By Eva Prokofiev
Thousands of commercial and private vessels transit the world’s oceans daily, broadcasting positional data, transmitting communications through exploitable unencrypted satellite communications, and connecting to shoreside networks with minimal security. Adversaries do not need to build dedicated collection strategies when the commercial fleet functions as a distributed sensor network accessible to anyone with the technical capability and intent.
The concept is not new. During the Cold War, the Soviet Union equipped commercial fishing trawlers with SIGINT and ELINT equipment, stationing them off U.S. naval bases to photograph and report the arrival and departure of warships.[1] These vessels – unremarkable in appearance and operating under legitimate commercial cover – functioned as auxiliary intelligence platforms. Today, the same logic applies at scale, except the commercial fleet no longer requires modification. The collection infrastructure is already installed.
In March 2025, a coordinated cyberattack disabled satellite communications across 116 vessels belonging to Iran’s state-owned shipping fleet.[2] Ship-to-shore links failed. Automatic Identification System (AIS) tracking went dark. Voice communications were compromised. The attackers – a group known as Lab Dookhtegan – had not targeted vessels individually. Instead, they compromised Fanava Group, an Iranian satellite and IT provider, gaining root-level access to the Linux systems running VSAT terminals across the National Iranian Tanker Company (NITC) and Islamic Republic of Iran Shipping Lines (IRISL) fleets simultaneously.[3] One provider, 116 vessels targeted, communications severed.
But before those communications were severed, the attackers had access to everything flowing through those systems – voice calls, data traffic, and real-time vessel positions around Bandar Abbas.[4] The attack was destructive, but the access that preceded it was an intelligence windfall. The incident demonstrated not merely that maritime communications are vulnerable, but that adversaries have recognized their intelligence value and are acting accordingly.
A Distributed Collection Network
The maritime sector’s digital transformation has created something unprecedented: a globe-spanning network of platforms that continuously radiate exploitable data while transiting areas of strategic significance. Modern vessels integrate VSAT terminals, Global Navigation Satellite Systems (GNSS), Automatic Identification Systems (AIS), Electronic Chart Display and Information Systems (ECDIS), closed-circuit television, access control systems, and multiple wireless networks. Many feature remote monitoring allowing shoreside engineers to access propulsion and machinery controls. Entertainment and administrative systems frequently share network infrastructure with systems necessary to safely operate a ship.
International Maritime Organization (IMO) Resolution MSC.428(98), adopted in 2017, requires cyber risk management within Safety Management Systems for vessels subject to the International Safety Management (ISM) Code.[5] Yet implementation remains uneven, enforcement mechanisms weak, and significant portions of the maritime domain fall outside mandatory frameworks entirely.
The Guidelines on Cyber Security Onboard Ships, produced by BIMCO and major industry associations, identify structural vulnerabilities persisting across the sector: “involvement of multiple stakeholders potentially resulting in lack of accountability for IT and OT system infrastructure,” “use of legacy systems that are no longer supported,” and “a cyber risk management culture that still has potential for improvement.”[6]
Technical management fragments among owners, management companies, and rotating crews. Classification society oversight focuses primarily on safety rather than cybersecurity. Port state control inspections rarely assess digital vulnerabilities. The result: a global fleet where vessels carry sophisticated communications equipment with considerably weaker protections than naval auxiliaries operating in the same waters.
The barrier to access is remarkably low. A security researcher used a publicly available search engine to locate a commercial vessel’s satellite communications system and access it using default credentials (admin/1234). No exploit, no malware, no supply chain compromise – only a web browser.[7]
From an adversary perspective, this represents not a problem but an opportunity. The collection infrastructure exists. Someone else maintains it. And access requires only the technical capability to exploit known vulnerabilities – or unconventional methods to bypass existing controls, on-site or entirely remotely.
Intelligence Streams Without Deployment
Traditional signals intelligence requires expensive platforms, trained personnel, and operational risk. The unwitting fleet offers an alternative: passive collection from commercial systems that operators voluntarily connect to exploitable networks.
