Shipping Bill and Export Declaration Email Scam Spreads Malware

A new email phishing scam related to shipping bills and export declaration forms has recently emerged, targeting businesses involved in international trade. This scam aims to infect recipients’ computers with dangerous malware known as Remcos RAT.

In this scam, victims receive an email appearing to come from a government agency or shipping company regarding supposed issues with shipping bills or export declaration forms. The email includes an attachment that supposedly contains important paperwork to resolve the alleged issues. However, if downloaded and opened, this attachment covertly installs Remcos Remote Access Trojan on the victim’s computer.

Remcos RAT allows cybercriminals to gain complete control over infected computers. They can access files, record keystrokes to steal passwords and other sensitive data, activate webcams and microphones to spy on users, and more. This gives them immense power to engage in identity theft, corporate espionage, and other damaging activities.

This article provides an in-depth examination of how the shipping bills and export declaration forms email scam operates. It outlines the scam overview, explains step-by-step how cybercriminals exploit victims, and offers advice on what to do if you have fallen prey to this scheme. Let’s dive in to better understand this threat.

Scam Overview

The shipping bills and export declaration forms email scam is a targeted phishing attack affecting companies in the import/export industry. Phishing refers to emails crafted to appear as legitimate correspondence from a trustworthy source, with the aim of persuading recipients to share sensitive information or download malware.

This scam leverages the processes around shipping bills and export declaration forms to make recipients believe the message is urgent and requires immediate action. But in reality, it is from cybercriminals seeking to infiltrate company networks.

Anatomy of the Scam Email

The scam emails are carefully designed to convince recipients of their legitimacy. They will appear to come from government customs/revenue agencies or shipping companies and contain the agency/company logos.

Some examples of purported senders we have seen associated with this scam include:

• Customs and Revenue Department
• Directorate of Shipping
• XYZ Shipping Co.

The email subject line will be along the lines of:

• Issues Detected with Shipping Bill No. 1234567
• Problems with Export Declaration Form AWB123456789

The message will typically inform the recipient that issues or inaccuracies have been identified with a specific shipping bill or declaration form they submitted recently.

The text cites the relevant bill of lading/AWB number and claims that proper documentation must be filled again to avoid penalties, shipment delays, or other problems.

The email includes an attachment, usually a Word doc, PDF, or ZIP file, containing the paperwork to supposedly re-submit. Filenames include:

• Shipping Bill Refiling Form.doc
• Export Declaration Correction Notice.pdf
• ExportDocs_AWB123456.zip

These elements lend an air of legitimacy and urgency to the scam message. But the true intent is to get recipients to open the attachment and activate the malware inside.

Technical Analysis

Examining the email headers and contents provides clues that the message is not what it seems. For instance:

• The sender email address likely comes from a free webmail provider and does not match the purported agency/company domain.
• Logos are often low-quality images copied from legitimate websites.
• Language may contain typos, grammar issues, or other signs of being written by a non-native speaker.
• The cited shipping bill or declaration form numbers are made up, not real references.
• The attachment is not a normal document type but rather contains embedded executable malware.

With technical analysis, the fraudulent nature of the email can be uncovered. However, most recipients will not scrutinize so closely before opening the attachment.

Malware Analysis

The attachments used in this scam have been found to contain the Remcos Remote Access Trojan (RAT). Once installed, Remcos RAT allows hackers to fully control the victim’s computer remotely.

Capabilities include:

• Activating webcam/mic for surveillance
• Logging keystrokes to capture sensitive data
• Downloading/uploading/deleting files
• Executing malicious programs
• Modifying system settings
• Exfiltrating passwords, contacts, and other private information

Remcos RAT represents a serious threat once activated on a device. The cybercriminals can leverage this access to infiltrate company networks, steal data, interrupt operations, and more.

Targets of the Scam

This scam predominantly targets small and medium businesses in the import/export industry. Major international companies likely have tighter email security controls that block such phishing attempts.

But smaller companies often lack the IT infrastructure and cybersecurity training to recognize red flags in scam emails. Especially if they are not versed on the processes for shipping bills and export declarations, the message may seem legitimate.

