Cybersecurity in Maritime Transport Systems: Threats, Trends, and Countermeasures in the Last Decade

Abstract

The increasing digitization and automation of maritime transport systems have introduced significant cybersecurity challenges across both vessel-based and port-based infrastructures. This paper provides a comprehensive overview of the current cyber threat landscape affecting the maritime domain, examining key vulnerabilities in modern maritime systems, including navigation, communication, and cargo handling technologies. It outlines recent trends such as the emergence of autonomous shipping and evaluates their implications for cybersecurity. A detailed classification of cyber threats — ranging from ransomware and phishing to advanced persistent threats and denial-of-service attacks — is presented alongside real-world case studies that illustrate the technical complexity and operational impact of cyber incidents. Furthermore, the paper analyzes the main risk factors contributing to cyber vulnerabilities in the maritime sector. Building on this, it explores state-of-the-art strategies and technologies aimed at mitigating these threats, including intrusion detection systems, blockchain applications, cybersecurity training protocols, and international regulatory efforts. The study concludes with key recommendations for strengthening cyber resilience in maritime operations, emphasizing a proactive and multilayered approach to securing this critical global infrastructure.

1. Introduction

The maritime transport sector is undergoing a profound transformation driven by the accelerated integration of digital technologies. From automated navigation systems aboard vessels to interconnected logistics platforms within ports, information and communication technologies (ICT) have become essential to ensuring operational efficiency, safety, and global connectivity. However, this digital shift has also exposed maritime infrastructure to a growing spectrum of cybersecurity threats. Unlike traditional risks, cyber threats are dynamic, asymmetrical, and often transnational, making them particularly challenging to detect, mitigate, and manage. As maritime systems become increasingly automated and data-driven, through the adoption of technologies such as the Automatic Identification System (AIS), Electronic Chart Display and Information System (ECDIS), and Supervisory Control and Data Acquisition (SCADA), the industry must simultaneously address the vulnerabilities that accompany this evolution.

This paper presents a comprehensive analysis of cybersecurity in maritime transport, focusing on both shipborne and shore-based systems. It begins by characterizing the digital landscape of modern maritime infrastructure and identifying the technologies most susceptible to cyber threats. It then outlines current and emerging threat vectors — including ransomware, phishing, GPS spoofing, and advanced persistent threats — supported by real-world case studies from recent years. A critical examination of sector-specific risk factors follows, highlighting technical, human, and organizational vulnerabilities. The final sections are dedicated to exploring effective mitigation strategies, such as the implementation of intrusion detection systems, the use of blockchain for data integrity, and enhanced crew training protocols. By integrating technical insights with operational case studies, the article provides a practical and forward-looking perspective on strengthening cyber resilience in the maritime domain.

2. Characteristics of Maritime Transport Systems

Modern maritime shipping uses many digital systems to support navigation, operations management, and communication, and electronic devices are present at every level of the maritime transport sector. Among the most important commonly used systems are: Global Navigation Satellite Systems (GNSS) such as GPS, GLONASS, and Galileo; the Automatic Identification System (AIS) for automatic exchange of navigation data to avoid collisions; Automatic Radar Plotting Aid (ARPA) for simultaneous tracking of multiple targets; Vessel Traffic Service (VTS) for vessel traffic control; the Electronic Chart Display and Information System (ECDIS) supporting route planning; Supervisory Control and Data Acquisition (SCADA) systems used both on ships and in ports to manage infrastructure, transshipment processes, and power supply; and the Internet of Things (IoT) — networked sensors monitoring the technical condition of the ship, its equipment, cargo, and parameters such as weather conditions or fuel consumption.

2.1 Trends in modern maritime transport systems

Taking into account the latest trends, it should be assumed that the number of cyber systems in the sector will gradually increase. The concept of autonomous or partially autonomous shipping is showing growing popularity, and its practical implementation on a global scale will require the development and standardization of AI systems capable of full management and control of the ship. Digital development also applies to the land side of the sector, where the smart-port idea leads to the greatest possible automation of port processes such as ship traffic management, cargo logistics, and infrastructure maintenance, using modern data transfer methods, big data analysis, and AI support. A trend developing alongside these concepts is the integration of individual systems in the maritime sector, connecting ship and land systems into uniform digital ecosystems enabling real-time data exchange between vessels, ports, and shipowners and an unprecedented level of process automation — significantly optimizing task costs and times and potentially improving navigation and port-work safety.

