Maritime Cyber Extortion Campaign Targets 38 Shipping and Port Companies

A maritime cyber extortion campaign has threatened to release data that a cybercrime group claims to have stolen from 38 shipping, port and logistics companies unless they pay multimillion-dollar ransoms by Oct. 19.

Cybersecurity firm SOCRadar said the group, known as n0n, added all 38 organizations to its dark web leak site at once on Oct. 12, marking a significant shift in focus toward maritime-sector targets.

The list includes 12 port and container terminal operators, 10 shipping companies and vessel operators, as well as port technology providers, logistics companies and other maritime-related businesses across 18 countries.

Companies named include Ocean Network Express (ONE), CULines, TS Lines and Samudera, as well as terminal operators Santos Brasil, Portonave, BNCT, Pusan Newport Company, TTI Algeciras, Eurogate Tanger, Nam Dinh Vu Port and NEOM Ports.

The alleged breaches, however, have not been independently verified.

SOCRadar stressed that none of the maritime companies on the list had publicly confirmed that their systems were compromised or that n0n actually possesses the data it claims to have obtained. The cybersecurity company said the group’s claims should therefore be treated as unverified.

n0n is described as a financially motivated data-theft extortion operation, rather than a conventional ransomware group.

The group has threatened to release the allegedly stolen material at 13:27 UTC on Oct. 19. According to SOCRadar, ransom demands it reviewed ranged from $2.4 million to $14 million, payable in Bitcoin.

In some cases, the group’s leak site also imposes a type of fee before victims can gain access to negotiations themselves. In one example cited by SOCRadar, Eurogate Tanger was allegedly instructed to pay 10% of a $6 million ransom before being granted access to a private negotiation room.

Maritime Cyber Extortion Campaign Involves Operational Data

The data n0n claims to possess varies by company and includes EDI files, container manifests, vessel schedules, gate movement records, commercial documents, internal system configurations, employee accounts and financial records.

So far, there is no confirmation that these data sets are authentic, complete or recently obtained.

According to SOCRadar, the relatively small volume and specific nature of the data attributed to some of the companies could indicate exploitation of a common application or shared vulnerability, rather than 38 separate intrusions. That hypothesis has also not been confirmed.

Maritime cybersecurity company Cydome pointed to a possible connection with an environment associated with maritime software provider CyberLogitec, but stressed that it was unable to determine the origin or extent of any potential breach.

Image generated with Artificial Intelligence. 

Fonte: Splash247

Sharing is caring!