Maritime Cyber Threat Intelligence Brief

1–3. Report Overview

4. Executive Summary

• A confirmed cyberattack disrupted North Carolina Ports’ IT systems, causing a systems-wide outage and delays across Wilmington, Morehead City, and Charlotte Inland Port. Recovery actions and contingency procedures were activated. View Article Supporting Report
• Available government reporting indicates continued real-world GNSS spoofing and jamming affecting vessels, including Red Sea cases in 2026 with intermittent position jumps and AIS visibility anomalies. Government Advisory
• The Indian Register of Shipping issued fresh guidance on operational and safety risks of GNSS spoofing/jamming and cross-checking navigation data (ECDIS, radar, AIS, visual) to detect anomalies—supporting bridge procedures for resilience. Maritime Advisory
• The U.S. Coast Guard clarified that vessels in inactive status retaining valid COI/COC must maintain MTSA cybersecurity controls—highlighting risks to unattended IT/OT, remote access, vendor interfaces, and portable media during layups. MSIB 04-26
• A Royal Navy unmanned surface vessel subsystem was observed communicating with an IP in China during a cyber sweep; MoD reported no evidence of compromise. This underscores embedded component and outbound communications risks in maritime autonomy. View Article

5. Key Findings

• Confirmed cyberattack caused multi-facility operational delays at North Carolina Ports; contingency plans were activated and recovery is underway. View Article Supporting Report
• Government reporting shows ongoing GPS/GNSS spoofing and jamming affecting merchant vessels, with confirmed navigation anomalies in 2026 reports. Government Advisory
• Classification-society guidance emphasizes cross-validating ECDIS, radar, AIS, and visual fixes to detect spoofing/jamming, and outlines operational indicators and response measures for bridge teams. Maritime Advisory
• USCG MSIB 04-26 clarifies MTSA cybersecurity requirements apply to inactive vessels with valid COI/COC, stressing controls for unattended IT/OT, remote access, vendor maintenance, and portable media. MSIB 04-26
• Royal Navy unmanned surface vessel subsystem exhibited unexpected outbound communications to China; MoD reports no data compromise, highlighting supply‑chain and embedded component assurance needs. View Article

6. Maritime Threat Dashboard

7. Top Five Priority Threats

8. Maritime Operational Relevance Assessment

• Vessel navigation: Continued GNSS spoofing/jamming requires cross-checking ECDIS against radar, visual bearings, and AIS sanity checks to avoid route deviations or unsafe CPA/TCPA decisions. (Analytical synthesis; supported by USCG and IRClass advisories)
• Shipboard OT and vendor access: USCG MSIB 04-26 highlights risks during inactive periods; operators should treat layup environments as elevated risk for remote-access abuse and portable media misuse. MSIB 04-26
• Port and terminal operations: The North Carolina incident shows that enterprise IT outages can quickly cascade to gate operations, trucking queues, and berth planning. View Article
• Autonomous and defense platforms: The Royal Navy USV case underscores the need for outbound traffic control and embedded component assurance in autonomy stacks. View Article

9. Port and Terminal Cyber Activity

10. Vessel and Shipboard System Security

• Inactive vessels with valid COI/COC remain under MTSA cybersecurity requirements; operators should maintain controls over remote access, vendor maintenance, and removable media during layups. MSIB 04-26

11. Navigation, GPS, GNSS, AIS, and ECDIS Threat Watch

• Confirmed GPS/GNSS interference reports include position jumps and AIS visibility anomalies (USCG GUIDE). Government Advisory
• Bridge teams should cross-validate GNSS against radar overlays, visual bearings, parallel indexing, and terrestrial aids to detect spoofing/jamming indicators (IRClass guidance). Maritime Advisory

12. Maritime OT and ICS Assessment

• OT boundary protection: Segment crane, gate, and yard systems from enterprise IT to limit blast radius of intrusions (derived best practice; reinforced by NC Ports disruption patterns).
• Remote maintenance and vendor access: Apply allow-listing, strong authentication, and session recording for both shipboard and terminal OT connections (supported by USCG MSIB emphasis on vendor pathways).
• Logging and detection: Ensure time-synchronized logs for ECDIS, AIS, VDR, and bridge networks to support post-incident navigation forensics (derived from GNSS interference reporting).