However, increasing digitization also brings threats: every electronic system can be susceptible to errors, cyberattacks, or problems resulting from insufficient crew training. The next chapter analyzes cyber threats related to the maritime sector. [1]

3. Current Cyber Threats in the Maritime Sector

As mentioned earlier, any cyber system can be vulnerable to threats resulting from both intentional actions and unintentional human errors or hardware malfunctions. However, special attention in the general classification of digital threats is paid to cyberattacks. Below we present descriptions of individual types of malicious activities, as well as examples of attacks on maritime infrastructure from recent years. [2, 3, 4, 5]

3.1 Cyber threat classification

Attack types differ by purpose, method, and mode of operation. The most common threats in the sector include: ransomware — one of the most popular types of cyberattacks; according to the 2023 Cyber Trends and Insights in the Marine Environment report released in 2024 by the Coast Guard Cyber Command, incidents of this type increased by 80% between 2022 and 2023 and were among the most common threats at 42% of all incidents, before decreasing significantly in the last year while remaining at a fairly high level (about 25% of registered incidents in 2024). A ransomware attack involves encrypting critical data or entire systems to force the victim to pay a ransom to unlock them, and the maritime industry is particularly vulnerable to such attacks due to the very high costs of delaying individual operations. [6, 7, 8, 9]

Phishing / spoofing — the most common type of network threat globally and one of the most serious problems in maritime transport systems. Phishing involves attempting to extort sensitive data using psychological manipulation in the form of fake emails, text messages, or websites cloning the appearance of well-known services, while spoofing is a technique of falsifying identity by hiding or replacing a real email address, phone number, or IP address, often used together with phishing to gain the victim's trust. Such attacks are usually not targeted — they are directed at the widest possible group of recipients — and phishing can rely on both psychological methods and malware installed on victims' computers. [10, 11] In maritime transport, spoofing poses an additional major risk, most often used to disrupt navigation processes by spoofing the GPS signal.

Distributed Denial of Service (DDoS) — an attack disrupting a selected system by artificially generating an unusually large amount of traffic on the server, e.g., rapidly flooding it with queries that overload it; in the maritime sector it can disrupt communication, maritime traffic coordination, or port operations. [12] A Domain Name System attack changes DNS settings to redirect known network addresses to attacker-chosen servers — most often containing cloned versions of a given website — to intercept sensitive data. [13]

Man in the Middle (MitM) — the attacker intercepts communication between two parties to obtain information and modify individual messages, enabling sensitive-data theft, fraud, or further attacks of various kinds. [14, 15] SQL injection is an attack on databases consisting of injecting a malicious code fragment into an SQL query, allowing access to sensitive data or another type of attack. [16]

Brute force — the most primitive type of attack, consisting of successive attempts to crack a password by testing every possible combination of characters, improved by checking the most popular passwords first; the threat level depends on password quality and accompanying security measures. Despite its simplicity, according to the Coast Guard Cyber Command report in 2025, almost 47% of password-cracking attempts by the Cyber Protection Team were successful. [7, 17] Spyware is software-form threat enabling monitoring of user activity and potentially obtaining sensitive data. [18, 19]

Additionally, the maritime industry is exposed to any combination of the above threats aimed at disrupting supply chains, manipulating navigation data (for example through GPS signal spoofing or AIS data falsification), or taking over control systems (for example through attacks on SCADA systems or other Operational Technologies). [20, 21]

3.2 Examples of cyber threat incidents

The most common types of digital threats are listed above. Individual incidents from the last few years are listed below to point out the real scale and nature of the problem; attack aftermaths include financial loss, supply chain disruptions, safety threats, and loss of trust.

3.2.1 Ransomware

The number of ransomware attacks grows every year, and industry journals describe many incidents of this type; three cases from 2023 or later were selected to illustrate the scale of the threat: the attack on Det Norske Veritas (January 2023) — DNV is the world's largest classification society and maritime software provider; on January 7, 2023, it was hit by a ransomware attack targeting its ShipManager software used to manage fleet operations such as maintenance planning, logistics, and regulatory compliance. The attackers gained undisclosed access to the IT servers running the software, encrypted the data, and demanded a ransom. According to DNV, the incident was limited to the ShipManager servers with no impact on the company's other services, yet it affected 70 customers and around 1,000 ships (15% of the software-served fleet); all network functions were down, leaving users with only limited offline functionality, and the company had to rebuild the server environment, investigate, and implement control and preventive measures to protect customers. [22, 23, 24, 25]

