Maritime and logistics threat intelligence report — 4–10 July 2026

• Reference: TI-2026-0710-002 (public edition)
• Sector: Maritime and logistics
• Reporting period: 4–10 July 2026
• Issued: 10 July 2026 · Lead analyst: Peter Bassill · Reviewed by: SOC Duty Senior Analyst

This is the public (TLP:CLEAR) edition of an intelligence product written by the UK Cyber Defence Security Operations Centre for its clients. Observations specific to individual client environments have been removed. Clients receive the full edition, including estate-specific indicators and detection content.

1. Executive summary

This report provides an assessment of the threat landscape affecting the Maritime and Logistics sector during the period 04 Jul 2026 - 10 Jul 2026. The maritime and logistics vertical is in an actively-adverse threat environment this period. The Adriatic Port Authority intrusion, attributed to Anubis with a $10m ransom demand and confirmed exfiltration of safety plans, employee records and internal communications, is the anchor event. The vertical's exposure to the FortiBleed campaign is substantial - 41.5% of the 74,000 credentials in the exposed set relate to shipping and freight organisations, with a further 31.2% attributable to offshore contractors, 10.7% to newbuild and repair yards and 6.7% to port authorities and logistics firms.

Weighting MTS-ISAC intelligence above vendor reporting, the analyst's view is that Anubis, Qilin, Akira and DragonForce are the four actors of most operational significance to the vertical over the next two reporting cycles. Anubis's use of CitrixBleed 2 exploitation, valid VPN credentials, and a broad RMM toolkit (ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, Total Software Deployment) - as documented in the NCSC advisory this period - transfers directly to the majority of UK logistics estates. Maritime cyber incident volume was already elevated in 2025 (103% year-on-year increase per SAFETY4SEA / CYTUR reporting), and the current geopolitical context around the Middle East reinforces the outlook.

Key Judgements

The following key judgements represent the lead analyst’s assessed view at the time of issue. Each is qualified by an analytic confidence rating in line with the conventions described in Section 11.

1. It is highly likely that Anubis-affiliate activity against port authorities, shipping firms and logistics operators will continue at elevated cadence over the next two reporting cycles, given the operational success of the Adriatic Port Authority intrusion this period and the NCSC advisory documenting VPN and RMM tradecraft (HIGH confidence).
2. It is highly likely that the FortiBleed credential set (74,000 credentials, 41.5% of maritime-linked logins related to shipping / freight) will be leveraged as an initial-access resource by multiple affiliate crews over the next four reporting cycles; ransomware follow-on activity is directly attested by at least 12 confirmed infections (HIGH confidence).
3. It is likely that GPS-spoofing and DDoS activity against port authority and shipping infrastructure will continue in the current Middle East geopolitical context, consistent with the NCSC advisory in force during the period (MEDIUM-HIGH confidence).
4. It is likely that CVE-2026-8451 (CitrixBleed 3 follow-on) will drive fresh Anubis and other affiliate access to logistics estates over the next two cycles given the 24-hour exploitation cadence (MEDIUM-HIGH confidence).
5. It is a realistic possibility that a UK-flagged shipping firm will publicly disclose a materially-disruptive intrusion within the next four reporting cycles (MEDIUM confidence).

2. Sector threat landscape

The maritime and logistics vertical is in an actively-adverse threat environment this period. The Adriatic Port Authority intrusion, attributed to Anubis with a $10m ransom demand and confirmed exfiltration of safety plans, employee records and internal communications, is the anchor event. The vertical's exposure to the FortiBleed campaign is substantial - 41.5% of the 74,000 credentials in the exposed set relate to shipping and freight organisations, with a further 31.2% attributable to offshore contractors, 10.7% to newbuild and repair yards and 6.7% to port authorities and logistics firms.

Weighting MTS-ISAC intelligence above vendor reporting, the analyst's view is that Anubis, Qilin, Akira and DragonForce are the four actors of most operational significance to the vertical over the next two reporting cycles. Anubis's use of CitrixBleed 2 exploitation, valid VPN credentials, and a broad RMM toolkit (ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, Total Software Deployment) - as documented in the NCSC advisory this period - transfers directly to the majority of UK logistics estates. Maritime cyber incident volume was already elevated in 2025 (103% year-on-year increase per SAFETY4SEA / CYTUR reporting), and the current geopolitical context around the Middle East reinforces the outlook.

IP Insights enrichment shows the persistent perimeter brute-force tail continuing to be dominated by dmzhost, serverion, PPTECHNOLOGY and UAB Host Baltic ranges plus F3 Netze / for-privacy.net Tor exits.

3. Key threat actors

The following actors are assessed to pose the most significant threat to organisations within the named vertical during the reporting period. The profile block below should be repeated, in full, for each actor profiled. Prioritise actors for whom new or sector-relevant activity has been observed within the reporting period; established actors with no recent activity may be referenced briefly without a full profile.