Communications interception represents the most direct stream. VSAT systems transmitting unencrypted or poorly secured traffic expose telephone calls, emails, and data transfers. Passengers and crew accustomed to connectivity discuss sensitive matters assuming shipboard communications are private. The BIMCO guidelines acknowledge that VSAT signals are “vulnerable to exploitation using low-cost, off-the-shelf products.”[6] Encryption implementation remains inconsistent across the sector. The Lab Dookhtegan attack demonstrated that compromising a satellite provider’s infrastructure via a supply chain attack grants access not just to data traffic but to Voice over IP (VOIP) services – enabling interception or disruption of voice communications between vessels and shore.
Location and pattern-of-life data flows continuously without requiring any compromise at all. AIS transponders broadcast position, course, and speed by design. Voyage histories stored in navigation systems reveal movement patterns. Booking and cargo management platforms maintain detailed records accessible through compromised supply chains. For vessels carrying high-value individuals, government officials, or defense-connected personnel, this information enables precise tracking across jurisdictions. The Fanava breach confirmed attackers accessed real-time vessel positions around Bandar Abbas, demonstrating how a single intrusion escalates from communications disruption to full operational visibility.[4] This dynamic is not limited to commercial vessels. Just this month, March 2026, the French aircraft carrier Charles de Gaulle and its carrier group were tracked in near real-time through Strava fitness data from a sailor’s smartwatch — a textbook example of how commercially available consumer technology becomes unintentional intelligence infrastructure.
Crew and passenger data constitutes targeting intelligence. Vessels routinely collect identification documents, travel histories, and contact details. Crew employment records, uploaded to recruitment agencies with minimal security, contain personal data exploitable for social engineering or direct approach. Cyber awareness training in the commercial maritime sector remains minimal. Exposure assessments have found crew credentials in breach databases, traced to documents uploaded years earlier to maritime employment platforms.
Physical proximity may be the least appreciated dimension. Commercial vessels routinely anchor near naval facilities, transit chokepoints, and call at ports hosting military ships. A vessel with compromised onboard systems positioned in these areas becomes a passive collection platform – whether operators recognize the condition or not.
The vulnerability of vessel navigation systems has been demonstrated directly. In 2013, University of Texas researchers used a $2,000 GPS spoofing device to covertly take control of an $80 million superyacht’s navigation system in the Mediterranean, diverting it from course without triggering any alarm.[8] If a research team can redirect a vessel using off-the-shelf equipment, an adversary can position a compromised vessel precisely where collection value is highest.
Consider a scenario: A commercial bulk carrier with compromised VSAT systems anchors in Hampton Roads awaiting berth assignment – within line of sight of Naval Station Norfolk. Its onboard Wi-Fi access point passively logs every wireless device in range, including phones carried by personnel on nearby piers. Its AIS receiver captures the movements of every naval vessel entering or departing. Its compromised satellite terminal provides an adversary with real-time access to the vessel’s communications and surrounding RF emissions. The crew is unaware. The operator is unaware. The adversary did not need to deploy a dedicated collection platform – the commercial fleet provided one.
This is not purely hypothetical. China has formalized this approach through its maritime militia. A 2025 Naval War College report documented that China embeds intelligence specialists – “information personnel” – aboard fishing and merchant vessels to collect data on foreign military vessels, transmitting intelligence directly to the PLA.[9] The Chinese government has installed BeiDou satellite systems with messaging capabilities on thousands of fishing boats for maritime surveillance.[10]
The critical difference between state-run programs and the unwitting fleet is intent. China’s maritime militia requires coordination, trained personnel, and exposure risk. The unwitting fleet requires none – the collection infrastructure is already deployed, maintained, and paid for by commercial operators.
