Loading story…
French authorities are investigating a suspected cyberattack targeting the GNV ferry Fantastic, which operates between Sète and North Africa. The investigation was initiated after Italian intelligence, acting on information from GNV, alerted French officials about two sailors—one Latvian and one Bulgarian—suspected of espionage for a foreign power. During a search of the vessel in the port of Sète, French intelligence agents detained the two individuals and discovered a device containing RAT-type malware capable of remotely controlling the ship's navigation systems. The Latvian sailor was charged in Paris with conspiracy to serve a foreign power, attempted computer system intrusion, and possession of devices intended to interfere with navigation, while the Bulgarian was released.
GNV reported that it had identified and neutralized the attempted intrusion, stating that its systems remained protected and unaffected. The company has fully cooperated with authorities throughout the investigation, which is reportedly focusing on possible Russian involvement amid broader concerns about hybrid warfare in European waters. The vessel was temporarily sealed for safety checks but has since resumed operations. Italian police and Eurojust have also conducted searches in Latvia as part of the ongoing inquiry into whether the ship's systems were exposed to malware designed for remote hijacking.
TTPs, infrastructure, and targeting history in one profile.
9 events from the most recent confirmed update back to the earliest known activity.
In response to the incident and broader maritime cyber risk concerns, the International Association of Classification Societies introduced new cybersecurity requirements for ships. The move reflected growing concern over the exposure of digitally connected maritime systems.
By the time of later reporting, the investigation had broadened into an international probe involving French authorities, Italian counterparts, and reported coordination with Eurojust. Emergency searches and evidence seizures were carried out as investigators examined the scope of the attempted compromise.
As details emerged publicly, media reports and officials indicated the inquiry was focusing on possible foreign-state involvement, with Russia cited as a suspected actor. The case was increasingly framed as a potential example of hybrid interference targeting maritime infrastructure.
The ferry was temporarily sealed and subjected to security and safety inspections after the malware discovery and arrests. After checks were completed, the vessel was cleared to return to service.
French prosecutors formally began investigating the suspected cyberattack on the GNV Fantastic, examining whether the malware was part of foreign interference and whether it could have supported a remote hijack attempt. French and Italian authorities, including DGSI, were reported to be cooperating on the case.
Following the initial detentions, French investigators released a Bulgarian national while continuing to hold a Latvian crew member. The Latvian suspect was charged in Paris with conspiracy to infiltrate computer systems for the benefit of a foreign power.
French authorities detained two crew members of the Fantastic in Sète as part of the investigation into the malware incident. The detentions were tied to suspicions that the malware had been installed from onboard by insiders.
After being prompted by GNV, Italian intelligence alerted French authorities about two sailors on the ferry suspected of espionage or acting for a foreign power. This triggered a cross-border security response focused on the vessel while it was in France.
Grandi Navi Veloci (GNV) detected and neutralized malware on the Italian passenger ferry Fantastic before any reported operational consequences occurred. The malicious code was described as capable of enabling unauthorized remote access to onboard systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
tomshardware.com
Open sourcetechrepublic.com
Open sourcebleepingcomputer.com
Open sourcesecurityaffairs.com
Open sourceen.ilsole24ore.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Coast Guard and FBI boarded two foreign commercial tankers in the Gulf of Mexico on August 21 and 24 after indications their networks had been compromised. Coast Guard Cyber Protection Teams and the FBI Cyber Action Team examined both vessels’ operational technology and IT environments; one potentially affected ship was identified as the Liberian-flagged *VL Prosperity*, which reportedly lost communications for more than 30 hours following an August 7 intrusion while transiting the Strait of Gibraltar from Egypt to the United States. Authorities said the incidents caused no confirmed disruption to vessel operations, instability, crew safety risk, or environmental harm, and they have not publicly attributed the activity. Investigators reportedly considered possible Iranian involvement or a group seeking to exploit U.S.-Iran tensions, while maritime agencies coordinated with stakeholders to maintain safe, uninterrupted port operations amid separate reported cyber disruption affecting North Carolina Ports.
Sep 16, 2026
Finnish authorities seized a cargo ship, identified as the Fitburg, on suspicion of damaging a subsea telecommunications cable connecting Helsinki to Estonia in the Baltic Sea. The incident, which did not disrupt telecommunications services due to network redundancy, is being investigated as aggravated criminal damage and aggravated interference with telecommunications. The ship, sailing from Russia and crewed by Russian, Georgian, Kazakh, and Azerbaijani nationals, was found with its anchor lowered in the Estonian economic zone and was subsequently boarded and detained by the Finnish Border Guard in a joint operation with the Defense Forces. Responsibility for the investigation has been transferred to the Helsinki Police Department, and prosecution orders have been issued. The event has heightened concerns about the security of critical infrastructure in the region, especially amid a series of recent faults in undersea cables and ongoing suspicions of Russian sabotage. While some cable faults have been attributed to stormy weather, others remain under investigation. Telecommunications providers, including Elisa and Arelion, confirmed that their services were not impacted due to redundant connections. The incident follows a pattern of increased scrutiny and tension regarding the safety of undersea cables in the Baltic Sea, a region already on alert for potential state-sponsored sabotage activities.
Jun 29, 2026
Dutch authorities arrested two 17-year-old boys on suspicion of attempting to conduct cyber espionage on behalf of Russian interests. The arrests took place after the Dutch General Intelligence and Security Service (AIVD) provided a tip to the police, leading to the apprehension of the suspects. The teenagers were reportedly recruited via the messaging app Telegram by pro-Russian hackers, who tasked them with carrying out reconnaissance activities. Their assignment involved using a WiFi sniffer device to collect information by walking past sensitive buildings in The Hague, including the headquarters of Europol, Eurojust, and several embassies such as the Canadian embassy. WiFi sniffers are devices capable of intercepting wireless network traffic and are often used in the early stages of cyberattacks to gather intelligence on potential targets. Europol confirmed awareness of the incident and stated that there was no evidence of compromise to their systems, emphasizing the robustness of their security infrastructure. The agency is working closely with Dutch authorities to monitor and address any potential risks arising from the incident. One of the suspects was arrested at home while reportedly finishing his homework, with his parents unaware of his alleged involvement in espionage activities. The severity of the charges means that at least one of the boys will remain in custody for two weeks as the investigation continues, while the other has been released on home bail. The Dutch prosecution service cited laws regarding state-sponsored interference as the basis for the arrests but withheld further details due to the suspects' ages and the ongoing nature of the investigation. This case is seen as an escalation from previous incidents in Europe, where young people were recruited by Russian agents for acts of sabotage and vandalism rather than direct espionage. The Dutch government has recently expanded its laws against cyber-espionage, reflecting growing concerns about state-sponsored cyber activities. The incident highlights the increasing trend of minors being targeted for recruitment by foreign intelligence services through online platforms. The use of simple but effective reconnaissance tools like WiFi sniffers demonstrates the evolving tactics employed in modern espionage operations. The case has raised concerns among parents and the broader community about the risks posed by online recruitment for cyber activities. Authorities continue to investigate the full extent of the teenagers' actions and any potential connections to broader Russian cyber operations. The incident underscores the importance of vigilance and robust security measures around critical infrastructure and international organizations in the Netherlands.
Jun 29, 2026