your computer for malicious programs.
Wait for the Malwarebytes scan to complete.
Malwarebytes will now scan your computer for browser hijackers and other malicious programs. This process can take a few minutes, so we suggest you do something else and periodically check on the status of the scan to see when it is finished.
Click on “Quarantine”.
When the Malwarebytes scan is finished scanning it will show a screen that displays any malware, adware, or potentially unwanted programs that it has detected. To remove the adware and other malicious programs that Malwarebytes has found, click on the “Quarantine” button.
Malwarebytes will now remove all the malicious files and registry keys that it has found. To complete the malware removal process, Malwarebytes may ask you to restart your computer.
Your computer should now be free of trojans, adware, browser hijackers, and other malware.
If your current antivirus allowed this malicious program on your computer, you may want to consider purchasing Malwarebytes Premium to protect against these types of threats in the future.
If you are still having problems with your computer after completing these instructions, then please follow one of the steps:
Scan your computer with Malwarebytes for Mac to remove malware
Malwarebytes for Mac is an on-demand scanner that can destroy many types of malware that other software tends to miss without costing you absolutely anything. When it comes to cleaning up an infected device, Malwarebytes has always been free, and we recommend it as an essential tool in the fight against malware.
Download Malwarebytes for Mac.
You can download Malwarebytes for Mac by clicking the link below.MALWAREBYTES FOR MAC DOWNLOAD LINK
(The above link will open a new page from where you can download Malwarebytes for Mac)
Double-click on the Malwarebytes setup file.
When Malwarebytes has finished downloading, double-click on the setup file to install Malwarebytes on your computer. In most cases, downloaded files are saved to the Downloads folder.
Follow the on-screen prompts to install Malwarebytes.
When the Malwarebytes installation begins, you will see the Malwarebytes for Mac Installer which will guide you through the installation process. Click “Continue“, then keep following the prompts to continue with the installation process.
When your Malwarebytes installation completes, the program opens to the Welcome to Malwarebytes screen. Click the “Get started” button.
Select “Personal Computer” or “Work Computer”.
The Malwarebytes Welcome screen will first ask you what type of computer are you installing this program, click either Personal Computer or Work Computer.
Click on “Scan”.
To scan your computer with Malwarebytes, click on the “Scan” button. Malwarebytes for Mac will automatically update the antivirus database and start scanning your computer for malware.
Wait for the Malwarebytes scan to complete.
Malwarebytes will scan your computer for adware, browser hijackers, and other malicious programs. This process can take a few minutes, so we suggest you do something else and periodically check on the status of the scan to see when it is finished.
Click on “Quarantine”.
When the scan has been completed, you will be presented with a screen showing the malware infections that Malwarebytes has detected. To remove the malware that Malwarebytes has found, click on the “Quarantine” button.
Malwarebytes will now remove all the malicious files that it has found. To complete the malware removal process, Malwarebytes may ask you to restart your computer.
Your Mac should now be free of adware, browser hijackers, and other malware.
If your current antivirus allowed a malicious program on your computer, you might want to consider purchasing the full-featured version of Malwarebytes Anti-Malware to protect against these types of threats in the future.
If you are still experiencing problems while trying to remove a malicious program from your computer, please ask for help in our Mac Malware Removal Help & Support forum.
Scan your phone with Malwarebytes for Android to remove malware
Malwarebytes for Android automatically detects and removes dangerous threats like malware and ransomware so you don’t have to worry about your most-used device being compromised. Aggressive detection of adware and potentially unwanted programs keeps your Android phone or tablet running smooth.
Download Malwarebytes for Android.
You can download Malwarebytes for Android by clicking the link below.MALWAREBYTES FOR ANDROID DOWNLOAD LINK
(The above link will open a new page from where you can download Malwarebytes for Android)
Install Malwarebytes for Android on your phone.
In the Google Play Store, tap “Install” to install Malwarebytes for Android on your device.
When the installation process has finished, tap “Open” to begin using Malwarebytes for Android. You can also open Malwarebytes by tapping on its icon in your phone menu or home screen.
