SOC status:Duty analyst on shift
Sectors · Maritime and logistics
Vessel operators, ports and terminals, freight forwarders, hauliers and 3PLs. We watch shore-side IT and the systems that talk to operational technology, test what is exposed from the internet and the quayside, and report in terms a fleet manager understands.
IMO MSC.428(98)ISPS CodeUK MCAMTS-ISAC intelligenceOT and IT
Ransomware against port operators and logistics platforms — the Anubis intrusion at the Adriatic Port Authority, with its ten-million-dollar demand and weeks of downstream delay, among them — shows how quickly a cyber event becomes a physical one. Access usually comes through the VPN concentrators and remote-management tools used to reach vessels and remote sites, through telematics and terminal operating systems, or through phishing themed on port-community and shipping-line correspondence. GPS and GNSS spoofing at chokepoints, state interest in maritime infrastructure and the compromise of shared vendors round out the picture. Our weekly maritime and logistics report tracks the operators, the vulnerabilities in the equipment the sector actually runs, and the actions that reduce exposure without stopping operations.
What we watch for
VPN and gateway defects exploited to reach onboard networks, terminals and depots.
TOS, fleet-management and routing systems as high-impact targets for extortion.
Bridge, engine and communications systems that must be segmented and watched rather than patched.
Look-alike domains and invoice pretexts aimed at shore-side finance and operations.
Navigation interference at chokepoints; an operational indicator to coordinate with vessel masters, not an IT alert.
Shared software and service providers as the route into many operators at once.
How we help
Weekly report
The maritime and logistics picture is shaped by the follow-on impact of the North Carolina Ports cyberattack, sustained APT interest in shipping and port operators, and a 103% year-on-year rise in recorded maritime cyber incidents.
The maritime and logistics vertical continues to be shaped by the operational lessons of the Anubis intrusion of the Adriatic Port Authority (attributed January 2026, \$10m demand, \$380m of downstream supply-chain delay)…
The maritime and logistics vertical is in an actively-adverse threat environment this period. The Adriatic Port Authority intrusion, attributed to Anubis with a \$10m ransom demand and confirmed exfiltration of safety plans, employee records and internal communications, is the anchor event.
Coverage this period is dominated by the SharePoint deserialisation KEV entry (CVE-2026-45659) - operationally significant given the prevalence of SharePoint document management across shipping agents, brokers…
The dominant theme this week is exposure of OT bridge devices following CISA's 23 June addition of CVE-2025-67038 (Lantronix EDS5000 serial-to-IP code injection) to the Known Exploited Vulnerabilities catalogue - this is operationally critical to the maritime vertical because Lantronix devices are…
During the reporting period the principal observations were a ransomware compromise of the Adriatic Port Authority by the Anubis ransomware group, reported on 13 June and disrupting maritime logistics across the region…
Questions
We monitor the shore-side and cloud systems and the gateways that reach vessels and sites; for onboard OT we work with your integrators on segmentation and passive visibility rather than agents.
The IMO expects cyber risk to be addressed in the safety management system. The detection, response and testing records SOC365 produces are the evidence that it is.
Yes. Telematics, routing, warehouse systems and customer portals face the same operators; the report and the services cover logistics as well as maritime.
Start a conversation
Thirty minutes on your estate, your vendors and where an attacker would start.