Loading story…
A Georgia Institute of Technology study of Automatic Identification System (AIS) broadcasts from more than 367,000 vessels identified 31 persistent maritime navigation-anomaly hotspots between late November 2024 and early February 2025. Researchers found strong or corroborated evidence of coordinated, regional GPS spoofing in at least 22 locations, documenting 17,936 anomalous episodes affecting 2,663 vessels and more than 31,000 hours of physically implausible or correlated vessel movements.
The activity appeared in heavily traveled waterways and showed geographic and temporal alignment with regional conflicts and sanctions, including persistent disruption in the Red Sea and Strait of Hormuz. Red Sea anomalies near Port Sudan in January 2025 resembled conditions associated with the May 2025 grounding of the container ship MSC Antonia. The researchers cautioned that AIS analysis cannot identify the transmitter, operator, or spoofing technology responsible and likely misses short-lived, localized, and single-vessel incidents.
See the actors and campaigns active against you right now.
5 events from the most recent confirmed update back to the earliest known activity.
Georgia Institute of Technology researchers published a study of AIS data from more than 367,000 vessels collected from late 2024 through early 2025. It identified 17,936 anomalous navigation episodes, 31 persistent hotspots, and strong or corroborated evidence of large-area GPS spoofing in 22 zones.
The 75,000-ton container ship MSC Antonia grounded in the Red Sea following an incident attributed to GPS spoofing and remained immobilized for more than five weeks.
AIS observations identified a persistent suspected GPS-spoofing zone in the Strait of Hormuz during early 2025, more than a year before the 2026 Iran war disrupted commercial shipping through the strait.
The bulk carrier Charmous and at least 11 other vessels recorded overlapping false movements near Port Sudan, including linear displacements sharing the same latitude to five decimal places. The patterns preceded the later MSC Antonia incident by five months.
Nearly 200 vessels displayed synchronized GPS-position jumps in the Gulf of Mexico. Researchers later reproduced the event using public NOAA AIS data.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A network of domains hosting login pages for likely fraudulent ship classification societies has been linked to entities operating under the names **Hellas Naval Bureau of Shipping (HNBS)**, **Med Lloyd Classification Society**, **International Marine Services (IMS)**, and **Olymbos Naval**. The organizations present themselves as recognized bodies authorized to certify vessel safety and compliance, and some are listed as recognized organizations by maritime administrations including Cameroon, Kenya, Comoros, Tanzania, Benin, and Gambia. Shared infrastructure, overlapping subdomains, similar website designs, and common hosting indicators suggest the entities are operationally connected. The network has been tied to vessels associated with Iranian and Russian shadow fleets, raising concerns that fraudulent certification services are being used to support maritime sanctions evasion. One cited case involved the vessel **SERANO II**, which Chinese maritime authorities said carried a non-compliant inspection certificate with an incorrect QR code; the Zhoushan Maritime Safety Administration said **Med Lloyd Classification Society** bore significant responsibility for arbitrarily issuing statutory inspection certificates that contributed to the vessel’s detention. The findings indicate cyber-enabled maritime deception is being used to help high-risk vessels obtain paperwork needed to continue operating.
Jun 29, 2026
Iran-linked threats and attacks expanded from shipping lanes to digital infrastructure across the Gulf, with reports naming **Google, Amazon, Oracle, IBM, and Nvidia** facilities in the Middle East as potential targets and describing earlier drone strikes that disrupted **AWS** operations in the UAE and Bahrain. Regional authorities later denied an IRGC claim that Oracle’s Dubai data center had been hit, but multiple reports said missile and drone attacks had already affected energy, desalination, and industrial sites in Kuwait and the UAE while raising fears for data centers and telecom assets tied to U.S. firms. The conflict’s cyber dimension also spilled into enterprise systems, with analysts warning that retaliation was increasingly aimed at civilian-adjacent technology, logistics, finance, and cloud dependencies rather than a single decisive cyberattack. At the same time, the Strait of Hormuz became a pressure point for both maritime traffic and internet connectivity. Large-scale **GPS/GNSS spoofing**, AIS suppression, dark vessel activity, and selective transit controls disrupted hundreds of ships, while repair and construction work on subsea cables slowed or stopped as security conditions deteriorated. Meta’s **2Africa/Africa2** cable project was delayed after Alcatel Submarine Networks declared force majeure, and Iran-linked media proposed licensing, taxing, and controlling undersea cable operations in the strait, with some outlets openly discussing cable disruption as leverage. Analysts warned that at least six major fiber systems crossing Hormuz underpin Gulf cloud services, finance, and trade, meaning prolonged interference or damage could delay repairs, force traffic onto riskier overland alternatives, and threaten the region’s broader digital-economy ambitions.
Jun 29, 2026
Indian authorities have confirmed that multiple major airports across the country, including those in Delhi, Mumbai, Kolkata, Hyderabad, Bangalore, Amritsar, and Chennai, have experienced GPS spoofing and jamming incidents. The Civil Aviation Minister, Ram Mohan Naidu, reported to parliament that these attacks have been ongoing since 2023, with a notable increase in recent months. The incidents have forced pilots to rely on manual navigation methods, as satellite-based navigation became unreliable, though no direct harm was reported. The Airports Authority of India is working with the Wireless Monitoring Organization to identify the source of the interference and is implementing advanced cybersecurity measures to protect IT networks and infrastructure. A particularly disruptive GPS spoofing attack occurred on November 7, 2025, affecting flight operations and airport tarmac activities at several key airports, including Indira Gandhi International Airport in New Delhi. The attack led to significant flight delays, cancellations, and operational chaos, highlighting the severe risks posed by such cyber threats to aviation safety and airspace management. The Indian government has officially classified these incidents as targeted cyber-attacks and emphasized the urgent need for enhanced security protocols to mitigate future risks.
Jun 29, 2026