13. Offshore Energy and Undersea Infrastructure

14. Maritime Communications and Satellite Systems

15. Maritime Supply Chain and Logistics Risks

• NC Ports disruptions produced gate delays and potential trucking backlogs, illustrating rapid logistics knock-on effects from port IT outages. View Article

16. Threat Actor and Campaign Activity

17. Vulnerability and CVE Watch

18. Affected Vendors and Technologies

• Kraken Unmanned Surface Vessel subsystem (unexpected outbound communications). Source
• Navigation systems and sensors: GNSS, ECDIS, AIS, radar cross-checks (general resilience focus). IRClass USCG GUIDE
• Port IT/gate systems: Port authority enterprise and terminal-support systems (NC Ports incident). Source

19. Affected Maritime Sectors

• Ports and Terminals; Maritime Logistics; Commercial Shipping
• Naval and Defense; Maritime Technology (autonomous vessels)

20. TTPs and MITRE ATT&CK-Style Observations

• Exploitation of public-facing/enterprise IT leading to disruption of terminal support services (observed effect at NC Ports; technique ID not specified in sources).
• Abuse of unattended systems during inactive periods; compromise via remote access pathways; vendor/third-party access risk; portable media exposure (explicit in USCG MSIB 04-26).
• Unexpected outbound beaconing/heartbeat traffic from embedded components (Royal Navy USV subsystem case).
• GNSS spoofing/jamming causing loss of view/manipulation of navigation information and AIS anomalies (behavioral observation; no formal ATT&CK mapping provided by sources).

21. Safety, Environmental, and Operational Impact

• Safety-of-navigation: GNSS interference elevates risk of route deviations and close-quarters misjudgments if not promptly detected.
• Operational continuity: Port IT disruptions can rapidly impact gate throughput, truck turn times, and vessel schedules.
• Defense/autonomy: Uncontrolled outbound communications from unmanned platforms may affect mission assurance and confidentiality even absent confirmed exfiltration.

22. Regulatory and Government Advisory Watch

• USCG MSIB 04-26: Applicability of MTSA cybersecurity requirements to inactive vessels; references include 33 CFR Part 101 Subpart F, 33 CFR Subchapter H, CG-5PC Policy Letter 01-25, VSP/ASP. MSIB 04-26
• USCG Navigation Center GUIDE tool: Ongoing user reports of GPS issues, including spoofing/jamming with operational significance. GUIDE

23. Defensive Mitigation Priorities

• Exercise and validate port and terminal cyber contingency plans, including manual gate workflows; segment terminal OT from enterprise IT. Derived from incident impact Source
• Maintain MTSA-aligned cybersecurity controls during vessel inactive periods; strictly govern third‑party/vendor access; control portable media and remote pathways. MSIB 04-26
• Implement GNSS resilience procedures on the bridge: cross-verify ECDIS fixes, monitor AIS plausibility, and train for spoofing/jamming indicators and responses. IRClass Guidance USCG GUIDE
• For autonomous/unmanned platforms and sensitive shipboard subsystems, implement outbound allow‑listing, network isolation, firmware provenance checks, and continuous egress monitoring. Supporting Report

24. Next 72-Hour Maritime Cyber Outlook

• Analysts should monitor North Carolina Ports recovery operations and potential residual gate or scheduling impacts across connected logistics flows. View Article
• Continued reporting of GNSS interference is likely; vessels transiting affected regions (e.g., Red Sea) should maintain heightened navigation cross-checks and logging. USCG GUIDE
• U.S.-regulated operators with vessels in layup should verify MTSA cybersecurity compliance and vendor-access controls this week to address USCG expectations. MSIB 04-26
• There is insufficient information to determine attribution or further spread of the NC Ports incident at this time. Confidence in this outlook is medium.

25. Intelligence Event Cards

26. Source Reference Section