Maritime and logistics threat intelligence report — 6–12 June 2026

• Reference: TI-2026-0612-002 (public edition)
• Sector: Maritime and logistics
• Reporting period: 6–12 June 2026
• Issued: 12 June 2026 · Lead analyst: Peter Bassill · Reviewed by: SOC Duty Senior Analyst

This is the public (TLP:CLEAR) edition of an intelligence product written by the UK Cyber Defence Security Operations Centre for its clients. Observations specific to individual client environments have been removed. Clients receive the full edition, including estate-specific indicators and detection content.

1. Executive summary

This report provides an assessment of the threat landscape affecting the Maritime and Logistics sector during the period 06 Jun 2026 - 12 Jun 2026. It is intended to support security leadership and operational defenders within the vertical and is issued under TLP:CLEAR.

The maritime-and-logistics collection picture this week has been dominated by the convergence of the new no-patch network-edge defects (Cisco Catalyst SD-WAN Manager CVE-2026-20245 and Arista EOS CVE-2026-7473) with the still-current US Coast Guard MTSA Cyber Regulations compliance window. Both defects sit squarely against the SD-WAN / data-centre fabric in use across global liner operators, port community systems, freight-forwarder hubs and 3PL / 4PL platforms. The Citrix NetScaler advisories from NCSC compound exposure on the operational-technology / IT-OT bridge that regulated maritime entities increasingly depend on for remote vessel and terminal management.

Key Judgements

The following key judgements represent the lead analyst’s assessed view at the time of issue. Each is qualified by an analytic confidence rating in line with the conventions described in Section 11.

1. It is highly likely that the no-patch Cisco SD-WAN Manager (CVE-2026-20245) and Arista EOS (CVE-2026-7473) defects will be exploited against at least one global maritime or freight-forwarding operator within the next two reporting cycles, given the prevalence of both vendors in liner / port / 3PL data-centre fabrics and the absence of a vendor patch. (MEDIUM-HIGH confidence)
2. It is highly likely that organised ransomware crews - Qilin, TheGentlemen, Akira and DragonForce - will continue to treat liner shipping, port community systems and 3PL / 4PL platforms as high-value targets, with mass-encryption of ESXi clusters supporting cargo-management and terminal-operating systems remaining the principal disruption modality. (HIGH confidence)
3. It is likely that nation-state targeting of maritime and logistics infrastructure will continue in line with the broader pattern of China-, Russia- and DPRK-linked operator focus on critical-national-infrastructure adjacents, with port community systems and ship-to-shore communications as the highest-value access vectors. (MEDIUM confidence)
4. It is a realistic possibility that the convergence of the US Coast Guard MTSA Cyber Regulations and the EU NIS2 Directive will surface previously-undisclosed incidents at smaller operators within the next reporting cycle as compliance-driven reporting matures. (MEDIUM confidence)
5. It is highly likely that GPS / AIS spoofing and tampering will continue to be observed in the Black Sea, Eastern Mediterranean and Strait of Hormuz, with knock-on effects for shipping insurers and route-planning platforms used by UK-flagged operators. (HIGH confidence)

2. Sector threat landscape

The maritime-and-logistics vertical sits at the intersection of regulated critical national infrastructure, complex IT-OT integration and a sustained high-value criminal target set. The US Coast Guard's MTSA Cyber Regulations entered into force during 2026 with multiple compliance milestones falling through 2026 and 2027, formalising obligations around cyber risk assessment, incident reporting, account management and incident response for US-port-touching vessels and facilities. The EU NIS2 Directive and its UK equivalent CAF / ESF framework continue to mature, with the Department for Transport publishing supplementary maritime cyber guidance during the period.