Opportunities for collection extend beyond the vessel itself. Management companies, brokers, terminals, chandlers, and service providers all interface with vessel systems. The BIMCO guidelines warn that “lack of physical and/or cyber security at a supplier, vendor or service provider may result in a breach of corporate IT systems and/or corruption of ship OT/IT systems.”[6] A compromised vessel becomes an entry point into broader maritime and commercial networks.
The cumulative picture: adversaries can collect communications, track movements, harvest personal data, achieve physical proximity to sensitive facilities, and pivot into shoreside networks – all without deploying dedicated intelligence platforms.
Adversary Recognition of the Opportunity
Evidence suggests state and criminal actors recognize the maritime sector’s intelligence value – and are exploiting it with increasing frequency.
The Lab Dookhtegan attack used destructive commands to wipe storage partitions and disable the Falcon software central to Iran’s maritime satellite communications. The damage required physical replacement of hardware aboard affected vessels. Internal documents, network diagrams, and operational checklists were leaked.[3]
The Chinese state-sponsored group Mustang Panda has targeted cargo shipping companies in Norway, Greece, and the Netherlands, with malware discovered directly on cargo ship systems via USB-based infection.[12] The South Asian group SideWinder APT has targeted maritime facilities across Egypt, Djibouti, the UAE, Bangladesh, Cambodia, and Vietnam. At least a dozen advanced persistent threat groups targeted the maritime industry in the past year alone.[12]
Other incidents confirm the sector’s exposure. In 2023, Lürssen – a major European shipbuilder – suspended operations following a ransomware attack.[13] The same year, Brunswick Corporation reported losses of $85 million and nine days of disrupted operations from a cyber incident.[14] In March 2024, MarineMax, the world’s largest luxury yacht retailer, disclosed that attackers exfiltrated data on over 123,000 customers and employees – including financial information on high-net-worth individuals.[15]
The BIMCO guidelines explicitly identify the threat actor landscape: “states, state-sponsored organisations, and terrorists” motivated by “political/ideological gain, espionage, financial gain, commercial espionage, and industrial espionage.”[6]
Russia’s intelligence-collection vessel Yantar – operated by the Main Directorate of Underwater Research (GUGI) – has been tracked surveilling undersea cables along Europe’s Atlantic coastline and operating near the U.S. submarine base at Kings Bay, Georgia.[16][17] While the Yantar is a purpose-built intelligence platform, its operations demonstrate the collection value of physical proximity to maritime infrastructure – the same proximity that thousands of commercial vessels achieve daily without attracting attention.
Monitoring of sanctioned vessels and those linked to specific state actors has shown how AIS data, satellite imagery, and port records synthesize into comprehensive surveillance. The same techniques available to journalists and compliance analysts are available to intelligence services. The defensive or proactive awareness within much of the maritime sector lags far behind the exposure.
Strategic Geography
The unwitting fleet operates precisely where intelligence collection carries greatest value.
The Mediterranean hosts dense vessel traffic intersecting NATO operations, Russian operations, and critical energy transit routes. Cyprus, Malta, and Gibraltar – significant flag states and frequent ports of call – sit at the intersection of multiple intelligence interests.
The Arabian Gulf and Red Sea see commercial traffic alongside critical energy infrastructure and ongoing naval operations. Vessels transiting these waters pass within range of state actors possessing demonstrated cyber capabilities and clear strategic motivations. The Iranian fleet targeted in March 2025 operated extensively in these waters – and the attackers’ access to AIS tracking data around Bandar Abbas underscores the intelligence value of maritime positioning in contested regions.
The Indo-Pacific presents expanding concerns as maritime activity increases alongside great power competition. The South China Sea, Malacca Strait, and waters surrounding Taiwan see commercial vessels operating in proximity to military activities – with minimal cybersecurity oversight. Chinese intelligence-collection vessels have been observed near Australia’s Naval Communication Station Harold E. Holt, a joint U.S.-Australian facility providing VLF communications vital for submarine operations.[18]
Unlike military vessels with communications security protocols, commercial craft frequently operate with default configurations, outdated software, and crews unfamiliar with threat indicators. They anchor in remote locations, utilize facilities with limited security infrastructure, and interface with vendors without proper verification of cybersecurity practices. The unwitting fleet transits sensitive waters daily – radiating data, accepting connections, and enabling collection.
