Loading story…
The U.S. Coast Guard and FBI boarded two foreign commercial tankers in the Gulf of Mexico on August 21 and 24 after indications their networks had been compromised. Coast Guard Cyber Protection Teams and the FBI Cyber Action Team examined both vessels’ operational technology and IT environments; one potentially affected ship was identified as the Liberian-flagged VL Prosperity, which reportedly lost communications for more than 30 hours following an August 7 intrusion while transiting the Strait of Gibraltar from Egypt to the United States.
Authorities said the incidents caused no confirmed disruption to vessel operations, instability, crew safety risk, or environmental harm, and they have not publicly attributed the activity. Investigators reportedly considered possible Iranian involvement or a group seeking to exploit U.S.-Iran tensions, while maritime agencies coordinated with stakeholders to maintain safe, uninterrupted port operations amid separate reported cyber disruption affecting North Carolina Ports.
See the actors and campaigns active against you right now.
5 events from the most recent confirmed update back to the earliest known activity.
President Joe Biden signed a 2024 executive order granting the U.S. Coast Guard additional authority to respond to cybersecurity incidents. The order warned that maritime cyber incidents could cause cascading harm to the global supply chain.
A similar joint Coast Guard and FBI team boarded a second foreign commercial vessel in the Gulf of Mexico to investigate another suspected network compromise.
A joint U.S. Coast Guard and FBI team boarded a foreign commercial vessel in the Gulf of Mexico after indications its network had been compromised. The team examined the vessel's operational-technology and IT environments.
The Liberian-flagged VL Prosperity was reportedly targeted while sailing from Egypt to the United States through the Strait of Gibraltar, losing communications for about 30 hours. A crew member alleged that the attackers increased engine speed and disabled the vessel's fuel and engine-oil tank.
North Carolina Ports reported that an outside actor or group compromised its IT system, prompting the port authority to enact its contingency plan and move to manual operations. It contacted state agencies and the U.S. Coast Guard.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcecyberscoop.com
Open sourcebloomberg.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
French authorities are investigating a suspected cyberattack targeting the GNV ferry Fantastic, which operates between Sète and North Africa. The investigation was initiated after Italian intelligence, acting on information from GNV, alerted French officials about two sailors—one Latvian and one Bulgarian—suspected of espionage for a foreign power. During a search of the vessel in the port of Sète, French intelligence agents detained the two individuals and discovered a device containing RAT-type malware capable of remotely controlling the ship's navigation systems. The Latvian sailor was charged in Paris with conspiracy to serve a foreign power, attempted computer system intrusion, and possession of devices intended to interfere with navigation, while the Bulgarian was released. GNV reported that it had identified and neutralized the attempted intrusion, stating that its systems remained protected and unaffected. The company has fully cooperated with authorities throughout the investigation, which is reportedly focusing on possible Russian involvement amid broader concerns about hybrid warfare in European waters. The vessel was temporarily sealed for safety checks but has since resumed operations. Italian police and Eurojust have also conducted searches in Latvia as part of the ongoing inquiry into whether the ship's systems were exposed to malware designed for remote hijacking.
Jun 29, 2026
Suspected Iranian hackers breached internet-exposed automatic tank gauge (ATG) systems at gas stations in several U.S. states, reportedly targeting **Veeder-Root** `TLS-350` and `TLS-450 Plus` consoles that lacked password protection rather than exploiting a newly disclosed flaw. Advisories said incidents affected sites in Tennessee, including one convenience store chain with 15 tanks impacted, and in some cases attackers deleted fuel tank and sensor data or altered system settings. Officials said no physical damage was reported, but security experts warned that compromised ATGs could enable fuel overfills, disable safety alarms, and cause environmental or equipment damage. The intrusions come amid a broader surge in attacks on operational technology across industrial sectors. NCC Group said industrial organizations suffered **2,073 ransomware attacks** in the 12 months to March 2026, accounting for **30% of all ransomware activity**, with manufacturers of capital goods, machinery, construction, and engineering among the hardest hit. The report said many organizations still prioritize IT defenses over OT security even as governments and regulators expand resilience requirements, while international authorities have issued procurement guidance to push stronger security controls into OT products and supply chains.
Aug 7, 2026
Iran-linked threats and attacks expanded from shipping lanes to digital infrastructure across the Gulf, with reports naming **Google, Amazon, Oracle, IBM, and Nvidia** facilities in the Middle East as potential targets and describing earlier drone strikes that disrupted **AWS** operations in the UAE and Bahrain. Regional authorities later denied an IRGC claim that Oracle’s Dubai data center had been hit, but multiple reports said missile and drone attacks had already affected energy, desalination, and industrial sites in Kuwait and the UAE while raising fears for data centers and telecom assets tied to U.S. firms. The conflict’s cyber dimension also spilled into enterprise systems, with analysts warning that retaliation was increasingly aimed at civilian-adjacent technology, logistics, finance, and cloud dependencies rather than a single decisive cyberattack. At the same time, the Strait of Hormuz became a pressure point for both maritime traffic and internet connectivity. Large-scale **GPS/GNSS spoofing**, AIS suppression, dark vessel activity, and selective transit controls disrupted hundreds of ships, while repair and construction work on subsea cables slowed or stopped as security conditions deteriorated. Meta’s **2Africa/Africa2** cable project was delayed after Alcatel Submarine Networks declared force majeure, and Iran-linked media proposed licensing, taxing, and controlling undersea cable operations in the strait, with some outlets openly discussing cable disruption as leverage. Analysts warned that at least six major fiber systems crossing Hormuz underpin Gulf cloud services, finance, and trade, meaning prolonged interference or damage could delay repairs, force traffic onto riskier overland alternatives, and threaten the region’s broader digital-economy ambitions.
Jun 29, 2026