The attack on Marinette Marine Shipyard (April 2023) — on April 12, 2023, the Fincantieri Marinette Marine shipyard in Wisconsin, USA, a key contractor of ships for the US Navy, was attacked. Due to its military connections the technical details have not been disclosed, but some sources indicate the work of a professional hacking group that managed to encrypt data on servers operating Computer Numerical Control (CNC) machines controlling production processes. The action was carried out in the early morning hours — probably intended to maximize the consequences of the production standstill — paralyzing production for several days and delaying, among others, the construction of Constellation-class frigates and Freedom-class LCS ships. On November 6, 2023, Fincantieri Marine Group confirmed the attack had leaked private data of 16,769 people, including names and Social Security numbers, and provided victims with two years of free credit monitoring. [26, 27]

The Nagoya Port attack (July 2023) — Nagoya hosts Japan's largest port with operations worth about $125 billion annually (10% of the country's trade). On July 4, 2023, it was hit by a ransomware attack targeting the Nagoya Port Unified Terminal System (NUTS), which manages container loading and unloading. The attack began at 6:30 AM local time, halting the NUTS system, while a port printer simultaneously printed a ransom message. The Japanese press suggested the attack was carried out by the LockBit 3.0 group known for attacks on critical infrastructure; it has not been confirmed how the hackers gained access, but the most likely scenarios are phishing or a security hole. Ultimately, all transshipment operations at container terminals were suspended for almost 3 days; the precise losses were never published but could exceed hundreds of millions of dollars given the annual value of handled operations. [28, 29, 30, 31]

3.2.2 Phishing / spoofing

As mentioned earlier, phishing remains one of the most common cyber threats in maritime transport, with spoofing an additional high risk most often used to disrupt navigation by GPS spoofing. Despite the scale of the phenomenon, detailed information on specific attacks is hard to obtain because they often involve confidential company data, though general information is published in the trade press. Selected incidents include: the spoofing attack on container ship MSC Antonia (May 2025) — on May 10, 2025, the over-300-meter-long container ship MSC Antonia, en route from Marsa Bashayer port in Sudan to Jeddah in Saudi Arabia, went off course and ran aground near its destination. Analysis later that day revealed GPS spoofing as the cause: according to Captain Steve Bomgardner, Vice President of Shipping and Offshore at Pole Star Global, the ship's AIS was misled by false GPS signals, causing the crew to misrepresent positioning data and the vessel to go off course and run aground. Initial findings by Windward likewise suggested a GPS spoofing attack; the day before, UK Maritime Trade Operations (UKMTO) had reported multiple GPS disruption incidents in the Red Sea involving several vessels over several hours. As of May 23, 2025, MSC Antonia was still grounded. [32, 33, 34, 35]

SideWinder phishing attacks (2024) — in 2024, the SideWinder group, most likely an Indian espionage group, intensified its activities with targeted phishing attacks on the logistics and maritime transport sector in Africa and Asia. The attacks mostly consisted of themed emails provoking the recipient to click an infected document containing an exploit for the Microsoft Office CVE-2017-11882 vulnerability known since 2017 (incorrect management of objects in memory). The group used this vulnerability to install the StealerBot advanced spyware toolkit. According to Kaspersky experts, SideWinder mainly attacked targets in Egypt, Djibouti, the UAE, Bangladesh, Cambodia, and Vietnam in 2024. The group most likely relies on known vulnerabilities, old exploits, and easy-to-detect attacks, but experts say deeper analysis suggests SideWinder may pose a more serious threat than it first appears. [36, 37, 38, 39]

3.2.3 Man in the middle

MitM incidents in the maritime sector are relatively poorly documented, since such activities are usually just one stage of a larger attack and technical details are confidential company data. MitM is usually combined with the phishing and spoofing attacks described above — an example being the attacks in the previous point, especially the SideWinder group's actions, where successful use of the earlier exploit allowed remote actions on infected computers, in turn enabling communication disruption and a typical man-in-the-middle scenario, with the later-used StealerBot tool enabling a wide range of hostile actions including MitM-related ones. [36, 37, 38, 39] Another example is the massive AIS spoofing attacks in the Crimea region: after earlier reports of system disruptions in the Black Sea basin, such incidents escalated rapidly in May 2023 with specific characteristics — from May 14 to 21, 2023, many merchant ships operating near Ukraine's southern coast experienced signal disruptions redirecting their AIS positions to Russian-occupied Crimea, with simulated ship locations clearly arranged in the shape of the letter "Z" associated with Russian forces, indicating deliberate organized action by Russian services. [40, 41, 42] Similar attacks took place on June 4, 2024, when the positions of almost 50 ships indicated Simferopol Airport and another 30 Gelendzhik Airport near Novorossiysk, with other AIS data including speed also falsified, targeting vessels of various types and sizes — undoubtedly an element of the Russian-Ukrainian war, exceeding all previous actions of this type in scale. [43]

