Loading story…
The Liberian-flagged LNG carrier Vivit Africa LNG, carrying U.S.-origin liquefied natural gas to Italy, diverted from its planned Adriatic terminal call near Rovigo after its crew reported that attackers had temporarily taken control of cargo and safety systems. The reported affected functions included steam-pressure controls, safety valves, cargo-tank pressure and pressure-relief systems, disrupting boil-off-gas management and allegedly creating a risk of tank rupture or explosion. The vessel instead proceeded toward Algeciras, Spain.
Italian Coast Guard authorities characterized the incident more cautiously as a malfunction of cargo-parameter monitoring systems that required intervention by company technicians. Authorities said the cause remains undetermined and issued a navigation warning; Korean Register has opened an investigation. No threat actor, malware, forensic evidence, or indicators of compromise have been publicly identified, leaving the claimed cyberattack and its reported technical impact unverified.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
Two alleged cyber incidents involving oil tankers off the U.S. coast were reported, prompting involvement by the U.S. Coast Guard and FBI. U.S. authorities were reportedly monitoring nearly 20 vessels worldwide for potential threats.
Korean Register, the vessel's classification society, began investigating the incident. No threat actor, malware, vulnerability, indicators of compromise, or verified forensic evidence were identified in the reporting.
Italian coast guard authorities characterized the incident as an undetermined malfunction in cargo-parameter monitoring systems requiring company technicians and issued a navigation warning. Vivit Africa LNG abandoned its planned Adriatic LNG terminal call near Rovigo and proceeded toward Algeciras, Spain.
The crew of the Liberian-flagged LNG carrier Vivit Africa LNG alleged that attackers attempted to compromise its control systems before loading and later temporarily controlled steam-pressure systems, safety valves, cargo-tank pressure controls, and pressure-relief valves during its voyage. The claims, including disruption to boil-off-gas management and a risk of tank rupture or explosion, were not independently verified.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Coast Guard and FBI boarded two foreign commercial tankers in the Gulf of Mexico on August 21 and 24 after indications their networks had been compromised. Coast Guard Cyber Protection Teams and the FBI Cyber Action Team examined both vessels’ operational technology and IT environments; one potentially affected ship was identified as the Liberian-flagged *VL Prosperity*, which reportedly lost communications for more than 30 hours following an August 7 intrusion while transiting the Strait of Gibraltar from Egypt to the United States. Authorities said the incidents caused no confirmed disruption to vessel operations, instability, crew safety risk, or environmental harm, and they have not publicly attributed the activity. Investigators reportedly considered possible Iranian involvement or a group seeking to exploit U.S.-Iran tensions, while maritime agencies coordinated with stakeholders to maintain safe, uninterrupted port operations amid separate reported cyber disruption affecting North Carolina Ports.
Sep 18, 2026
French authorities are investigating a suspected cyberattack targeting the GNV ferry Fantastic, which operates between Sète and North Africa. The investigation was initiated after Italian intelligence, acting on information from GNV, alerted French officials about two sailors—one Latvian and one Bulgarian—suspected of espionage for a foreign power. During a search of the vessel in the port of Sète, French intelligence agents detained the two individuals and discovered a device containing RAT-type malware capable of remotely controlling the ship's navigation systems. The Latvian sailor was charged in Paris with conspiracy to serve a foreign power, attempted computer system intrusion, and possession of devices intended to interfere with navigation, while the Bulgarian was released. GNV reported that it had identified and neutralized the attempted intrusion, stating that its systems remained protected and unaffected. The company has fully cooperated with authorities throughout the investigation, which is reportedly focusing on possible Russian involvement amid broader concerns about hybrid warfare in European waters. The vessel was temporarily sealed for safety checks but has since resumed operations. Italian police and Eurojust have also conducted searches in Latvia as part of the ongoing inquiry into whether the ship's systems were exposed to malware designed for remote hijacking.
Jun 29, 2026
A ransomware attack hit Spain’s Port of Vigo, disrupting cargo traffic management systems and other digital services while forcing authorities to disconnect affected parts of the network. Port officials said some equipment was locked and the attackers sought a ransom payment, prompting cybersecurity teams to keep systems offline until they can verify the environment is secure. Investigators are still working to determine the initial access vector and whether any sensitive data was compromised. Physical port activity, including ship movements and cargo handling, continued, but logistics coordination through digital platforms was impaired and some cargo-related processes were shifted to manual operations. Port president Carlos Botana said there is no timeline for full restoration, underscoring the operational risk ransomware poses to ports and other maritime organizations that support critical trade flows.
Jun 29, 2026