Follow the on-screen prompts to complete the setup process
When Malwarebytes will open, you will see the Malwarebytes Setup Wizard which will guide you through a series of permissions and other setup options.
This is the first of two screens that explain the difference between the Premium and Free versions. Swipe this screen to continue.
Tap on “Got it” to proceed to the next step.
Malwarebytes for Android will now ask for a set of permissions that are required to scan your device and protect it from malware. Tap on “Give permission” to continue.
Tap on “Allow” to permit Malwarebytes to access the files on your phone.
Update database and run a scan with Malwarebytes for Android
You will now be prompted to update the Malwarebytes database and run a full system scan.
Click on “Update database” to update the Malwarebytes for Android definitions to the latest version, then click on “Run full scan” to perform a system scan.
Wait for the Malwarebytes scan to complete.
Malwarebytes will now start scanning your phone for adware and other malicious apps. This process can take a few minutes, so we suggest you do something else and periodically check on the status of the scan to see when it is finished.
Click on “Remove Selected”.
When the scan has been completed, you will be presented with a screen showing the malware infections that Malwarebytes for Android has detected. To remove the malicious apps that Malwarebytes has found, tap on the “Remove Selected” button.
Restart your phone.
Malwarebytes for Android will now remove all the malicious apps that it has found. To complete the malware removal process, Malwarebytes may ask you to restart your device.
Your phone should now be free of adware, browser hijackers, and other malware.
If your current antivirus allowed a malicious app on your phone, you may want to consider purchasing the full-featured version of Malwarebytes to protect against these types of threats in the future.
If you are still having problems with your phone after completing these instructions, then please follow one of the steps:
- Restore your phone to factory settings by going to Settings > General management > Reset > Factory data reset.
- Ask for help in our Mobile Malware Removal Help & Support forum.
Frequently Asked Questions
What is the Shipping Bills & Export Declaration Form scam?
This is a phishing scam where emails pretending to come from government agencies or shipping companies claim there are issues with a company’s shipping bills or export declaration forms. The emails contain malware attachments that infect recipients’ computers if opened.
What is the malware used in this scam?
The attachments in this scam have been found to contain a Remote Access Trojan (RAT) called Remcos. This allows hackers to remotely control infected computers, steal data, install more malware, and infiltrate connected networks.
How do the scam emails reach recipients?
Cybercriminals use stolen data and public sources to obtain email addresses at targeted import/export companies. The scam emails are carefully crafted to bypass spam filters and seem urgent and legitimate to recipients.
What techniques do scammers use in the emails?
The emails contain fabricated shipping/export numbers to reference the recipient’s activities, official logos, and urgency cues using terms like “penalty,” “deadline,” etc. to persuade recipients to open attachments quickly.
Who is being targeted by this scam?
Small and medium import/export businesses are prime targets, especially personnel who handle shipping documentation. Larger companies often have security controls that block such phishing attempts.
What should I do if I receive one of these scam emails?
Do not open any attachments. Report the phishing attempt to your IT department. Provide the full email headers and attachment for analysis. Also alert industry organizations so they can warn others.
What if my company was infected with malware from this scam?
Immediately isolate affected devices. Eliminate the malware threat, reset all credentials, strengthen security controls, and notify legal/regulatory authorities per incident response best practices. Also inform any customers whose data may have been compromised.
How can companies protect against this scam?
Proper email security, staff phishing training, stronger spam filters, endpoint detection tools, and cybersecurity policies/procedures focused on the latest threats are key protective measures.
The shipping bills and export declaration forms phishing scam leverages familiar administrative processes to inject malware like Remcos RAT into corporate systems. Companies involved in international trade must remain vigilant for this scam and train employees to recognize warning signs in suspicious emails. If your organization unfortunately falls prey, take swift action to isolate infections, remove malware, strengthen security controls, and partner with legal/regulatory authorities to respond comprehensively. With proper awareness and precautions, the threat posed by this scam can be managed and mitigated.