Implications for Naval and Intelligence Communities
Recognizing commercial vessels as existing intelligence infrastructure – rather than merely vulnerable assets – suggests several considerations for naval, coast guard, and intelligence communities.
A natural limitation of the unwitting fleet as a collection platform is that commercial vessels move according to commercial schedules, not adversary requirements. An adversary cannot direct a container ship to remain anchored near a naval facility indefinitely. However, the density of commercial traffic in strategic waters means exploitable vessels are nearly always present in areas of intelligence value – and supply chain compromise of a single VSAT provider can deliver simultaneous access to hundreds of vessels, as the Fanava breach demonstrated.
Awareness and monitoring: Commercial and private vessels operating near defense installations or during significant events represent potential collection platforms, whether through deliberate compromise or passive exploitation of security gaps. Analytical frameworks should account for the intelligence value these vessels offer adversaries by default.
Industry engagement: Classification societies and flag states could strengthen cybersecurity certification and extend requirements across vessel categories. Organizations like BIMCO have established guidelines; what remains absent is meaningful incentive for adoption. U.S. Navy and Coast Guard engagement with maritime industry associations might encourage improved practices while building information-sharing relationships.
Supply chain assessment: The Lab Dookhtegan attack demonstrated that VSAT providers, navigation system manufacturers, and vessel management software companies constitute single points of failure. Compromise of one provider delivered access to 116 vessels simultaneously. Understanding the security posture of these suppliers – and the potential for similar attacks against providers serving allied commercial fleets – supports broader maritime domain awareness.
Information sharing: Much of the maritime sector operates outside established security frameworks. Integrating commercial vessel incident data into threat assessment would improve understanding of adversary capabilities and intentions in the maritime domain.
Exercise integration: Naval and coast guard exercises could incorporate scenarios involving compromised commercial vessel communications or adversary exploitation of maritime satellite infrastructure. The Iranian fleet incident provides a real-world template.
Conclusion
The maritime sector’s cybersecurity gaps are typically framed as a defensive problem – vessels at risk of attack, operations vulnerable to disruption. This framing, while accurate, is incomplete.
The unwitting fleet is not merely vulnerable. It is already functioning as adversary intelligence infrastructure. Thousands of vessels transit strategic waters broadcasting position, transmitting communications through exploitable links, and maintaining connections to shoreside networks – all without security adequate to the operating environment.
The commercial fleet provides positioning, sensors, and connectivity. Operators maintain the infrastructure and pay the bills. Collection requires only the will and skill to access what is already exposed.
A vessel does not need to be gray-hulled to present intelligence value – or strategic risk. Naval and intelligence communities attentive to military communications security should extend that awareness to the unwitting fleet operating every day on the world’s oceans.
Eva Prokofiev, former Israeli Military Intelligence Officer from a Special Operations Division with 15+ years in cyber and intelligence. Her work has been cited by the U.S. Army War College and various defense publications. She is the founder and CEO of EPCYBER and RedRadar Technologies, focused on intelligence and cyber for government, defense, and maritime sectors.