Anubis (ransomware affiliate cluster)

• Aliases: Anubis, Anubis-affiliate cluster
• Suspected Origin: Unattributed
• Suspected Sponsor: Organised criminal RaaS
• Primary Motivation: Financial (double extortion)
• Sector Targeting: Maritime and logistics, energy, professional services, transportation
• Geographic Focus: Europe (Adriatic focus) and North America
• Signature TTPs: Valid VPN credential abuse, CitrixBleed 2 (CVE-2025-5777) and 3 (CVE-2026-8451) exploitation, extensive RMM tradecraft (ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, Total Software Deployment)
• Tooling / Malware Families: Anubis ransomware, RMM tooling above, standard post-exploitation kit
• Recent Activity: Adriatic Port Authority intrusion (this period) with $10m ransom demand; subject of NCSC advisory this period covering VPN credential and RMM tradecraft
• Assessed Threat to Vertical: HIGH - directly implicated in a materially-disruptive maritime intrusion this period
• Analytic Confidence: HIGH

Qilin (a.k.a. Agenda)

• Aliases: Agenda, Qilin.B, Water Galura
• Suspected Origin: Russian-speaking (unattributed)
• Suspected Sponsor: Organised criminal RaaS
• Primary Motivation: Financial (double extortion)
• Sector Targeting: Financial services, healthcare, manufacturing, retail, professional services, logistics
• Geographic Focus: Global; UK and EU disproportionately represented in H1 2026 leak-site postings
• Signature TTPs: Initial access via brokered credentials, Check Point VPN CVE-2026-50751 exploitation, RMM abuse (AnyDesk, SplashTop), PowerShell + Rust ransomware payload; ESXi Linux variant
• Tooling / Malware Families: Qilin.B ransomware (Rust), Cobalt Strike, Rclone-to-Mega, Mimikatz, SharpHound
• Recent Activity: 1,496 leak-site victims across trailing 12 months (dominant RaaS); 78 postings in June 2026 (temporarily overtaken by The Gentlemen at 115); continued CVE-2026-50751 exploitation reported this period
• Assessed Threat to Vertical: HIGH - dominant RaaS operator across UK/EU
• Analytic Confidence: HIGH

Akira

• Aliases: Akira, Storm-1567
• Suspected Origin: Russian-speaking (unattributed)
• Suspected Sponsor: Organised criminal RaaS
• Primary Motivation: Financial (double extortion)
• Sector Targeting: Manufacturing, professional services, mid-market FS, education, hospitality, logistics
• Geographic Focus: North America and Europe; UK and Ireland heavily represented in FY26 tally
• Signature TTPs: Cisco / Citrix VPN unpatched initial access, valid credentials from IABs, weak-MFA bypass, RDP lateral movement, ESXi hypervisor targeting
• Tooling / Malware Families: Akira ransomware (Rust / C++), Megazord ESXi variant, Cobalt Strike, Mimikatz, Rclone, AnyDesk
• Recent Activity: 1,205 leak-site victims across trailing 12 months; continued mid-cycle activity through 04-10 Jul 2026 per ransomware.live
• Assessed Threat to Vertical: HIGH - direct threat to mid-market back-office ESXi estates
• Analytic Confidence: HIGH

DragonForce / Scattered Spider cluster

• Aliases: Scattered Spider, UNC3944, Octo Tempest, Muddled Libra, 0ktapus, DragonForce affiliate
• Suspected Origin: Anglophone (UK/US); further four arrests 10 Jul 2026 per NCA
• Suspected Sponsor: Organised criminal alliance / RaaS
• Primary Motivation: Financial (ransomware + data extortion)
• Sector Targeting: Retail, hospitality, telecoms, technology, real estate, manufacturing, construction, FS (payments)
• Geographic Focus: Anglophone western targets
• Signature TTPs: Voice-phishing IT service desk to reset MFA, help-desk social engineering, EDR bypass via legitimate RMM tooling, DragonForce Linux/ESXi ransomware, aggressive cloud-tenant pivot
• Tooling / Malware Families: DragonForce ransomware, Ngrok, AnyDesk, SplashTop, Impacket, Chisel
• Recent Activity: 7 leak-site postings in trailing 24h (Real Estate, Manufacturing, Construction focus); 4 additional UK arrests connected to M&S/Co-op/Harrods case 10 Jul 2026; alliance-affiliate operations continue
• Assessed Threat to Vertical: HIGH - social-engineering methodology transfers directly across verticals
• Analytic Confidence: HIGH

4. Tactics, techniques and procedures

The TTPs listed below are aligned to the MITRE ATT&CK Enterprise framework and represent techniques observed in incidents affecting the vertical during the reporting period. The corresponding behaviours should be cross-referenced to the incidents listed in Section 5 and to detection logic deployed within client environments.

5. Notable incidents and campaigns

Where peer organisations are named, the source of attribution is recorded. Where peer organisations are anonymised, the description is sufficient to convey the operational lessons without identifying the affected party.

6. Vulnerabilities of concern

The vulnerabilities below are those assessed to carry the greatest material risk to the vertical at the time of issue, taking into account exploit availability, observed exploitation, the prevalence of affected products in the sector, and listing on the CISA Known Exploited Vulnerabilities catalogue. The remediation guidance should be read alongside the recommended actions in Section 9.

