Emails Impersonating Shipping Companies Distributed as ‘Guide on Submitting Import Clearance Info’

ASEC (AhnLab Security Emergency response Center) has recently discovered malicious emails impersonating shipping companies being distributed in Korea. These emails prompt users to open the attached file with the subject ‘Submitting import clearance info’. Considering that the attached HTML’s filename starts with ‘DHL_Korea’, it can be concluded that the email is being distributed to Korean targets.

Figure 1. Original email

This disguised email has a login page in the attached HTML file. When a user logs in this page, an …

ahnlab asec center clearance companies distributed email emails emergency file filename guide html impersonating import info korea login malicious malware analysis response security shipping