Threat reportThreat IntelligenceTL-2026-4446
Maritime Sector Targeting: Blue Initiative Maritime Vulnerabilities Repository Launch Amid Tanker Cyber-Attacks and n0n Extortion Leak-Site Postings
Maritime Sector Targeting (TL-2026-4446), also tracked as n0n maritime leak-site campaign, is a medium-severity tracked intrusion set, first published 2026-10-26. It has no confirmed attribution, affects Various Oil tanker IT/OT networks (propulsion, navigation, engine, maps to 6 MITRE ATT&CK techniques (T1005, T1078, T1087.002), and is covered by 9 detection rules and 12 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 12Indicators of compromise
Key facts for TL-2026-4446
- Threat ID
- TL-2026-4446
- Also known as
- n0n maritime leak-site campaign, VL Prosperity tanker cyber incident
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- maritime, shipping, ports and terminals, energy, logistics
- Target regions
- Gulf of Mexico / United States, south korea, Asia-Pacific, Europe, Middle East, 005 - South America, North Africa
- Detection rules
- 9
- Indicators of compromise
- 12
How Maritime Sector Targeting works
Two US-bound oil tankers were boarded by the US Coast Guard and FBI on Aug 21 and Aug 24, 2026 after indications that their networks were compromised by unnamed 'foreign cyber actors'. On Oct 12, 2026 the n0n data-extortion group posted 38 maritime and port organizations to its leak site. The Blue Initiative launched a maritime-specific IT/OT vulnerability repository on Oct 26, 2026 in response to this threat context.
This record tracks the maritime-sector threat context reported on 2026-10-26 by Infosecurity Magazine, together with primary reporting on its two cited incidents. No CVEs, malware hashes, network indicators, or confirmed attribution have been published for either incident; every indicator below is an entity or behavioral observable drawn from reporting.
Tanker incidents: The US Coast Guard, with the FBI Cyber Action Team and the Coast Guard Cyber Protection Team, boarded two foreign-flagged oil tankers bound for Texas ports in the Gulf of Mexico on Aug 21 and Aug 24, 2026. The stated purpose was to ensure the integrity of the vessels' operational and information technology systems following indications that their networks were compromised by foreign cyber actors. One vessel was identified in press reporting as the Liberian-flagged VLCC VL Prosperity (crude from Egypt's Sidi Kerir terminal toward Galveston); The Record reports it was attacked on Aug 7 near the Strait of Gibraltar. Iranian state-aligned outlet Mehr claimed a 30-hour communications outage and manipulation of engine speed and fuel/engine-oil systems; US authorities have not confirmed those claims, have not attributed the activity to any country or group, and reported no indications of operational disruption, vessel instability, danger to crew or environmental impact. Investigators are reportedly examining whether Iran or another actor exploiting the Iran-US conflict was involved. The article summarised for this record describes the compromise as affecting IT and OT networks including propulsion and navigation, which is broader than what US officials have confirmed.
n0n extortion group: n0n is a financially motivated data-theft extortion group that emerged in September 2026 (SOCRadar assesses it is likely Russia-based; this is an analyst assessment, not confirmed). SOCRadar reports initial access via credentials obtained from infostealer malware, exfiltration of items such as Active Directory mappings and legal documents, and manipulation of victim data with administration tools rather than deploying conventional ransomware. Its leak site operates as a public scoreboard with statuses such as PENDING EXPOSURE, NOT PAID EXPOSED and HONORED; one payment from a Canadian financial services company was recorded on Oct 7, 2026. On Oct 12, 2026 the group listed 38 organizations across 18 countries (container terminals, shipping lines, port IT providers, a crane manufacturer, with a cluster of 12 South Korean entries), demanded USD 2.4M-14M per victim payable in Bitcoin to per-victim addresses, charged a negotiation entry fee of 10% of the demand, and set a publication deadline of 2026-10-19 13:27 UTC. Claimed data includes EDI messages, manifests, gate and equipment interchange records, terminal system configuration, release documents and deployment material. None of the listed organizations had publicly confirmed a compromise at the time of reporting.
Suspected attack path: SOCRadar notes small, application-scoped datasets, identical EDI message types and terminal configurations across victims, and incomplete infostealer coverage, suggesting a shared platform or third party (comparable in pattern to the MOVEit and Cleo mass-exploitation campaigns). Cydome identified a possible compromise of a shared environment associated with CLT, a maritime software provider. This is unconfirmed.
