Maritime and logistics threat intelligence report — 30 May – 5 June 2026

• Reference: TI-2026-0605-002 (public edition)
• Sector: Maritime and logistics
• Reporting period: 30 May – 5 June 2026
• Issued: 5 June 2026 · Lead analyst: Peter Bassill · Reviewed by: SOC Duty Senior Analyst

This is the public (TLP:CLEAR) edition of an intelligence product written by the UK Cyber Defence Security Operations Centre for its clients. Observations specific to individual client environments have been removed. Clients receive the full edition, including estate-specific indicators and detection content.

1. Executive summary

The maritime collection picture this week is dominated by the convergence of three structural factors: continuing IT-side ransomware pressure against port operators and freight forwarders, the POSIDONIA 2026 shipping conference held 01-05 June which predictably attracted hacktivist DDoS and brand-impersonation activity, and a rising operational-technology threat picture against vessel and shore-side OT. CYTUR's industry data placed maritime cyber incidents at +103% year-on-year through 2025, with DDoS, ransomware and malware infections accounting for the majority of growth, and GPS-spoofing disruption now affecting over 40,000 vessels on a typical day.

Perimeter scrubbing was dominated by sustained SSH and Telnet brute-force pressure from the same tail of IP Insights 'critical' sources - ServeTheWorld AS (NO), Contabo (DE), Offshore LC (LU), Viettel (VN), Megacore (VN), JSC Kazakhtelecom (KZ) - none of which produced successful authentication. The wider sector continues to absorb sustained Qilin and Akira interest, with Akira specifically flagged by the Maritime Transportation System ISAC (MTS-ISAC) as a continuing pattern against port operators and shipping agents.

Key Judgements

The following key judgements represent the lead analyst’s assessed view at the time of issue. Each is qualified by an analytic confidence rating in line with the conventions described in Section 11.

1. It is highly likely that ransomware deployment against UK and EU port operators, freight forwarders and shipping agents will continue at the elevated 2026 cadence, with Qilin, Akira and TheGentlemen as the dominant threats. (HIGH confidence)
2. It is likely that hacktivist DDoS against POSIDONIA 2026 exhibitors and sponsors - running 01-05 June in Athens - will produce at least one brand-impersonation or credential-harvest campaign in the next reporting cycle as event-attendee data is operationalised. (MEDIUM confidence)
3. It is highly likely that GPS-spoofing disruption will continue to affect commercial shipping in the Eastern Mediterranean, Black Sea and Persian Gulf at the ~1,000 incidents/day cadence observed through 2025, with hybrid-warfare attribution remaining the dominant analytic line. (HIGH confidence)
4. It is likely that CVE-2026-35616 (Fortinet FortiClient EMS) will be exploited against maritime IT estates over the next two reporting cycles, given the prevalence of Fortinet at terminal-management and shore-side IT layers. (MEDIUM-HIGH confidence)
5. It is a realistic possibility that the IACS UR E26/E27 cyber-security requirements coming into effect for ships delivered from 01 July 2024 will produce a wave of compliance-driven disclosure during 2026, with knock-on demand for managed-SOC services from owners and operators. (MEDIUM confidence)

2. Sector threat landscape

The maritime threat picture is structurally different from other verticals in that the same threat actor will routinely operate against both IT (port-operator ERP, freight-forwarder customer portals, agent booking systems) and OT (vessel-side navigation, communications, cargo-management) targets. Industrial Cyber's reporting of CYTUR data places maritime incidents at +103% year-on-year through 2025, with the average cost per attack now in excess of USD 550,000. Average ransomware victim-counts from May 2026 (BreachSense) place maritime and transportation in the top six sub-sectors by leak-site posting volume.

Edge-appliance exposure at shore-side IT is the dominant near-term concern. The Microsoft Exchange OWA crafted-email primitive (CVE-2026-42897) remains relevant to ship-broker and freight-forwarder mailbox estates still operating on-prem Exchange.

Hacktivist activity around POSIDONIA 2026, held 01-05 June in Athens with digitalisation and maritime security as flagship agenda items, has predictably included DDoS against exhibitor public-facing services and credential-harvest activity targeting attendees. Russian-aligned NoName057(16)-successor clusters and pro-Palestinian hacktivist coalitions continue to treat maritime targets as legitimate hybrid-warfare objectives.

