Cybersecurity: Ghosts in the Machine

CyberOwl/HFW Report: Maritime industry pays an average ransom of $3 million in cyberattacks

 

In the dead of night, a fully laden LNG tanker quietly navigates the narrow channel of a strategic U.S. port. Suddenly, the ship's GPS blinks and alarms, showing the vessel miles off course. The crew has no idea their instruments have fallen prey to a sophisticated spoofing attack—where false GPS signals are broadcast to deceive a ship's navigation system into believing it's in a different location. 

Without their knowledge, the tanker was silently steered off track, headed toward critical infrastructure.

Hours earlier, a shoreside vendor had completed what appeared to be routine maintenance, leaving behind a smartphone in the engine control room—a harmless oversight, or so it seemed. Unbeknownst to the crew, that phone was a Trojan horse, silently infiltrating the ship's systems despite the air gap designed to safeguard critical functions. 

As the crew struggled to regain control, the malware awoke, crippling the ship's electrical network, communications and emergency uninterrupted battery supply. The vessel, making way while not under command, drifted helplessly toward catastrophe. 

Do you think this is fiction? Hardly.

GPS Spoofing

In the dark waters off Crimea, the battleground has undeniably gone digital, truly evoking the "ghosts in the machine" scenario. This battleground embodies fifth- and sixth-generation warfare where cyber operations, electronic warfare and disinformation blur the lines between physical and virtual combat. 

AIS (Automatic Identification System) broadcasts vessels' positions via GPS inputs, but GPS spoofing manipulates this data, creating navigational confusion. Jamming, on the other hand, blocks signals altogether, leaving vessels without critical navigation and communication capabilities. These tactics could lead to catastrophic accidents in high-traffic areas like the Black Sea. In one incident, spoofed signals traced a "Z" across the sea near Crimea. It was unclear if it was the symbol for Russia's war efforts or the mark of Zorro, but it was disruptive.

In May 2023, a mass spoofing event off Crimea caused ships to appear far from their true locations. The Center for Advanced Defense Studies documented over 10,000 spoofing incidents between 2017 and 2019, demonstrating a correlation between Putin's movements and GPS spoofing incidents near Crimea. Such tactics are deployed to shield high-value targets from GPS-guided weapons, complicating the use of drones, missiles and other advanced precision systems.

In June and July 2021, NATO warships like the HMS Defender and USS Ross were spoofed near Crimea, underscoring Russia's use of electronic warfare to disrupt maritime operations and global shipping lanes. 

Just days before this article was published, the Ukrainian Navy launched an operation to combat Russian GPS spoofing, destroying an idle gas platform off Crimea. Russian forces were purportedly using the platform to broadcast GPS interference, which Ukraine claimed threatened civilian navigation. "The occupiers used this location for GPS spoofing to endanger civilian navigation. We cannot allow this," said Ukrainian Navy spokesman Dmytro Pletenchuk. 

The attack came just hours after Russian personnel and equipment were spotted on the platform.

On October 1, the Panama-flagged oil tanker M/V Cordelia Moon survived a major explosion. The attack, claimed by Yemen's Houthi rebels, involved eight ballistic and winged missiles, a drone and an uncrewed surface boat (videos of both attacks are online). A missile northwest of Hodeidah also hit a Liberia-flagged bulker. 

These incidents, along with the Ukrainian strike on a Russian GPS spoofing platform, underscore how low-tech, unmanned vessels, along with electronic warfare like GPS spoofing and jamming, pose severe risks to maritime safety.

As maritime systems become increasingly digital and interconnected, cyber warfare is no longer confined to the pages of a novel. It's an urgent, evolving threat lurking in the waters of global trade. 

CyberOwl & DNV: Securing Maritime Networks

The maritime sector faces increasing cybersecurity risks, driven mainly by the complexity of vessel lifecycles and supply chains. Daniel Ng, CEO of Singapore-based CyberOwl, explains that many shipping companies still treat cyber risk management as a one-off compliance task. 

"For cyber risk management to be effective, it needs to be continuous," says Ng. “This is where our partnership with DNV brings real value. By combining our expertise, we can address cyber risks throughout the vessel lifecycle."

This collaboration brings together over 70 maritime cybersecurity specialists in five global hubs from Oslo to Singapore, backed by a network of 500 cybersecurity experts and 7,000 maritime risk professionals. "This allows us to cover everything—from the design stage to vessel operations to incident response," notes Ng.

