Maritime and logistics threat intelligence report — 27 June – 3 July 2026

• Reference: TI-2026-0703-002 (public edition)
• Sector: Maritime and logistics
• Reporting period: 27 June – 3 July 2026
• Issued: 3 July 2026 · Lead analyst: Peter Bassill · Reviewed by: SOC Duty Senior Analyst

This is the public (TLP:CLEAR) edition of an intelligence product written by the UK Cyber Defence Security Operations Centre for its clients. Observations specific to individual client environments have been removed. Clients receive the full edition, including estate-specific indicators and detection content.

1. Executive summary

This report provides an assessment of the threat landscape affecting the Maritime and Logistics sector during the period 27 Jun 2026 - 03 Jul 2026. Coverage this period is dominated by the SharePoint deserialisation KEV entry (CVE-2026-45659) - operationally significant given the prevalence of SharePoint document management across shipping agents, brokers, freight forwarders and port authorities - and by continuing GNSS spoofing activity in the eastern Mediterranean, Black Sea and Persian Gulf. Ransomware activity against logistics targets remains steady, with Qilin and Akira dominant.

The perimeter tail against port and freight forwarder clients continues to be dominated by IP Insights critical-scored Tor and bulletproof-hosting infrastructure, with a moderate uptick in scripted OAuth token replay attempts against Microsoft 365 mailbox rules on freight-forwarder tenants (invoice-redirect precursor pattern).

Key Judgements

The following key judgements represent the lead analyst’s assessed view at the time of issue. Each is qualified by an analytic confidence rating in line with the conventions described in Section 11.

1. It is highly likely that CVE-2026-45659 will be exploited against unpatched SharePoint estates in ports, freight forwarders and shipping agents within the next 14 days, given the CISA KEV three-day BOD timeline (HIGH confidence).
2. It is highly likely that GNSS spoofing activity in the eastern Mediterranean, Black Sea and Strait of Hormuz will continue at current volumes, with associated operational risk to bridge navigation, ECDIS, and voyage planning systems (HIGH confidence).
3. It is likely that Qilin, Akira and DragonForce will continue to target freight forwarders, 3PL / 4PL operators, ports and shipping agents as opportunistic ransomware targets over the next two reporting cycles (HIGH confidence).
4. It is a realistic possibility that state-sponsored actors (Volt Typhoon, Salt Typhoon) will conduct pre-positioning activity against UK / EU / US maritime critical national infrastructure - ports, VTS providers, terminal operating systems - over the next quarter (MEDIUM confidence).

2. Sector threat landscape

The maritime and logistics vertical continues to sit at the intersection of information technology and operational technology, with terminal operating systems, container management systems, bridge navigation, ECDIS, cargo release and gate-in / gate-out workflows all exposed to network-borne threats.

The CVE-2026-45659 SharePoint chain is operationally significant for maritime and logistics. SharePoint is heavily deployed in shipping agents, freight forwarders and port authority back offices as the store of record for bills of lading, master service agreements, voyage-fixture files, port state control documentation, and vendor onboarding packs. The vertical also tends to run on older SharePoint releases with heavy customisation, which may complicate patching. The MTS-ISAC and Coast Guard Maritime Cyber advisories issued in the preceding quarter emphasised the need for accelerated patching of SharePoint and similar collaboration platforms in critical maritime infrastructure.

Ransomware activity against sector-adjacent targets continues at high volume - Qilin and Akira leak-site postings during the period include hospitality, healthcare and professional services victims of the shape and size typical of freight forwarders and 3PL operators. The M&S / Co-op / Harrods cluster attributable to the DragonForce / Scattered Spider cluster continues to reverberate through logistics: Co-op's ordering and logistics systems were disrupted in the original attack, with knock-on effects for rural distribution which have taken weeks to fully resolve. NCA arrests during the period reduce, but do not eliminate, the operational threat.

3. Key threat actors

The following actors are assessed to pose the most significant threat to organisations within the named vertical during the reporting period. The profile block below should be repeated, in full, for each actor profiled. Prioritise actors for whom new or sector-relevant activity has been observed within the reporting period; established actors with no recent activity may be referenced briefly without a full profile.