OT-side risk continues to grow. Dragos and Claroty Team82 reporting through Q1 2026 places vessel-side navigation, ECDIS, voyage-data-recorder and cargo-management systems as principal OT target classes, with GPS-spoofing the most-publicised disruption mode. The IMO MSC-FAL.1/Circ.3/Rev.3 cyber-risk-management guidelines, IACS UR E26/E27 and USCG / UK MCA cyber-security requirements together define the regulatory floor for the cycle.

Perimeter pressure was dominated by familiar brute-force sources - the same NO / DE / LU / VN / KZ cluster observed across all verticals - none successful.

3. Key threat actors

The following actors are assessed to pose the most significant threat to organisations within the named vertical during the reporting period. The profile block below should be repeated, in full, for each actor profiled. Prioritise actors for whom new or sector-relevant activity has been observed within the reporting period; established actors with no recent activity may be referenced briefly without a full profile.

Qilin (a.k.a. Agenda, Qilin.B)

• Aliases: Agenda, Qilin.B
• Suspected Origin: Russia
• Suspected Sponsor: Criminal (RaaS)
• Primary Motivation: Financial - extortion / data theft
• Sector Targeting: Cross-sector with sustained Maritime & Logistics relevance.
• Geographic Focus: Global; UK, EU, US, ANZ
• Signature TTPs: VPN-credential IAB initial access; ESXi-aware encryptor; double-extortion
• Tooling / Malware Families: Qilin.B encryptor; SystemBC, AnyDesk, rclone
• Recent Activity: 101 victims posted in May 2026 - fifth consecutive month at top. Sustained maritime / logistics interest.
• Assessed Threat to Vertical: HIGH - Admiralty B2.
• Analytic Confidence: HIGH

Akira

• Aliases: -
• Suspected Origin: Russia / CIS criminal milieu
• Suspected Sponsor: Criminal (RaaS)
• Primary Motivation: Financial - extortion
• Sector Targeting: Cross-sector with sustained Maritime & Logistics relevance.
• Geographic Focus: Cross-sector, global; sustained maritime and logistics pattern
• Signature TTPs: VPN initial access (SonicWall, Cisco AnyConnect); rapid lateral via RDP; Rust encryptor
• Tooling / Malware Families: Akira / Megazord encryptors; Cobalt Strike; rclone
• Recent Activity: 52 victims posted in May 2026; H-ISAC and MTS-ISAC continuing standing advisories.
• Assessed Threat to Vertical: HIGH - Admiralty B2.
• Analytic Confidence: HIGH

NoName057(16) successor clusters

• Aliases: NoName-Aligned, RussianCyberArmy, several short-lived rebrands
• Suspected Origin: Russia (aligned)
• Suspected Sponsor: Hacktivist (state-aligned)
• Primary Motivation: Disruption / ideological
• Sector Targeting: Cross-sector with sustained Maritime & Logistics relevance.
• Geographic Focus: UK, EU, NATO partners
• Signature TTPs: Layer-7 DDoS using DDoSia-derivative tooling; brand-impersonation; sanctions-rhetoric leak claims
• Tooling / Malware Families: DDoSia, custom HTTP flood, BotenaGo derivatives
• Recent Activity: Continuing posture against UK / EU maritime targets with sanctions-regime exposure; POSIDONIA 2026 attendees plausible secondary targets.
• Assessed Threat to Vertical: MEDIUM - disruption-grade; Admiralty B2.
• Analytic Confidence: MEDIUM

4. Tactics, techniques and procedures

The TTPs listed below are aligned to the MITRE ATT&CK Enterprise framework and represent techniques observed in incidents affecting the vertical during the reporting period. The corresponding behaviours should be cross-referenced to the incidents listed in Section 5 and to detection logic deployed within client environments.

5. Notable incidents and campaigns

Where peer organisations are named, the source of attribution is recorded. Where peer organisations are anonymised, the description is sufficient to convey the operational lessons without identifying the affected party.

6. Vulnerabilities of concern

The vulnerabilities below are those assessed to carry the greatest material risk to the vertical at the time of issue, taking into account exploit availability, observed exploitation, the prevalence of affected products in the sector, and listing on the CISA Known Exploited Vulnerabilities catalogue. The remediation guidance should be read alongside the recommended actions in Section 9.

