# Maritime Sector Targeting: Blue Initiative Maritime Vulnerabilities Repository Launch Amid Tanker Cyber-Attacks and n0n Extortion Leak-Site Postings

> Two US-bound oil tankers were boarded by the US Coast Guard and FBI on Aug 21 and Aug 24, 2026 after indications that their networks were compromised by unnamed 'foreign cyber actors'. On Oct 12, 2026 the n0n data-extortion group posted 38 maritime and port organizations to its leak site. The Blue Initiative launched a maritime-specific IT/OT vulnerability repository on Oct 26, 2026 in response to this threat context.

- **Published:** 2026-10-26T10:46:43Z
- **Last reviewed:** 2026-10-26T10:46:43Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4446
- **ID:** TL-2026-4446
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This record tracks the maritime-sector threat context reported on 2026-10-26 by Infosecurity Magazine, together with primary reporting on its two cited incidents. No CVEs, malware hashes, network indicators, or confirmed attribution have been published for either incident; every indicator below is an entity or behavioral observable drawn from reporting.

Tanker incidents: The US Coast Guard, with the FBI Cyber Action Team and the Coast Guard Cyber Protection Team, boarded two foreign-flagged oil tankers bound for Texas ports in the Gulf of Mexico on Aug 21 and Aug 24, 2026. The stated purpose was to ensure the integrity of the vessels' operational and information technology systems following indications that their networks were compromised by foreign cyber actors. One vessel was identified in press reporting as the Liberian-flagged VLCC VL Prosperity (crude from Egypt's Sidi Kerir terminal toward Galveston); The Record reports it was attacked on Aug 7 near the Strait of Gibraltar. Iranian state-aligned outlet Mehr claimed a 30-hour communications outage and manipulation of engine speed and fuel/engine-oil systems; US authorities have not confirmed those claims, have not attributed the activity to any country or group, and reported no indications of operational disruption, vessel instability, danger to crew or environmental impact. Investigators are reportedly examining whether Iran or another actor exploiting the Iran-US conflict was involved. The article summarised for this record describes the compromise as affecting IT and OT networks including propulsion and navigation, which is broader than what US officials have confirmed.

n0n extortion group: n0n is a financially motivated data-theft extortion group that emerged in September 2026 (SOCRadar assesses it is likely Russia-based; this is an analyst assessment, not confirmed). SOCRadar reports initial access via credentials obtained from infostealer malware, exfiltration of items such as Active Directory mappings and legal documents, and manipulation of victim data with administration tools rather than deploying conventional ransomware. Its leak site operates as a public scoreboard with statuses such as PENDING EXPOSURE, NOT PAID EXPOSED and HONORED; one payment from a Canadian financial services company was recorded on Oct 7, 2026. On Oct 12, 2026 the group listed 38 organizations across 18 countries (container terminals, shipping lines, port IT providers, a crane manufacturer, with a cluster of 12 South Korean entries), demanded USD 2.4M-14M per victim payable in Bitcoin to per-victim addresses, charged a negotiation entry fee of 10% of the demand, and set a publication deadline of 2026-10-19 13:27 UTC. Claimed data includes EDI messages, manifests, gate and equipment interchange records, terminal system configuration, release documents and deployment material. None of the listed organizations had publicly confirmed a compromise at the time of reporting.

Suspected attack path: SOCRadar notes small, application-scoped datasets, identical EDI message types and terminal configurations across victims, and incomplete infostealer coverage, suggesting a shared platform or third party (comparable in pattern to the MOVEit and Cleo mass-exploitation campaigns). Cydome identified a possible compromise of a shared environment associated with CLT, a maritime software provider. This is unconfirmed.

Defensive development: The Blue Initiative (Cydome, Rakuten Maritime, Bureau Veritas, ClassNK, MTS-ISAC) launched the Maritime Vulnerabilities Repository, the first database listing only IT and OT vulnerabilities relevant to the maritime sector, with CVE browsing, vendor filtering, expert insight and alert subscriptions. Entries are published only after patches are available and are validated by Cydome and partner researchers. Severity MEDIUM is analyst judgment, not source-stated.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1195 Supply Chain Compromise
- T1199 Trusted Relationship
- T1087.002 Domain Account
- T1005 Data from Local System
- T1657 Financial Theft

## Sources

- [Blue Initiative Offers Maritime Sector Dedicated Vulnerability Database (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/blue-initiative-maritime/)
- [Coast Guard, FBI board US-bound oil tankers after cyberattack indications (The Record)](https://therecord.media/oil-tanker-cyberattack-coast-guard-fbi)
- [FBI and Coast Guard boarded US-bound oil tankers after signs the ships were hit with cyberattacks (Local10)](https://www.local10.com/news/national/2026/09/16/fbi-and-coast-guard-boarded-us-bound-oil-tankers-after-signs-the-ships-were-hit-with-cyberattacks/)
- [FBI, Coast Guard boarded hacked oil tankers heading towards US coast (TechCrunch)](https://techcrunch.com/2026/09/18/fbi-coast-guard-boarded-hacked-oil-tankers-heading-towards-us-coast/)
- [FBI, Coast Guard probe cyberattacks on ships entering US waters (Cybersecurity Dive)](https://www.cybersecuritydive.com/news/fbi-coast-guard-probe-cyberattacks-ships-us-waters/830668/)
- [Coast Guard, FBI investigating after 2 oil tankers bound for US hit with cyberattacks (ABC7)](https://abc7news.com/story/coast-guard-fbi-investigating-2-oil-tankers-bound-us-hit-cyberattacks-sources/19838934/)
- [n0n Group Global Ports and Shipping Leak (SOCRadar)](https://socradar.io/blog/n0n-group-global-ports-shipping-leak/)
- [Massive cyber attack threatens release of data from 38 maritime companies (Maritime Executive)](https://maritime-executive.com/article/massive-cyber-attack-threatens-release-of-data-from-38-maritime-companies)
- [Indian maritime facility among 38 targeted by cyber extortion group (The Week)](https://www.theweek.in/news/maritime/2026/10/15/indian-maritime-facility-among-38-targeted-by-cyber-extortion-group-report-makes-shocking-claim.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4446