References
[1] “Spy ship,” Wikipedia. Soviet fishing trawlers were equipped with SIGINT and ELINT equipment and stationed off U.S. naval bases to monitor warship movements. https://en.wikipedia.org/wiki/Spy_ship
[2] Iran International, “Cyber group says it disrupted Iranian shipping communications,” March 18, 2025. https://www.iranintl.com/en/202503182119
[3] Cydome, “Lab Dookhtegan Cyberattack – Second Wave Findings (Aug 2025).” Lab Dookhtegan published leaked internal documents, network diagrams, and operational data from Fanava Group following the attack. https://cydome.io/lab-dookhtegan-cyberattack-second-wave-findings-aug-2025/
[4] Cydome, “Lab Dookhtegan cyber attack on Iranian oil tankers disrupts operations,” March 2025. Maps with real-time vessel positions around Bandar Abbas confirmed access to AIS tracking data, and control over ship-to-shore VOIP services enabled interception of voice communications. https://cydome.io/lab-dookhtegan-cyber-attack-on-iranian-oil-tankers-disrupts-operations/
[5] International Maritime Organization, Resolution MSC.428(98), “Maritime Cyber Risk Management in Safety Management Systems,” June 2017. https://wwwcdn.imo.org/localresources/en/OurWork/Security/Documents/Resolution%20MSC.428(98).pdf
[6] BIMCO et al., The Guidelines on Cyber Security Onboard Ships, Version 4, 2021. https://www.bimco.org
[7] Cyber Defense Magazine, “Cyber Attacks at Sea: Blinding Warships,” July 2020. https://www.cyberdefensemagazine.com/cyber-attacks-at-sea-blinding-warships/
[8] Todd Humphreys et al., University of Texas at Austin, “Researchers Successfully Spoof an $80 Million Yacht at Sea,” July 2013. https://news.utexas.edu/2013/07/29/ut-austin-researchers-successfully-spoof-an-80-million-yacht-at-sea/
[9] Conor M. Kennedy, “China’s Fishermen Spies: Intelligence Specialists in the Maritime Militia,” China Maritime Report No. 46, Naval War College, April 2025. https://digital-commons.usnwc.edu/cmsi-maritime-reports/46/
[10] Benar News, “China Turning South China Sea Supply Ships into Mobile Surveillance Bases,” April 2021. https://www.benarnews.org/english/news/philippine/surveillance-ships-04092021173155.html
[11] “Chinese Spy Ships Stalk U.S., Philippine and French Warships in South China Sea,” USNI News, April 2024. https://news.usni.org/2024/04/29/chinese-spy-ship-live-stalks-u-s-philippine-and-french-warships-in-south-china-sea-interrupts-live-fire-drill
[12] Cyble, “Cyber Threats Surge Against Maritime Industry in 2025,” July 2025. https://cyble.com/blog/cyberattacks-targets-maritime-industry/
[13] The Record, “German builder of yachts and military vessels hit by ransomware attack,” April 2023. Lürssen shipyard operations brought to a standstill by ransomware attack over Easter holiday. https://therecord.media/german-builder-of-superyachts-and-military-boats
[14] The Record, “Marine industry giant Brunswick Corporation lost $85 million in cyberattack, CEO confirms,” August 2023. Nine days of disrupted operations; major impact on Navico marine electronics subsidiary. https://therecord.media/marine-industry-giant-brunswick-lost-millions
[15] BleepingComputer, “Yacht giant MarineMax data breach impacts over 123,000 people,” July 2024. Rhysida ransomware group exfiltrated 225GB of data including financial documents, driver’s licenses, and passports. https://www.bleepingcomputer.com/news/security/yacht-giant-marinemax-data-breach-impacts-over-123-000-people/
[16] Financial Times, “The Russian Spy Ship Stalking Europe’s Subsea Cables,” Helen Warrell, Chris Cook, and Daria Mosolova, September 26, 2025. https://www.ft.com/content/0b351091-3f82-4f2f-bef2-a52a35f009f2
[17] “Russian research vessel Yantar,” Wikipedia. https://en.wikipedia.org/wiki/Russian_research_vessel_Yantar
[18] “Chinese Spy Ship Makes First Appearance Near Australian Submarine Communications Base,” The War Zone, May 2022. https://www.twz.com/chinese-spy-ship-makes-first-appearance-near-australian-submarine-communications-base
Featured Image: Commercial vessels sailing (courtesy of pxhere.com)