Edge-appliance exposure continues to define the operational threat picture for the vertical. The Cisco Catalyst SD-WAN Manager defect CVE-2026-20245 (added to CISA KEV 09 June, no patch available) is the seventh SD-WAN zero-day Cisco has acknowledged in 2026; the prevalence of Cisco SD-WAN in liner data-centre, port community system and 3PL hub fabrics elevates this defect to the top of the maritime-and-logistics risk list for the reporting period. The Arista EOS tunnel-decap defect CVE-2026-7473 (no patch planned) is acutely relevant to inter-DC fabrics on which global cargo-management and terminal-operating systems depend. The Citrix NetScaler advisories from NCSC (CVE-2026-3055 / -4368) sit against the VPN concentrators commonly used to reach onboard vessel networks and remote-management consoles for cranes and gantries.

Organised criminal ransomware activity continues to treat the vertical as high-value. BreachSense's May 2026 retrospective places Qilin at 97-101 victims (fifth consecutive month at #1), TheGentlemen at 70, Akira at 64 and DragonForce at 32; cross-sector statistics indicate logistics and transportation as the third-most-targeted vertical behind manufacturing and healthcare. The ESXi-aware encryptor families used by Qilin and DragonForce specifically threaten the hypervisor estates that underpin cargo-management, dangerous-goods systems, electronic-bill-of-lading platforms and customs-broker integrations.

GPS / AIS spoofing and tampering remains a persistent operational concern in the Black Sea, Eastern Mediterranean and Strait of Hormuz; MTS-ISAC and equivalent maritime cyber sharing communities continue to circulate observed-position-deviation indicators.

3. Key threat actors

The following actors are assessed to pose the most significant threat to organisations within the named vertical during the reporting period. The profile block below should be repeated, in full, for each actor profiled. Prioritise actors for whom new or sector-relevant activity has been observed within the reporting period; established actors with no recent activity may be referenced briefly without a full profile.

Qilin (a.k.a. Agenda, Qilin.B)

• Aliases: Agenda, Qilin.B
• Suspected Origin: Russia (Russian-speaking)
• Suspected Sponsor: Criminal (RaaS)
• Primary Motivation: Financial - extortion / data theft
• Sector Targeting: Cross-sector with sustained Maritime and Logistics relevance; demonstrated targeting of liner shipping and 3PL hubs.
• Geographic Focus: Global; UK, EU, US, ANZ
• Signature TTPs: VPN-credential initial access via IABs; rapid DCSync; ESXi-aware encryptor; double-extortion with leak-site countdown
• Tooling / Malware Families: Qilin.B encryptor (Rust/Go), SystemBC, AnyDesk, Cobalt Strike, mimikatz, rclone
• Recent Activity: 97-101 victims posted in May 2026 - fifth consecutive month at top of leak-site postings (BreachSense / Check Point).
• Assessed Threat to Vertical: HIGH - Admiralty B2.
• Analytic Confidence: HIGH - multiply sourced (Check Point Research, BreachSense, Ransomware.live)

TheGentlemen

• Aliases: -
• Suspected Origin: Unattributed (likely Russian-speaking)
• Suspected Sponsor: Criminal (RaaS)
• Primary Motivation: Financial - extortion
• Sector Targeting: Cross-sector with sustained Maritime and Logistics relevance.
• Geographic Focus: Cross-sector, global
• Signature TTPs: Rapid affiliate onboarding; multi-platform encryptor (Windows / Linux / BSD / NAS); SystemBC C2
• Tooling / Malware Families: Go-based encryptor; SystemBC; partner-supplied IAB access
• Recent Activity: 70 victims posted in May 2026 - second only to Qilin (BreachSense).
• Assessed Threat to Vertical: HIGH - Admiralty B2.
• Analytic Confidence: MEDIUM-HIGH