Personnel who handle logistics and documentation make prime targets. Cybercriminals hope the appearance of a customs/shipping issue will persuade these employees to open the email attachment without scrutiny.

This allows them to gain a foothold in the corporate network, putting the whole company at risk. All organizations involved in international trade should ensure proper email security and employee training to recognize phishing.

How the Scam Works

Cybercriminals employ a variety of tactics to distribute the fraudulent shipping bills and export declaration forms emails. By understanding the actions they take, we can better defend against this scam.

Stage 1 – Obtain Victim Email Addresses

The first step is compiling a list of target email addresses, typically from companies involved in importing/exporting goods.

Cybercriminals may gather these through:

• Accessing leaked/stolen company data dumps
• Scraping business directories, customs databases, shipping company client lists, etc.
• Monitoring industry forums, social media, and other public data sources
• Using email verification tools to validate addresses at targeted domains

This allows them to focus scam emails directly on personnel likely to handle logistics paperwork. Targeted phishing using real individual/company names adds to the appearance of legitimacy.

Stage 2 – Craft Fraudulent Emails

Next, the scammers compose the phishing emails using the standard format outlined previously.

Specific shipping bill and declaration form numbers are fabricated to reference each recipient company’s recent legitimate import/export activities. This makes the supposed issues appear credible and urgent.

The emails are crafted to avoid automatic spam filtering based on content, using clean text without obvious red flags. Attachments are specially packaged to bypass detection of the malware inside.

Stage 3 – Send Malicious Emails

Using the list of target email addresses, the scam messages are distributed en masse.

Strategies like:

• Sending from spoofed email addresses matching real agencies/companies
• Making the messages come from domains with false registration info
• Adjusting transmission volume and timing to avoid spam filtering
• Taking over legitimate but poorly-secured email accounts to send from

Enable the phishing emails to effectively reach recipients’ inboxes.

Stage 4 – Recipients Open Attachment

For the scam to succeed, recipients must open the malicious attachment. Typical social engineering tactics promote this action:

• Pretending the email comes from a position of authority
• Citing urgent problems requiring the recipient’s action
• Offering a supposed simple solution to avoid negative consequences
• Embedding words/phrases to trigger emotional responses – “penalty,” “deadline,” “inspector review,” etc.

If effective, the recipient will hastily open the attached Word doc, PDF, or ZIP file, anxious to resolve the alleged issues. But this executes the Remcos RAT malware, creating the threat.

Stage 5 – Remote Access Achieved

Once installed via the attachment, Remcos RAT provides the hackers full remote access to infect the system. They can now:

• Modify software configurations
• Steal passwords, files, communications
• Install further malware
• Access connected systems on the network

With such capabilities, cybercriminals can deeply infiltrate a company’s IT infrastructure. All sensitive corporate data is now at risk.

This remote foothold is the scammers’ ultimate objective, allowing extensive identity theft, data exfiltration, and other fraud.

What to do if you have fallen victim

If your company has experienced a breach of its network security via this shipping bills/export declaration phishing scam, swift and thorough action is required to mitigate damage. Follow these steps:

Step 1: Isolate and Contain

• Immediately isolate any devices confirmed to be infected. Remove them from the network to prevent further spread.
• For any additional suspected infected systems, isolate until they can be verified malware-free. Limit access to sensitive data.
• Work systematically to confirm scope of infection. Identify which specific systems/data may have been compromised.
• Check for signs of unauthorized network activity that may indicate data exfiltration.
• Temporarily disable remote access capabilities to prevent reinfection.

Step 2: Eliminate the Threat

• On the confirmed infected devices, use antivirus scanners and anti-malware tools to remove all instances of Remcos RAT.
• Quarantine and submit malware samples to security firms/law enforcement for analysis.
• Completely wipe and reimage infected devices to factory settings after removing malware.
• Reset all account passwords and other credentials, enforce mandatory resets company-wide.
• Install OS/software security patches across all systems to fix potential vulnerabilities.

