Loading story…
A network of domains hosting login pages for likely fraudulent ship classification societies has been linked to entities operating under the names Hellas Naval Bureau of Shipping (HNBS), Med Lloyd Classification Society, International Marine Services (IMS), and Olymbos Naval. The organizations present themselves as recognized bodies authorized to certify vessel safety and compliance, and some are listed as recognized organizations by maritime administrations including Cameroon, Kenya, Comoros, Tanzania, Benin, and Gambia. Shared infrastructure, overlapping subdomains, similar website designs, and common hosting indicators suggest the entities are operationally connected.
The network has been tied to vessels associated with Iranian and Russian shadow fleets, raising concerns that fraudulent certification services are being used to support maritime sanctions evasion. One cited case involved the vessel SERANO II, which Chinese maritime authorities said carried a non-compliant inspection certificate with an incorrect QR code; the Zhoushan Maritime Safety Administration said Med Lloyd Classification Society bore significant responsibility for arbitrarily issuing statutory inspection certificates that contributed to the vessel’s detention. The findings indicate cyber-enabled maritime deception is being used to help high-risk vessels obtain paperwork needed to continue operating.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
A cited April 2025 article by the Zhoushan Maritime Safety Administration said the vessel SERANO II carried a non-compliant inspection certificate with an incorrect QR code. The article stated that Med Lloyd Classification Society bore significant responsibility for arbitrarily issuing statutory inspection certificates that contributed to the vessel’s detention.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 14 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Coast Guard and FBI boarded two foreign commercial tankers in the Gulf of Mexico on August 21 and 24 after indications their networks had been compromised. Coast Guard Cyber Protection Teams and the FBI Cyber Action Team examined both vessels’ operational technology and IT environments; one potentially affected ship was identified as the Liberian-flagged *VL Prosperity*, which reportedly lost communications for more than 30 hours following an August 7 intrusion while transiting the Strait of Gibraltar from Egypt to the United States. Authorities said the incidents caused no confirmed disruption to vessel operations, instability, crew safety risk, or environmental harm, and they have not publicly attributed the activity. Investigators reportedly considered possible Iranian involvement or a group seeking to exploit U.S.-Iran tensions, while maritime agencies coordinated with stakeholders to maintain safe, uninterrupted port operations amid separate reported cyber disruption affecting North Carolina Ports.
Sep 18, 2026
A Georgia Institute of Technology study of Automatic Identification System (AIS) broadcasts from more than 367,000 vessels identified 31 persistent maritime navigation-anomaly hotspots between late November 2024 and early February 2025. Researchers found strong or corroborated evidence of coordinated, regional GPS spoofing in at least 22 locations, documenting 17,936 anomalous episodes affecting 2,663 vessels and more than 31,000 hours of physically implausible or correlated vessel movements. The activity appeared in heavily traveled waterways and showed geographic and temporal alignment with regional conflicts and sanctions, including persistent disruption in the Red Sea and Strait of Hormuz. Red Sea anomalies near Port Sudan in January 2025 resembled conditions associated with the May 2025 grounding of the container ship *MSC Antonia*. The researchers cautioned that AIS analysis cannot identify the transmitter, operator, or spoofing technology responsible and likely misses short-lived, localized, and single-vessel incidents.
Oct 2, 2026
The U.S. Treasury sanctioned two Iranian firms—**HormuzSafe Marine Services Authority** and **Persian Gulf Marine Insurance Company**—for allegedly supporting an IRGC-backed extortion scheme targeting commercial shipping in the Strait of Hormuz. Treasury said the companies sold maritime insurance that benefited or was approved by the Islamic Revolutionary Guard Corps, including coverage against vessel seizure risks created by Iran itself, and accepted digital assets such as **Bitcoin** to help evade sanctions. The action was issued under **Executive Order 13902** as part of broader pressure on Iran’s petroleum, petrochemical, and financial sectors. OFAC also sanctioned eight shipping companies in China, Hong Kong, and the Marshall Islands and blocked eight vessels tied to Iran’s shadow fleet for transporting Iranian crude and petroleum products, largely to China and in some cases the UAE. Treasury said more than 100 vessels linked to Iran’s shadow fleet have been sanctioned since the start of the year, while maritime risk reporting separately described heightened regional tensions, including increased IRGC small-boat activity in Hormuz and signs of disrupted export operations around key Iranian and regional energy shipping routes.
Jul 30, 2026