7. Indicators of compromise

The following indicators are provided to support detection engineering and threat hunting within client environments. Indicators are defanged in line with industry convention, and confidence ratings reflect the analyst’s assessment of the strength of the association between the indicator and the named actor or campaign. Indicators should be ingested with appropriate decay periods; high-confidence atomic indicators (hashes) generally warrant longer retention than network indicators (IPs, domains).

A machine-readable companion file in STIX 2.1 format is available on request from the lead analyst.

8. Sector risk assessment

The risk assessment below combines the threat picture established in earlier sections with an estimate of the impact each scenario would carry for a representative organisation operating in the vertical. The composite rating is intended to inform prioritisation of defensive investment and is not a substitute for an organisation-specific risk assessment.

9. Recommended defensive actions

The recommendations below are organised against the three operational pillars of Detect, Defend, and Disrupt. They are intended to be actionable within a typical client environment and should be prioritised according to the risk ratings assigned in Section 8 and the operational maturity of the receiving organisation.

Detect

Defend

Preventive priorities follow Section 6 directly: patch Fortinet FortiClient EMS to 7.4.2 or later; verify Emergency Directive 26-03 closure on Cisco SD-WAN; rotate any VPN admin credentials whose issue-date predates 01 February 2026; force MoCAMP 4.18.26040.1011 across shore-side endpoint estates; apply the June 2026 Android security patch via MDM to any vessel-side or pilot-station handset. Align to IMO MSC-FAL.1/Circ.3/Rev.3, IACS UR E26/E27, USCG / UK MCA cyber-security requirements, and ISO/IEC 27001 Annex A controls A.5.7 and A.8.8. For ship-broker and freight-forwarder finance functions, implement out-of-band verification of any payment-instruction change.

Disrupt

Disruption activity should focus on: (i) sustained MTS-ISAC participation and indicator exchange, with this week's IP Insights 'critical' tail submitted as the highest-value contribution; (ii) coordinated takedown of POSIDONIA brand-impersonation infrastructure through registrar-abuse and Cloudflare trust-and-safety channels; (iii) tabletop exercises around the IT/OT bridge scenario in which a ransomware deployment in shore-side IT cascades into terminal-management; and (iv) deception deployment around fake VPN endpoints and fake EMS admin tokens to gain attacker-side telemetry.

10. Forward outlook

Looking forward to the next reporting period (06 - 12 June 2026), it is likely that at least one UK or EU port operator, freight forwarder or shipping agent will be named on a Qilin, TheGentlemen or Akira leak-site posting, with MEDIUM-HIGH confidence based on the May 2026 cadence. It is highly likely that GPS-spoofing disruption will continue at the current ~1,000 vessels/day cadence in hybrid-warfare zones. It is a realistic possibility that POSIDONIA 2026 attendee-data harvested this week will resurface as targeted spear-phishing infrastructure within 30 days.

Trigger conditions that would prompt revision include: (a) public attribution of a UK port-operator ransomware incident to Akira VPN-credential exploitation; (b) MTS-ISAC TLP:CLEAR notification of a terminal-management-system compromise; (c) IMO or USCG notice of OT-side incident reportable under MSC.428(98).

11. Analytic confidence and source reliability

Analytic confidence ratings used throughout this report express the analyst’s assessment of the strength of the evidence and reasoning underlying each judgement. HIGH indicates well-corroborated evidence drawn from multiple credible sources and a strong analytic line of reasoning; MEDIUM indicates plausibility supported by partial corroboration or sound analytic inference; LOW indicates limited evidence, single-sourcing, or significant uncertainty in the underlying data. Where confidence is LOW, the rationale is recorded in the body of the report rather than allowed to stand unexamined.

Sources cited in Section 12 are graded against the Admiralty System, which assesses source reliability on a scale of A to F and information credibility on a scale of 1 to 6. The full key is reproduced below for reference.

12. References

The numbered references below correspond to citations within the body of the report. Each entry is graded against the Admiralty System.

---

About this report

UK Cyber Defence's SOC publishes sector threat intelligence for the organisations it defends, graded against the Admiralty system and mapped to MITRE ATT&CK. This public edition is provided in good faith on the basis of sources held to be reliable at the time of issue; recipients remain responsible for how they apply it. If you would like sector briefings, indicators and detection content for your own organisation, talk to an analyst or read about SOC365, our managed SOC.