Scattered Spider / DragonForce affiliate cluster

• Aliases: UNC3944, Octo Tempest, Muddled Libra, 0ktapus, Scatter Swine
• Suspected Origin: UK / US / English-speaking community
• Suspected Sponsor: Criminal (IAB into DragonForce / LockBit / Qilin)
• Primary Motivation: Financial - extortion via partner ransomware
• Sector Targeting: Cross-sector with sustained Maritime and Logistics relevance, particularly BPO and outsourced IT helpdesks supporting freight / 3PL operators.
• Geographic Focus: UK, US, increasing EU and outsourced helpdesks abroad
• Signature TTPs: Voice-phishing of IT helpdesks, SIM-swap, MFA fatigue, OAuth consent-phish, RMM abuse (AnyDesk / ScreenConnect)
• Tooling / Malware Families: DragonForce / LockBit / Qilin partner encryptors; ESXi mass-encryption
• Recent Activity: DragonForce 32 victims in May 2026 (down from 41 in April per BreachSense); BPO / outsourced-helpdesk pattern continues.
• Assessed Threat to Vertical: HIGH - Admiralty A2.
• Analytic Confidence: HIGH - NCSC-UK, Sophos X-Ops, CrowdStrike, Mandiant multi-sourced

UNC2891 / FIN13-adjacent transportation cluster

• Aliases: Unattributed in the open-source picture
• Suspected Origin: Mixed
• Suspected Sponsor: Criminal
• Primary Motivation: Financial - cargo-theft enablement and freight-forwarding-fraud
• Sector Targeting: Maritime and Logistics primary
• Geographic Focus: Global
• Signature TTPs: EDI / EDIFACT manipulation; BEC against freight-forwarder and customs-broker finance teams; targeted phish against bill-of-lading platforms
• Tooling / Malware Families: Commodity loaders, password-stealer families, web-shell sets against Magento and similar storefronts
• Recent Activity: Continued reporting via INTERPOL / NCA logistics-fraud channels; no specific public attribution this reporting period.
• Assessed Threat to Vertical: MEDIUM-HIGH - direct logistics relevance; Admiralty C3.
• Analytic Confidence: MEDIUM

[Repeat the profile block above for each additional threat actor. A typical monthly report will profile between two and four actors in detail; quarterly reports may profile more.]

4. Tactics, techniques and procedures

The TTPs listed below are aligned to the MITRE ATT&CK Enterprise framework and represent techniques observed in incidents affecting the vertical during the reporting period. The corresponding behaviours should be cross-referenced to the incidents listed in Section 5 and to detection logic deployed within client environments.

5. Notable incidents and campaigns

Where peer organisations are named, the source of attribution is recorded. Where peer organisations are anonymised, the description is sufficient to convey the operational lessons without identifying the affected party.

6. Vulnerabilities of concern

The vulnerabilities below are those assessed to carry the greatest material risk to the vertical at the time of issue, taking into account exploit availability, observed exploitation, the prevalence of affected products in the sector, and listing on the CISA Known Exploited Vulnerabilities catalogue. The remediation guidance should be read alongside the recommended actions in Section 9.

7. Indicators of compromise

The following indicators are provided to support detection engineering and threat hunting within client environments. Indicators are defanged in line with industry convention, and confidence ratings reflect the analyst’s assessment of the strength of the association between the indicator and the named actor or campaign. Indicators should be ingested with appropriate decay periods; high-confidence atomic indicators (hashes) generally warrant longer retention than network indicators (IPs, domains).

A machine-readable companion file in STIX 2.1 format is available on request from the lead analyst.

8. Sector risk assessment

The risk assessment below combines the threat picture established in earlier sections with an estimate of the impact each scenario would carry for a representative organisation operating in the vertical. The composite rating is intended to inform prioritisation of defensive investment and is not a substitute for an organisation-specific risk assessment.

9. Recommended defensive actions

The recommendations below are organised against the three operational pillars of Detect, Defend, and Disrupt. They are intended to be actionable within a typical client environment and should be prioritised according to the risk ratings assigned in Section 8 and the operational maturity of the receiving organisation.

