Europe

Archived

[...]

As cyber operations increasingly disrupt access control and vessel traffic systems, the lack of clear coordination between military and civilian stakeholders is becoming a strategic vulnerability. Despite the civilian ownership of most port infrastructure, these facilities play an essential role in NATO’s defence network, yet NATO’s current maritime strategy lacks formal frameworks for engagement with commercial port operators, despite their critical role in maritime security and NATO logistics operations.

In its policy brief titled, ‘Addressing State-Linked Cyber Threats to Critical Maritime Port Infrastructure,’ NATO CCDCOE [Cooperative Cyber Defence Centre of Excellence ] identified that maritime port facilities face a range of threats from state-sponsored advanced persistent threats (APTs), financially motivated cybercriminals, and politically driven hacktivists. These threats are remarkably consistent regardless of geographical location, and the tactics, techniques, and procedures (TTPs) are the same if not identical across Europe, the Americas, and the Asia Pacific regions.

[...]

As hybrid warfare tactics combine physical and cyber operations, the divide between civilian and military maritime security is increasingly blurred. This undermines NATO’s coordination mechanisms, especially since most strategic port assets remain in civilian hands.

[...]

Since Russia’s full-scale invasion of Ukraine in 2022, Moscow has intensified its use of hybrid tactics, including sabotage, disruption operations, and support for extremist groups, to weaken critical infrastructure and erode public trust in democratic systems. In May 2025, NATO and several European governments issued a joint cybersecurity advisory confirming that APT28 (Fancy Bear), linked to Russia’s GRU military intelligence agency, had launched widespread cyberattacks against Western logistics and tech firms spanning nearly every mode of transportation.

According to the Nordic Maritime Cyber Resilience Centre (NORMA Cyber), Fancy Bear has specifically targeted maritime operators, logistics companies, and air traffic control networks in at least 11 countries.

[...]

Threat groups such as Yellow Lideric (Imperial Kitten), APT35 (Charming Kitten), MuddyWater, and the IRGC-linked persona Cyber Aveng3rs have hit ports across Israel, Egypt, and the Eastern Mediterranean. Their targets have included Israel’s Ashdod and Haifa ports, the latter handling 88 percent of the country’s maritime traffic, as well as the BAZAN oil refinery and Egypt’s Port Said, each a critical link in global trade flows.

[...]

These incidents underscore a growing pattern of state-sponsored cyber operations aimed at disrupting critical infrastructure. Ports, in particular, present high-value targets, not only for their role in global trade but for their importance in military logistics. Cyberattacks on these systems can inflict serious financial damage while also undermining operational readiness.

[...]

“In January 2022, ransomware attacks unfolded over several days, targeting at least 17 major oil port terminals in Belgium, the Netherlands, and Germany. These attacks affected some of the largest ports in the region, such as Hamburg, Ghent, Antwerp-Zeebrugge, and Rotterdam. European prosecutors and cybersecurity officials investigating these attacks found that ransomware forced oil suppliers to reroute their products, disrupting operations.”

Further, it added that this could disrupt and delay military operations in the region. Investigations by the Antwerp public prosecutors’ office highlighted the complexity of attributing such cyberattacks.

According to Germany’s Federal Office for Information Security (BSI), the state-linked BlackCat ransomware group was responsible for these attacks. Meanwhile, the now-defunct state-linked Conti ransomware group was identified as responsible for the cyber attack on Ghent-based international terminal operator Sea-Invest.

[...]

In parallel, the brief urges the formation of international maritime cybersecurity working groups under the International Maritime Organization. These groups would unite port operators, shipping firms, government bodies, and cybersecurity specialists to develop consistent, maritime-specific security standards across the Alliance. Their focus would include creating actionable guidance for implementing existing cybersecurity frameworks, such as the NIST Framework and NIS2, tailored to the OT and IT complexities unique to port environments.

[...]