7. Indicators of compromise

The following indicators are provided to support detection engineering and threat hunting within client environments. Indicators are defanged in line with industry convention, and confidence ratings reflect the analyst’s assessment of the strength of the association between the indicator and the named actor or campaign. Indicators should be ingested with appropriate decay periods; high-confidence atomic indicators (hashes) generally warrant longer retention than network indicators (IPs, domains).

A machine-readable companion file in STIX 2.1 format is available on request from the lead analyst.

8. Sector risk assessment

The risk assessment below combines the threat picture established in earlier sections with an estimate of the impact each scenario would carry for a representative organisation operating in the vertical. The composite rating is intended to inform prioritisation of defensive investment and is not a substitute for an organisation-specific risk assessment.

9. Recommended defensive actions

The recommendations below are organised against the three operational pillars of Detect, Defend, and Disrupt. They are intended to be actionable within a typical client environment and should be prioritised according to the risk ratings assigned in Section 8 and the operational maturity of the receiving organisation.

Detect

Detection engineering should prioritise CitrixBleed 3 follow-on (CVE-2026-8451) session-token replay hunts, given the Anubis-affiliate tradecraft. Hunt for the Anubis RMM toolkit (ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, Total Software Deployment) using the NCSC advisory as a signature baseline. Retain SharePoint deserialisation hunts against document-management estates that hold freight documentation, bill-of-lading records and shipping-agent files. Deploy IP Insights critical-tail block / alert lists to WAF and Entra ID Conditional Access. Establish or maintain deep-packet inspection on port-scheduling and container-manifest APIs.

Defend

Preventive priorities follow Section 6 directly. Complete Citrix NetScaler patching for CVE-2026-8451 with mandatory session invalidation. Verify residual patching against CitrixBleed 2 (CVE-2025-5777) - NCSC reporting attests to sustained exploitation of unpatched estates. Apply Ivanti Sentry patch for CVE-2026-10520 and Ivanti EPMM patch for CVE-2026-6973. Force credential rotation across any account cohort with plausible exposure to the FortiBleed credential set; enforce phishing-resistant MFA on all VPN and RMM authentication. Restrict OT / port-management VLANs from general corporate networks. Review NCSC Middle East posture advisory and implement recommended controls.

Disrupt

Disruption activity within client lawful authority should focus on: (i) sustained participation in MTS-ISAC daily indicator exchange, with this week's IP Insights critical / block tail submitted as the highest-value contributable; (ii) honeypot deployment fronting NetScaler Gateway and port-management interfaces; (iii) coordinated take-down requests to bulletproof-hosting providers (dmzhost, serverion, PPTECHNOLOGY, UAB Host Baltic) via NCSC Takedown Service where UK-hosted infrastructure is in scope; (iv) close liaison with the MTS-ISAC Adriatic incident working group and NCSC CiSP maritime channel.

10. Forward outlook

Looking forward to the next reporting period (11 Jul - 17 Jul 2026), it is likely that at least one further port authority or shipping operator will publicly disclose a materially-disruptive intrusion, given the operational success of Anubis's Adriatic activity, the size and freshness of the FortiBleed credential set, and the current Middle East geopolitical context. It is likely that CitrixBleed 3 follow-on (CVE-2026-8451) exploitation will continue against logistics NetScaler estates. Ransomware leak-site cadence from Qilin, Akira, DragonForce and The Gentlemen is expected to remain steady week-on-week.

Trigger conditions that would prompt revision of this outlook include: (a) a UK-flagged shipping firm or UK port authority publicly attributing a breach to Anubis or the FortiBleed credential set, which would warrant immediate out-of-cycle reporting; (b) an escalation in Middle East cyber-adjacent activity affecting UK-registered vessels or port infrastructure; (c) further CISA KEV additions materially affecting maritime OT or shipping-agent SaaS; (d) any confirmed intrusion against a monitored logistics client attributable to the actors profiled in Section 3.

11. Analytic confidence and source reliability

Analytic confidence ratings used throughout this report express the analyst’s assessment of the strength of the evidence and reasoning underlying each judgement. HIGH indicates well-corroborated evidence drawn from multiple credible sources and a strong analytic line of reasoning; MEDIUM indicates plausibility supported by partial corroboration or sound analytic inference; LOW indicates limited evidence, single-sourcing, or significant uncertainty in the underlying data. Where confidence is LOW, the rationale is recorded in the body of the report rather than allowed to stand unexamined.

Sources cited in Section 12 are graded against the Admiralty System, which assesses source reliability on a scale of A to F and information credibility on a scale of 1 to 6. The full key is reproduced below for reference.

12. References

The numbered references below correspond to citations within the body of the report. Each entry is graded against the Admiralty System.

---

About this report

UK Cyber Defence's SOC publishes sector threat intelligence for the organisations it defends, graded against the Admiralty system and mapped to MITRE ATT&CK. This public edition is provided in good faith on the basis of sources held to be reliable at the time of issue; recipients remain responsible for how they apply it. If you would like sector briefings, indicators and detection content for your own organisation, talk to an analyst or read about SOC365, our managed SOC.