3.2.4 DDoS

DDoS attacks are most often used as political protest or simple sabotage and hence less dangerous than the other cases described, yet in maritime transport they can disrupt key services including communication systems, causing significant delays or threats. Selected incidents include: the attack on Dutch ports (June 2023) — on June 6, 2023, Dutch port websites were hit by a DDoS attack from the hacker group known as NoName057(16), allegedly motivated by Dutch support for Ukraine in the ongoing war; Amsterdam's port website stayed unavailable for an hour while Groningen Seaports experienced problems for two more days. [44, 45, 46] The Nagoya Port attack (September 2022) — on September 6, 2022, Nagoya's port website suffered a DDoS attack by the Russian hacker group Killnet, remaining unavailable for about 40 minutes alongside other Japanese websites; Killnet later released a Telegram video declaring the attacks a declaration of war against the Japanese government. [29, 47, 48] Regarding European DDoS attacks over the past year, in Spain alone 72 incidents were recorded in March 2025 alone, mainly targeting key government services; the previously described NoName057(16) group claimed responsibility for most, motivated by actions supporting Ukraine in the political conflict ongoing since February 2022, with increases also recorded in France and Italy. Having previously attacked port infrastructure, the group poses a significant risk of similar incidents this time too. [49, 50]

3.2.5 Brute force, spyware, and remaining attack types

Brute force is the most primitive form of cyberattack, so there are no single "major incidents" directly linked to it and maritime transport; however, wide-scale actions simultaneously targeting many sectors including logistics companies can be distinguished over the past years: according to the US Cybersecurity Agency, the Russian military intelligence 85th Main Special Forces Center — specifically military unit 26165 (also known online as APT28, Fancy Bear, Forest Blizzard, or BlueDelta) — has used brute force since at least 2022 in intelligence operations via cyberattacks mainly targeting technology and logistics companies, carrying out mass attempts to guess targets' access data while using VPN and the Tor network to complicate tracking; brute force was one of many attack forms including phishing, malware, and known vulnerabilities and exploits, with similar actions also before 2022. [51, 52] Spyware attacks were already described in previous chapters, most often used in intelligence activities by individual states — direct examples being unit 26165's activities and the software SideWinder installed on seized computers. In recent years the trade press has reported no major attacks based solely on SQL injection or DNS attacks in the maritime sector, or they have not been made public — but that does not mean the threat is absent: according to the European Cyber Report 2025, SQL injection attacks accounted for 23% in 2024, while DNS-related incidents were included in the protocol point at 57% of attacks. [49]

3.3 Risk factors

The maritime transport sector faces several unique cybersecurity risk factors distinguishing it from other industries, arising from a combination of technological, organizational, and regulatory conditions that increase cyber threat exposure.

Legacy systems and infrastructure — many vessels and port facilities continue to rely on outdated control systems and software rarely updated or patched. These legacy systems are incompatible with modern cybersecurity tools, making them particularly susceptible to known exploits.

Low cybersecurity awareness among personnel — unlike other critical sectors, seafarers and port operators often lack specialized cybersecurity training. This human factor is significant — misconfigurations, weak passwords, or clicking phishing links can introduce serious vulnerabilities. That situation is clearly visible throughout US Coast Guard Cyber Trends and Insights in the Marine Environment reports: in 2022 [53], 50% of Cyber Protection Team (CPT) missions gained initial access through phishing campaigns with a 59% success rate in brute-force password cracking; in 2023 [6], 66% of phishing campaigns succeeded, with a 60.1% brute-force success rate and 94.4% of organizations using default credentials; in 2024 [7], 53% succeeded in credential harvesting through phishing with a 46.9% brute-force success rate. All of this clearly shows cybersecurity awareness in maritime organizations needs improvement.

Increased system integration and remote access — as described in earlier sections, digital integration between ship and port systems is a growing trend; however, these connected infrastructures expand the attack surface, especially when remote access is granted for operational convenience or technical support without strong authentication protocols. Ships also usually operate with minimal onboard IT personnel, making real-time response to cyber incidents difficult and creating delays in detection, containment, and remediation.

