NATO warns ports vulnerable to ‘unprecedented’ cyber threats

The vector for these threats expands beyond simple hacking attempts or malware. The CCDCOE identifies the involvement of politically-motivated hacktivists, particularly pro-Russian groups like NoName057. These groups, employing methods such as distributed denial-of-service (DDoS) attacks, have effectively demonstrated the disruptive potential of cyber operations. For instance, one notable incident involved NoName057’s disruption of the Port of Rotterdam’s main website in June 2023, underscoring the group’s ability to impact port operations directly. The group also attacked the ports of Gdynia in Poland, and Felixstowe and Tyne in Great Britain.

The report also cited maritime organizations, logistics providers, and air traffic control systems in at least 11 countries that were targeted by a group linked to Russian military intelligence services.

In Israel, the ports of Ashdod and Haifa and an oil refinery, and Egypt’s Port Said, were attacked by Iran-based groups. 

Maritime transportation companies were targeted by China-connected groups using various attack vectors, including infected USB drives.

NATO said at least 45 maritime organizations suffered ransomware attacks in 2024.

The challenge extends further to state-sponsored cyber attacks, notably from Iranian groups under the aegis of the Islamic Revolutionary Guard Corps and China’s increasing pre-positioning of cyber tools on critical infrastructure networks. These actions provide these states with the capabilities to execute disruptive or even destructive cyberattacks, posing a direct threat not only to the economic fabric of affected countries but also to their national security.

NATO’s current maritime strategy, last revised in 2011, is critiqued in the report for lacking formalized frameworks for engagement with commercial port operators. Because critical port infrastructures are predominantly under civilian control yet serve essential military logistics functions, updated strategies are required that integrate cybersecurity measures tailored to address the needs of modern-day maritime operations.

There are several recommendations from the CCDCOE aimed at enhancing the cyber resilience of maritime ports. These include the need for establishing sector-specific intelligence sharing networks, coordinated response mechanisms, and resilience standards. Such measures would facilitate better cooperation between public and private entities while bolstering NATO’s maritime cyber defense posture.

The cost of inaction, according to the CCDCOE, far exceeds the investment necessary for comprehensive maritime cybersecurity. Without a fortified approach, ports remain susceptible to cyber incursions that could disrupt global trade, endanger economic stability, and compromise national security. The report calls for an urgent revision of existing cybersecurity frameworks to incorporate these recommendations, fostering an environment where intelligence sharing, strategic coordination, and robust cybersecurity practices become the norm.

Find more articles by Stuart Chirls here.

Related coverage:

Historic order for U.S.-built LNG carrier could test new rules 

Trans-Pacific shippers’ turn to pause as box rates end slide

“It all unraveled quickly”: Family-owned business laments tariff and trade chaos

Drewry: Ocean rates fall for fifth straight week