Cydome

💡 What's fake and what's not in the recent tanker cyber incidents Last week, the U.S. Coast Guard and Federal Bureau of Investigation (FBI) announced that a joint team boarded marine vessels to inspect them, following indications of possible cybersecurity compromise. The agencies did not reveal which systems were impacted, and reports varied from loss of communications for 30 hours near Gibraltar to a compromise of engine control systems and hydraulics. Some reports even included images of leaking pipes and an (alleged) “ransom” note addressed to the VL Prosperity tanker’s master from the hackers, instructing them to abandon ship within 15 minutes. The Cydome maritime cyber research team analyzed the incident, identified interesting new insights and the research was featured in the Financial Times. First, we found that the information about pipe leaks etc., published originally in Iranian media and a Russian-speaking Telegram channel (later repeated by other publications) is fake. We analyzed the images and saw evidence they are an AI manipulation of images of a Maersk vessel published on social media in 2023 (that don’t show any signs of problems). Since the U.S. Coast Guard confirmed evidence of malicious cyber activity on board (without specifying), the team continued and found additional information that could present a possible attack vector: ▶️ The fake images originated or were distributed very early by Iranian media and Russian-speaking Telegram channels. ▶️ Last year, two fleets of Iranian tankers were hacked by exploiting their ST Engineering iDirect VSAT satellite terminals, completely disabling their satellite communications (see the Lab Dookhtegan incident analysis by Cydome research). ▶️ The VL Prosperity seems to have been transporting Saudi oil to the USA. ▶️ CISA and Saudi aramco published new vulnerabilities in ST Engineering iDirect VSATs mere weeks before the attacks (followed by additional CVEs this week). This information is purely circumstantial, as we don’t have direct evidence that the VSATs were hacked, etc. However, compromising critical ship OT systems by exploiting its VSAT is a plausible scenario that shipping companies must prepare for, and the article details how such an attack would look like. Read more in the Financial Times article here: https://lnkd.in/dgvBkC34 Link to the full analysis, with the side-by-side image comparison and a step-by-step possible attack scenario is in the comments. #maritimecybersecurity #tankerincident #CVE #VSAT Image source: Telegram

250+ shipping and port companies were found in the FortiBleed dataset. Check your own exposure in seconds.

Cydome found 250+ maritime organizations with exposed Fortinet credentials as part of "FortiBleed". Here's what you need to know.

A global credential leak has hit Fortinet firewalls of shipping companies and ports worldwide. Check if your fleet is exposed with our free tool.

FortiBleed exploited a step most operators missed after patching Fortinet firewalls.

FortiBleed breach exposed Fortinet credentials for 250+ maritime companies, some devices remain unpatched. Here's what IT teams need to know.