Detect

Detection engineering should prioritise (a) Cisco SD-WAN Manager netadmin role activity, config-push events from non-management VLANs, and crafted file uploads; (b) Arista EOS decap-protocol-conflation via gNMI / syslog; (c) NetScaler AAA-vserver tampering and session-token reuse outside expected geographies; (d) Fortinet FortiClient EMS admin-endpoint anomaly patterns from the watchTowr PoC; (e) anomalous EDI / EDIFACT changes against cargo-management and customs-broker integration points; and (f) anomalous OAuth-consent grants against M365 tenants supporting freight-management workflows. Maintain MTS-ISAC indicator ingestion where membership is held.

Defend

Preventive priorities follow Section 6 directly: enforce mitigation-only postures for CVE-2026-20245 and CVE-2026-7473 in the absence of vendor patches - restrict netadmin role membership, ACL the SD-WAN Manager and Arista tunnel-endpoint IP, and apply Arista's per-protocol decap-group configuration; patch Fortinet FortiClient EMS to 7.4.2; apply Citrix NetScaler firmware and rotate session tokens; force Microsoft Defender MoCAMP roll-up; force Chromium update. Verify segmentation between IT and OT networks supporting TOS, dangerous-goods, electronic-bill-of-lading and gantry / crane control planes.

Disrupt

Disruption activity within client lawful authority should focus on: (i) MTS-ISAC indicator sharing with this week's IP Insights critical tail as the highest-value contribution; (ii) takedown of Magento / Mirasvit storefront credential-phish destinations through registrar-abuse channels; (iii) sector-level coordination through MTS-ISAC of any UK-attributed Scattered Spider helpdesk-phish indicators; (iv) deception deployment on logistics-themed honeypot domains modelling NetScaler VPN portals and SD-WAN Manager landing pages.

10. Forward outlook

Looking forward to the next reporting period (13-19 Jun 2026), it is likely that at least one logistics or freight-forwarding operator will publicly disclose an incident traceable to one of the Cisco SD-WAN Manager, Arista EOS, Fortinet FortiClient EMS or Citrix NetScaler vulnerabilities flagged in Section 6 (MEDIUM-HIGH confidence). Qilin and TheGentlemen are highly likely to retain their leak-site dominance. GPS / AIS spoofing is highly likely to persist in current hotspots.

Trigger conditions that would prompt revision of this outlook include: (a) public disclosure by a UK-flagged operator or UK-port-touching liner of an incident traceable to one of the flagged CVEs; (b) appearance of a Qilin, Akira or DragonForce leak-site post naming a UK port community system, 3PL hub or 4PL platform; (c) MTS-ISAC TLP:CLEAR notification of a sector-wide TOS or EDI campaign; (d) USCG Marine Safety Information Bulletin escalating beyond current MTSA Cyber Regulations guidance. The principal intelligence gap to be closed is direct visibility into MTS-ISAC TLP:CLEAR traffic for the 06-12 Jun period.

11. Analytic confidence and source reliability

Analytic confidence ratings used throughout this report express the analyst’s assessment of the strength of the evidence and reasoning underlying each judgement. HIGH indicates well-corroborated evidence drawn from multiple credible sources and a strong analytic line of reasoning; MEDIUM indicates plausibility supported by partial corroboration or sound analytic inference; LOW indicates limited evidence, single-sourcing, or significant uncertainty in the underlying data. Where confidence is LOW, the rationale is recorded in the body of the report rather than allowed to stand unexamined.

Sources cited in Section 12 are graded against the Admiralty System, which assesses source reliability on a scale of A to F and information credibility on a scale of 1 to 6. The full key is reproduced below for reference.

12. References

The numbered references below correspond to citations within the body of the report. Each entry is graded against the Admiralty System.

---

About this report

UK Cyber Defence's SOC publishes sector threat intelligence for the organisations it defends, graded against the Admiralty system and mapped to MITRE ATT&CK. This public edition is provided in good faith on the basis of sources held to be reliable at the time of issue; recipients remain responsible for how they apply it. If you would like sector briefings, indicators and detection content for your own organisation, talk to an analyst or read about SOC365, our managed SOC.