Regulatory and standardization gaps — while several organizations (e.g., IMO, BIMCO, IACS) offer cybersecurity guidelines, they are often non-binding or outdated relative to the pace of cyber threat evolution. The absence of consistent enforcement results in varied cybersecurity maturity levels across the industry.

4. Strategies and technologies for countering threats

Mitigating cyber threats in maritime transport systems requires an integrated approach combining technical solutions, personnel readiness, and regulatory compliance. Intrusion Detection and Prevention Systems (IDPS) are essential for real-time monitoring of vessel and port networks, detecting anomalies and enabling swift responses, particularly in SCADA and industrial control environments. Blockchain technology enhances data integrity in logistics and cargo handling by creating tamper-resistant, decentralized records of operational events.

Addressing the human factor remains critical: regular, role-specific cybersecurity training and simulated threat scenarios improve awareness and response capability across crews and port staff. Artificial intelligence and machine learning contribute significantly to early threat detection by analyzing network behaviors and identifying irregularities such as AIS spoofing or GPS manipulation.

Regulatory frameworks like the IMO Guidelines and ISO/IEC 27001 ensure structured risk management and foster a consistent cybersecurity culture throughout the sector. Finally, network segmentation, strong access controls, encryption, and least-privilege policies limit the spread and impact of potential intrusions, forming a vital foundation for resilient maritime cyber defense.

5. Conclusions and recommendations

Growing digitization of maritime transport systems has introduced substantial cybersecurity challenges affecting both seaborne and port-based infrastructure. As demonstrated by numerous recent incidents, the maritime industry is increasingly vulnerable to cyberattacks ranging from ransomware and GPS spoofing to advanced persistent threats and coordinated denial-of-service campaigns. The complexity and interdependence of modern maritime systems — including navigation, logistics, and communication platforms — have considerably expanded the sector's attack surface. One of the most important conclusions is that cybersecurity in this domain is no longer a peripheral concern — it is now a core component of operational safety and business continuity. Many vulnerabilities stem not only from technical weaknesses but also from organizational gaps such as outdated infrastructure, insufficient cyber awareness, or lack of standardized response procedures. The case studies in this paper highlight how even brief disruptions can cascade across supply chains, causing significant financial losses and reputational damage. It is clear that as maritime operations become more integrated and data-driven, cybersecurity must evolve in parallel as a strategic priority.

To address these challenges, a proactive and multilayered approach to cybersecurity is necessary. Maritime stakeholders should invest in up-to-date technological safeguards while simultaneously cultivating a culture of cyber vigilance across all organizational levels. Regulatory frameworks must be implemented comprehensively and consistently, ensuring risk management protocols are embedded in safety systems rather than treated as standalone policies. Industry-wide cooperation — including information sharing on emerging threats and response strategies — is essential to counter transnational risks effectively. Furthermore, targeted investments in crew training, system redundancy, and real-time threat detection capabilities can significantly improve resilience. Ultimately, cybersecurity must be regarded not merely as a compliance issue but as a dynamic and continuous process integral to the future of safe and efficient maritime operations.

Acknowledgements

This study was funded by the Gdynia Maritime University under research project WN/2025/PZ/07.

References

The full reference list (53 sources) is available in the original PDF. Selected key references:

[1] S. Symes et al., "Cyberattacks on the Maritime Sector: A Literature Review," J. Marine Sci. Application, vol. 23, no. 4, pp. 689–706, 2024.

[5] T. Neumann, "Cybersecurity in Maritime Industry," TransNav, vol. 18, no. 4, pp. 765–774, 2024. doi: 10.12716/1001.18.04.02

[6] U.S. Coast Guard Cyber Command, "Cyber Trends and Insights in the Marine Environment 2023," 2024.

[7] U.S. Coast Guard Cyber Command, "Cyber Trends and Insights on the Marine Environment 2024," 2025.

[22] J. Greig, "Ransomware attack on maritime software impacts 1,000 ships," The Record, Jan. 17, 2023.

[28] I. Arghire, "Japan's Nagoya Port Suspends Cargo Operations Following Ransomware Attack," SecurityWeek, July 5, 2023.

[33] M. Schuler, "Pole Star Confirms GPS Interference Caused MSC ANTONIA Grounding," gCaptain, May 15, 2025.

[51] CISA, "Russian GRU Targeting Western Logistics Entities and Technology Companies," AA25-141A, May 21, 2025.