Loading story…
Finnish authorities seized a cargo ship, identified as the Fitburg, on suspicion of damaging a subsea telecommunications cable connecting Helsinki to Estonia in the Baltic Sea. The incident, which did not disrupt telecommunications services due to network redundancy, is being investigated as aggravated criminal damage and aggravated interference with telecommunications. The ship, sailing from Russia and crewed by Russian, Georgian, Kazakh, and Azerbaijani nationals, was found with its anchor lowered in the Estonian economic zone and was subsequently boarded and detained by the Finnish Border Guard in a joint operation with the Defense Forces. Responsibility for the investigation has been transferred to the Helsinki Police Department, and prosecution orders have been issued.
The event has heightened concerns about the security of critical infrastructure in the region, especially amid a series of recent faults in undersea cables and ongoing suspicions of Russian sabotage. While some cable faults have been attributed to stormy weather, others remain under investigation. Telecommunications providers, including Elisa and Arelion, confirmed that their services were not impacted due to redundant connections. The incident follows a pattern of increased scrutiny and tension regarding the safety of undersea cables in the Baltic Sea, a region already on alert for potential state-sponsored sabotage activities.
See the actors and campaigns active against you right now.
5 events from the most recent confirmed update back to the earliest known activity.
By 2026-01-02, Finnish authorities had arrested two crew members of the Fitburg in connection with the suspected cable damage. Reports identified them as a Russian and an Azerbaijani national, while the rest of the multinational crew remained detained as the investigation continued.
Following the seizure of Fitburg, the Helsinki Police Department began investigating the incident as aggravated criminal damage and interference with telecommunications, with support from other Finnish security authorities. Investigators also used underwater technology and examined the ship’s equipment to determine how the cables were damaged.
On 2025-12-31, Finnish authorities seized the cargo ship Fitburg after finding it with its anchor lowered near the damaged cable route while transiting the area. The vessel, traveling from Russia toward Israel, became the main focus of a criminal investigation into the cable break.
On 2025-12-31, an undersea telecommunications cable operated by Elisa between Helsinki and Estonia was damaged in Estonia’s exclusive economic zone, and a second cable owned by Arelion was also damaged. Despite the damage, telecom services remained operational because traffic was rerouted over redundant connections.
In 2024, Finnish authorities seized the Russia-linked tanker Eagle S after it was suspected of damaging Baltic undersea infrastructure, including the EstLink 2 connection. The case later became a reference point for the Fitburg investigation, with prosecution reportedly complicated by jurisdictional issues.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
7 references tracked. Mallory keeps watching after this page renders.
tomshardware.com
Open sourcecybersecuritynews.com
Open sourcehackread.com
Open sourcetherecord.media
Open sourcetherecord.media
Open sourcegovinfosecurity.com
Open sourcebankinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Recent disruptions to undersea cables in the Red Sea, impacting internet connectivity across Asia and the Middle East, are now believed to have been caused by a ship's anchor rather than sabotage. The incident severed multiple major cables, including SEA-ME-WE-4, IMEWE, FALCON GCX, and Europe India Gateway, leading to significant slowdowns and rerouting of traffic. Repairs are expected to take weeks, with no evidence of hostile intent identified so far.
Jun 29, 2026
French authorities are investigating a suspected cyberattack targeting the GNV ferry Fantastic, which operates between Sète and North Africa. The investigation was initiated after Italian intelligence, acting on information from GNV, alerted French officials about two sailors—one Latvian and one Bulgarian—suspected of espionage for a foreign power. During a search of the vessel in the port of Sète, French intelligence agents detained the two individuals and discovered a device containing RAT-type malware capable of remotely controlling the ship's navigation systems. The Latvian sailor was charged in Paris with conspiracy to serve a foreign power, attempted computer system intrusion, and possession of devices intended to interfere with navigation, while the Bulgarian was released. GNV reported that it had identified and neutralized the attempted intrusion, stating that its systems remained protected and unaffected. The company has fully cooperated with authorities throughout the investigation, which is reportedly focusing on possible Russian involvement amid broader concerns about hybrid warfare in European waters. The vessel was temporarily sealed for safety checks but has since resumed operations. Italian police and Eurojust have also conducted searches in Latvia as part of the ongoing inquiry into whether the ship's systems were exposed to malware designed for remote hijacking.
Jun 29, 2026
European officials and industry reporting have highlighted a widening threat to critical infrastructure as cyber risks to electricity networks grow alongside military monitoring of subsea assets. An International Energy Agency assessment cited in Spanish reporting said cyberattacks on critical energy infrastructure rose 30% in 2023 to **420 million** globally, while attacks on energy service companies have quadrupled since 2020. Recent incidents include the 2022 satellite communications disruption that knocked **5,800 wind turbines** offline in Germany and breaches affecting more than 20 Danish energy companies. Authorities have also warned that compromised smart meters, solar inverters, and battery systems could be used to destabilize grid frequency or trigger broader outages. The concern extends beyond direct hacking to supply-chain and geopolitical exposure tied to digitally connected clean-energy equipment and other strategic infrastructure. European and U.S. authorities reviewed communications modules in imported solar and battery systems, while Lithuania moved to block remote access by Chinese suppliers to solar, wind, and storage control platforms. Separately, the UK said British and Norwegian forces carried out a month-long operation to track a Russian attack submarine and two GUGI-linked spy submarines near North Atlantic cables and pipelines, underscoring fears that hostile states could target the seabed networks that carry **99% of international telecommunications traffic** and support a major share of regional energy supplies.
Jun 29, 2026