Defensive development: The Blue Initiative (Cydome, Rakuten Maritime, Bureau Veritas, ClassNK, MTS-ISAC) launched the Maritime Vulnerabilities Repository, the first database listing only IT and OT vulnerabilities relevant to the maritime sector, with CVE browsing, vendor filtering, expert insight and alert subscriptions. Entries are published only after patches are available and are validated by Cydome and partner researchers. Severity MEDIUM is analyst judgment, not source-stated.
MITRE ATT&CK techniques used in TL-2026-4446
Collection
Initial Access
T1078 Valid Accounts; T1195 Supply Chain Compromise; T1199 Trusted Relationship
Discovery
Impact
Affected products and versions in Maritime Sector Targeting
- Various — Oil tanker IT/OT networks (propulsion, navigation, engine, communications systems reported)
Vulnerable versions: Unspecified - CLT — Maritime software provider shared environment (possible compromise, unconfirmed)
Vulnerable versions: Unspecified - Various — Port and terminal EDI, terminal-system and file-transfer platforms (suspected shared platform, unconfirmed)
Vulnerable versions: Unspecified
Remediation for Maritime Sector Targeting
Patches
- No CVEs are cited in the sources; apply vendor patches for maritime IT/OT products as published in the Maritime Vulnerabilities Repository
Immediate actions
- Reset credentials and enforce MFA for accounts exposed in infostealer logs, prioritising maritime software, EDI and file-transfer platform accounts
- Audit access and data-egress logs of EDI, terminal-operating-system and managed file-transfer products for the period around Sep-Oct 2026
- Ask maritime software and integration providers (including CLT) whether shared environments were compromised and request their logs
- Segment shipboard OT (propulsion, navigation, engine and tank control) from shipboard IT and crew/internet-facing networks and review remote access paths
Workarounds
- Restrict and monitor use of administrative tools on terminal and EDI servers
- Rotate API keys, service accounts and deployment secrets present in exfiltration-exposed deployment material
Longer-term hardening
- Monitor vulnerabilities relevant to your fleet and terminals via the Blue Initiative Maritime Vulnerabilities Repository and subscribe to alerts
- Participate in MTS-ISAC information sharing
- Monitor leak sites and dark-web postings for organization and third-party names
- Run tabletop exercises for vessel network compromise and third-party data-theft extortion
Timeline of Maritime Sector Targeting
- Per The Record, tanker VL Prosperity is attacked near the Strait of Gibraltar; Iranian outlet Mehr later claims a 30-hour communications loss and engine/fuel system manipulation (unconfirmed by US authorities).
- US Coast Guard and FBI board the first foreign-flagged oil tanker in the Gulf of Mexico to verify integrity of its operational and IT systems after indications of compromise by foreign cyber actors.
- Second oil tanker (reported as carrying LNG) is boarded under the same investigation.
- Press reports disclose the Coast Guard/FBI tanker boardings; authorities do not attribute the activity and report no operational disruption, instability or crew danger.
- n0n leak site records a settlement from a Canadian financial services company, the one confirmed payment noted by SOCRadar.
- n0n adds 38 maritime and port organizations across 18 countries to its leak site with ransom demands of USD 2.4M-14M in Bitcoin.
- Publication deadline of 13:27 UTC set by n0n for the maritime batch; no victim had publicly confirmed a compromise at time of SOCRadar reporting.
- Blue Initiative (Cydome, Rakuten Maritime, Bureau Veritas, ClassNK, MTS-ISAC) launches the Maritime Vulnerabilities Repository for maritime IT/OT vulnerabilities.
Sources cited for Maritime Sector Targeting
- Blue Initiative Offers Maritime Sector Dedicated Vulnerability Database (Infosecurity Magazine)
- Coast Guard, FBI board US-bound oil tankers after cyberattack indications (The Record)
- FBI and Coast Guard boarded US-bound oil tankers after signs the ships were hit with cyberattacks (Local10)
- FBI, Coast Guard boarded hacked oil tankers heading towards US coast (TechCrunch)
- FBI, Coast Guard probe cyberattacks on ships entering US waters (Cybersecurity Dive)
- Coast Guard, FBI investigating after 2 oil tankers bound for US hit with cyberattacks (ABC7)
- n0n Group Global Ports and Shipping Leak (SOCRadar)
- Massive cyber attack threatens release of data from 38 maritime companies (Maritime Executive)
- Indian maritime facility among 38 targeted by cyber extortion group (The Week)
Detection coverage for TL-2026-4446
As of 2026-10-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4446 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.