He points out that a significant challenge is the difference between operational technology (OT), which controls shipboard machinery, and information technology (IT), which handles data: "Legacy OT systems often aren't as secure as newer technologies. We align with standards like UR E26 for new systems but take a more practical approach to legacy systems. CyberOwl's technologies provide visibility into OT risks so shipowners can focus on real threats rather than theoretical ones."

Looking ahead, Ng sees the partnership driving innovation in maritime cybersecurity. He highlights CyberOwl's OT Security Manager as a key tool: "It ingests and interprets Excel documents, PDF reports and system drawings, helping shipowners assess risks without needing to deploy tech onboard." 

This approach supports compliance with the E.U.'s Network and Information Systems (NIS) Directive, aimed at protecting critical infrastructure. "Ultimately," says Ng, "we want to give shipowners peace of mind as they adopt digital technologies to boost performance and reduce emissions."

Information Fusion Centre: CYBSEC Threats & Trends

Based in Singapore, the Information Fusion Centre (IFC) serves as a critical hub for maritime security (MARSEC) monitoring and information-sharing across the Indo-Pacific. Under the Republic of Singapore Navy, the IFC collaborates with international liaison officers from over 25 countries to tackle maritime threats including piracy, smuggling and cybersecurity (CYBSEC).

The IFC emphasizes the increasing cyber risks to vessels' OT systems and the importance of continuous monitoring and rapid response. Its information-sharing capabilities have been instrumental in preventing cyber incidents from escalating into significant disruptions. 

"We've seen growing interest from shipping companies in involving us in their security drills, where we bring a naval perspective and real-time information-sharing," an IFC spokesperson noted.

Despite a 77 percent reduction in CYBSEC incidents in 2024—down to three from 13 the previous year—the IFC warns this may reflect a lack of reporting, not a decline in threats. Recent malware attacks on cargo vessels in Europe underscore the persistent cyber risks in high-threat areas.

The IFC provides regular updates on cybersecurity trends via its social media channels and advisories. Shipowners are encouraged to subscribe to these reports or engage the IFC in security exercises to boost their readiness against cyber threats. 

Tackling Cyber Espionage and Signal Jamming

Sahil Andrews Chand, Founder & CEO of ShipSafe, warns that signal jamming—disrupting communication and navigation—poses significant risks during critical operations like docking. 

"Jamming can lead to disorientation and even collisions in congested waters where precision is crucial," Chand explains. He also highlights the broader threat of cyber espionage, where attackers gather intelligence on shipping routes and cargo, creating severe security implications.

Chand addresses a common misconception in the maritime industry—the assumption that existing navigation systems are inherently secure. "This complacency can lead to dangerous vulnerabilities,” he notes. 

Many systems, primarily operational technology, can be exploited if not properly secured. Chand advocates for a structured cybersecurity approach, prioritizing critical communications such as navigation and safety, which must be safeguarded with dedicated bandwidth and strong security measures.

Chand also stresses the importance of network segmentation to isolate OT systems from administrative IT systems, limiting the impact of any potential breaches. He further emphasizes adopting robust firewalls and intrusion-detection systems to block unauthorized access.

"Limiting remote access is key," Chand continues, recommending multifactor authentication and strong passwords. However, technology alone isn't enough. "Continuous crew cybersecurity training is critical to ensure preparedness against evolving threats," he advises. Chand underscores the importance of collaboration with port authorities to share information about cyber incidents and threats.

Finally, he highlights the need to balance innovation with security, urging companies to evaluate new technologies like AI, machine learning, and blockchain through a cybersecurity lens to prevent new vulnerabilities from emerging.

Staying the Course

As cyber and electronic warfare tactics like GPS spoofing and jamming increasingly impact military and civilian vessels, experts agree that the industry must bolster defenses. Heightened vigilance, coupled with substantial investment in advanced technologies and crew training, is crucial. 

These measures are essential to safeguarding maritime operations against the evolving landscape of cyber warfare. – MarEx 

Technology columnist Sean Holt writes from Singapore.
 

 

 

Maersk Line Vessel Diverts to Morocco Due to Allegations in Spain

One of the container vessels operating for Maersk Limited, Limited, the U.S. subsidiary of the shipping company, diverted to Morocco over the weekend following activists’ protests in Spain alleging the vessel is carrying military supplies to Israel. The vessel was also met with protests while it was in the port of Tangier Med as the company questioned the change in policies after months of similar port calls.