Step 3: Strengthen Security

• Update email security controls, enable stronger spam/phishing filters. Educate staff on identifying scam emails.
• Implement advanced endpoint detection and response (EDR) tools to prevent, detect, and isolate future malware threats faster.
• Review procedures around shipping bills, declarations, etc. Update to validate legitimacy before opening attachments.
• Conduct cybersecurity workforce training on the latest threats and response procedures.
• Hire external forensics experts to determine root cause and ensure all remnants of compromise are removed.

Step 4: Notify Authorities

• Alert relevant regulatory bodies related to international shipping and customs about the data breach.
• Contact law enforcement cybercrime units and report the malicious hacking activity targeting your company. Provide malware samples/forensic artifacts.
• Fully document incident details, timing, scope, containment/remediation actions, and damage assessment to support legal/regulatory investigations.

Step 5: Keep Customers Informed

• If personal information or other sensitive customer/partner data was compromised, promptly notify those individuals/organizations. Provide credit monitoring if identities may be at risk.
• Maintain transparency about the incident, your response actions, and measures taken to prevent future attacks. This upholds trust and compliance obligations.

Is Your Device Infected? Run a Free Malware Scan

Slow performance, constant pop-ups, or strange behavior? These are classic signs of a malware infection. The fastest way to find out is to scan your device with Malwarebytes Free — one of the most trusted malware removal tools available.

The free version detects and removes the most common threats, including:

• Adware — the cause of those annoying pop-ups
• Browser hijackers — unwanted redirects and changed homepages
• Trojans and spyware — hidden programs stealing your data
• Potentially unwanted programs (PUPs) — software you never asked for

👉 Select your device below — Windows, Mac, or Android — then follow the simple steps to download Malwarebytes, scan your system, and remove any threats it finds. The scan usually takes 5 to 20 minutes.

Stay Protected: Block Ads and Malicious Sites

Now that your device is clean, keep it that way. Most infections start with a malicious ad or a fake download button — so blocking them at the source is your best defense.

We recommend AdGuard, which blocks malicious ads, phishing pages, and dangerous redirects before they can reach you.

👉 Download AdGuard and browse safely

Frequently Asked Questions

What is the Shipping Bills & Export Declaration Form scam?

This is a phishing scam where emails pretending to come from government agencies or shipping companies claim there are issues with a company’s shipping bills or export declaration forms. The emails contain malware attachments that infect recipients’ computers if opened.

What is the malware used in this scam?

The attachments in this scam have been found to contain a Remote Access Trojan (RAT) called Remcos. This allows hackers to remotely control infected computers, steal data, install more malware, and infiltrate connected networks.

How do the scam emails reach recipients?

Cybercriminals use stolen data and public sources to obtain email addresses at targeted import/export companies. The scam emails are carefully crafted to bypass spam filters and seem urgent and legitimate to recipients.

What techniques do scammers use in the emails?

The emails contain fabricated shipping/export numbers to reference the recipient’s activities, official logos, and urgency cues using terms like “penalty,” “deadline,” etc. to persuade recipients to open attachments quickly.

Who is being targeted by this scam?

Small and medium import/export businesses are prime targets, especially personnel who handle shipping documentation. Larger companies often have security controls that block such phishing attempts.

What should I do if I receive one of these scam emails?

Do not open any attachments. Report the phishing attempt to your IT department. Provide the full email headers and attachment for analysis. Also alert industry organizations so they can warn others.

What if my company was infected with malware from this scam?

Immediately isolate affected devices. Eliminate the malware threat, reset all credentials, strengthen security controls, and notify legal/regulatory authorities per incident response best practices. Also inform any customers whose data may have been compromised.

How can companies protect against this scam?

Proper email security, staff phishing training, stronger spam filters, endpoint detection tools, and cybersecurity policies/procedures focused on the latest threats are key protective measures.

Conclusion

The shipping bills and export declaration forms phishing scam leverages familiar administrative processes to inject malware like Remcos RAT into corporate systems. Companies involved in international trade must remain vigilant for this scam and train employees to recognize warning signs in suspicious emails. If your organization unfortunately falls prey, take swift action to isolate infections, remove malware, strengthen security controls, and partner with legal/regulatory authorities to respond comprehensively. With proper awareness and precautions, the threat posed by this scam can be managed and mitigated.