Qilin (a.k.a. Agenda)

• Aliases: Agenda, Qilin.B, Water Galura
• Suspected Origin: Russian-speaking (unattributed)
• Suspected Sponsor: Organised criminal RaaS
• Primary Motivation: Financial (double extortion)
• Sector Targeting: Logistics, freight forwarders, 3PL, ports, sector-adjacent professional services
• Geographic Focus: Global; heavy European exposure in H1 2026
• Signature TTPs: Initial access via IAB-brokered credentials, RMM abuse, RDP; Rust ransomware payload; ESXi Linux variant; sustained LOTL
• Tooling / Malware Families: Qilin.B ransomware, Cobalt Strike, Rclone-to-Mega, Mimikatz
• Recent Activity: Sustained cadence into July 2026 per ransomware.live; fresh Qilin posting 01 Jul
• Assessed Threat to Vertical: HIGH - dominant RaaS operator, direct threat to logistics mid-market
• Analytic Confidence: HIGH

Akira

• Aliases: Akira, Storm-1567
• Suspected Origin: Russian-speaking (unattributed)
• Suspected Sponsor: Organised criminal RaaS
• Primary Motivation: Financial (double extortion)
• Sector Targeting: Logistics, manufacturing, professional services
• Geographic Focus: North America and Europe
• Signature TTPs: Cisco VPN unpatched initial access, valid credentials from IABs, RDP lateral movement, ESXi hypervisor targeting
• Tooling / Malware Families: Akira ransomware, Megazord ESXi variant, Rclone, AnyDesk
• Recent Activity: Cumulative $244m proceeds through Q1 2026; Refinery Hotel NYC posted 01 Jul
• Assessed Threat to Vertical: HIGH - direct threat to logistics ESXi back-office estates
• Analytic Confidence: HIGH

Volt Typhoon (PRC)

• Aliases: BRONZE SILHOUETTE, Vanguard Panda, DEV-0391
• Suspected Origin: People's Republic of China
• Suspected Sponsor: Nation state (Ministry of State Security)
• Primary Motivation: Espionage / pre-positioning for disruptive attack against CNI
• Sector Targeting: Maritime critical infrastructure, ports, water, energy, transportation, communications
• Geographic Focus: US, Five Eyes and allied nations
• Signature TTPs: LOLBins, stolen valid credentials, SOHO router exploitation, prolonged persistence with minimal on-endpoint tooling, long dwell times
• Tooling / Malware Families: Minimal - reliance on native Windows binaries and stolen credentials
• Recent Activity: Continued CISA / NCSC joint advisory pressure; specific incidents against port and CNI environments referenced in AA25-239A follow-up reporting
• Assessed Threat to Vertical: MEDIUM - low volume but strategic significance for CNI-designated maritime nodes
• Analytic Confidence: MEDIUM

[Repeat the profile block above for each additional threat actor. A typical monthly report will profile between two and four actors in detail; quarterly reports may profile more.]

4. Tactics, techniques and procedures

The TTPs listed below are aligned to the MITRE ATT&CK Enterprise framework and represent techniques observed in incidents affecting the vertical during the reporting period. The corresponding behaviours should be cross-referenced to the incidents listed in Section 5 and to detection logic deployed within client environments.

5. Notable incidents and campaigns

Where peer organisations are named, the source of attribution is recorded. Where peer organisations are anonymised, the description is sufficient to convey the operational lessons without identifying the affected party.

6. Vulnerabilities of concern

The vulnerabilities below are those assessed to carry the greatest material risk to the vertical at the time of issue, taking into account exploit availability, observed exploitation, the prevalence of affected products in the sector, and listing on the CISA Known Exploited Vulnerabilities catalogue. The remediation guidance should be read alongside the recommended actions in Section 9.

7. Indicators of compromise

The following indicators are provided to support detection engineering and threat hunting within client environments. Indicators are defanged in line with industry convention, and confidence ratings reflect the analyst’s assessment of the strength of the association between the indicator and the named actor or campaign. Indicators should be ingested with appropriate decay periods; high-confidence atomic indicators (hashes) generally warrant longer retention than network indicators (IPs, domains).

A machine-readable companion file in STIX 2.1 format is available on request from the lead analyst.

8. Sector risk assessment

The risk assessment below combines the threat picture established in earlier sections with an estimate of the impact each scenario would carry for a representative organisation operating in the vertical. The composite rating is intended to inform prioritisation of defensive investment and is not a substitute for an organisation-specific risk assessment.

9. Recommended defensive actions

The recommendations below are organised against the three operational pillars of Detect, Defend, and Disrupt. They are intended to be actionable within a typical client environment and should be prioritised according to the risk ratings assigned in Section 8 and the operational maturity of the receiving organisation.

Detect

Detection engineering should treat CVE-2026-45659 as the principal hunting hypothesis for the next reporting cycle. Additionally, deploy OAuth token-replay detections against freight-forwarder Microsoft 365 tenants (impossible travel + token-anomaly correlation, particularly against Exchange Online mailbox-rule creation events - the invoice-redirect precursor pattern). For clients with maritime OT scope, extend the hunt to detection of unexpected AIS / VDR / ECDIS communications from IT segments to the OT VLAN (indicative of pivot from IT compromise into bridge / VTS environments).

Defend

Preventive priorities follow Section 6 directly. Complete SharePoint patching by 04 Jul, escalate residual estates to priority remediation. Complete NetScaler patching and run the session-invalidation commands. For OT-adjacent maritime clients, verify network segmentation between IT SharePoint / M365 estates and any TOS, bridge-management or gate-control environment. Enforce phishing-resistant MFA on all M365 accounts with mailbox-rule creation authority, particularly in freight-forwarder finance and accounts-payable teams. Review GNSS resilience: dual-source position (GNSS + inertial + terrestrial), position cross-check on ECDIS, and analyst awareness of MTS-ISAC and Coast Guard GNSS-anomaly reports.

Disrupt

10. Forward outlook

Looking forward to the next reporting period (04 Jul - 10 Jul 2026), it is likely that at least one maritime or logistics firm will publicly disclose a SharePoint-borne incident traceable to CVE-2026-45659, given the low authenticated privilege bar and the prevalence of SharePoint in the vertical. It is likely that GNSS spoofing incidents will continue at current volumes, with associated operational risk. It is likely that Qilin, Akira and DragonForce leak-site cadence will remain steady, with a moderate probability of a directly-attributed logistics victim posting during the period.

Trigger conditions that would prompt revision of this outlook include: (a) any publicly-disclosed maritime SharePoint incident attributable to CVE-2026-45659; (b) any GNSS or AIS anomaly affecting a UK-flagged or UK-owned vessel in a key waterway that warrants MAIB or Coast Guard cyber advisory; (c) any confirmed Volt Typhoon or Salt Typhoon activity against UK port or maritime CNI, which would warrant immediate out-of-cycle reporting under the NCSC / CISA joint advisory framework.

11. Analytic confidence and source reliability

Analytic confidence ratings used throughout this report express the analyst’s assessment of the strength of the evidence and reasoning underlying each judgement. HIGH indicates well-corroborated evidence drawn from multiple credible sources and a strong analytic line of reasoning; MEDIUM indicates plausibility supported by partial corroboration or sound analytic inference; LOW indicates limited evidence, single-sourcing, or significant uncertainty in the underlying data. Where confidence is LOW, the rationale is recorded in the body of the report rather than allowed to stand unexamined.

Sources cited in Section 12 are graded against the Admiralty System, which assesses source reliability on a scale of A to F and information credibility on a scale of 1 to 6. The full key is reproduced below for reference.

12. References

The numbered references below correspond to citations within the body of the report. Each entry is graded against the Admiralty System.

---

About this report

UK Cyber Defence's SOC publishes sector threat intelligence for the organisations it defends, graded against the Admiralty system and mapped to MITRE ATT&CK. This public edition is provided in good faith on the basis of sources held to be reliable at the time of issue; recipients remain responsible for how they apply it. If you would like sector briefings, indicators and detection content for your own organisation, talk to an analyst or read about SOC365, our managed SOC.