Maersk confirmed in a statement to Agence France-Presse (AFP) that Spanish authorities denied docking privileges at Algeciras to the Maersk Denver (6,200 TEU vessel registered in the United States) on its current voyage from New York to the Middle East. This came after activist groups last week asserted that Maersk Line ships making port calls in Spain were carrying military supplies to Israel violating Spain’s ban on the transshipment of arms to Israel through its ports.

“To gain clarity for future operations, we have consulted the Spanish authorities to understand why entry was denied for cargo no different than previous shipments that have routinely been transshipped through this port without incident,” a Maersk spokesperson told AFP.

Maersk said that it understands that it is Spain’s discretion to change its criteria while emphasizing that the cargo it was carrying is all legal. Further, they said that “cargo to be transshipped through the port does not include any military weapons or ammunition.”

Maersk Line, Limited is a Maersk subsidiary that operates U.S.-flag, U.S.-crewed ships under U.S. government subsidy. A large share of MLL cargoes are government-owned goods and equipment which may include military cargoes.  

The Maersk Denver docked in Tangier Med on Saturday, November 9, and departed Sunday with its AIS signal and published schedule showing the next port in Oman. Protestors however also demonstrated in Morocco on Sunday claiming that the ship after unloading cargo was bound for Haifa, Israel.

Last week, Spain’s foreign ministry told the press in Spain that the two Maersk ships singled out by the activists “will not stop in Spain.” It also said it would look into allegations that previously Maersk ships had been permitted to make port calls while transporting military equipment.

A second Maersk Line vessel, Maersk Seletar, is following close behind due to make a port call in Algeciras on Thursday and Thursday, November 14 – 15. Officials told the media that they have not yet been advised of the ship’s destination. Like the Maersk Denver, it shows a route bound for Oman and the Middle East.

The Houthis have also alleged that Maersk Line, Limited ships were targets because of the company’s involvement with Israel. The rebels have claimed attacks on several of the company’s vessels as they were bound for Oman.

 

 

Maersk Tankers Adopts Wind-Assisted Propulsion with Landmark Deal

Maersk Tankers is becoming the latest blue chip brand in shipping to embrace wind-assisted propulsion technology to help it meet its aspirations for reducing emissions. The tanker operator selected suction sales for five of its medium-range tankers giving Spain’s Bound4blue its largest agreement to date for its wind-assisted propulsion system.

With over 240 tankers and gas carriers, Maersk Tankers reports it is continually exploring and adopting advanced energy-efficient technologies. The company demonstrated wind-assisted propulsion in 2018 with the installation of rotor sails on the Maersk Pelican and recently retained Njord, a specialist in green solutions for the maritime industry, to assist in assessing and evaluating a broad range of wind-assisted propulsion systems.

Maersk Tankers awarded a contract to Bound4blue to install a total of 20 suction sails across five ships of the fleet. The vessels including Maersk Tacoma, Maersk Tampa, Maersk Tangier, and Maersk Teesport, built in 2015 and 2016 and each 49,800 dwt, as well as the Maersk Tokyo also built in 2016 and 44,000 dwt. 

“For the tanker industry to progress in the energy transition, concrete investments and actions are essential,” said Claus Grønborg, Chief Investment Officer for Maersk Tankers. “By implementing Wind-Assisted Propulsion Systems at scale in our fleet, we enable our customers to meet their sustainability targets, while also advancing the objectives of FuelEU Maritime and the EU Emissions Trading System."

Each of the suction sails will be 26 meters (85 feet) in height. The technology works by dragging air across its aerodynamic surface to generate lift and propulsive efficiency. Maersk Tankers report the sails will be installed during normal dry dock periods in 2025 and 2026 and they expect to realize double-digit percentage reductions in fuel consumption and CO2 missions per vessel.

“Designed to operate safely in challenging conditions, our system is particularly well-suited for safe, high performing, and cost-efficient operation on tankers,” said José Miguel Bermúdez, CEO and co-founder of Bound4blue.  He called the order a “key milestone” for the technology.

Started a decade ago in Spain, the company highlights that it has installed its eSail system on four ships. They note growing momentum having signed additional agreements with other well-known shipping companies such as Klaveness Combination Carriers, Eastern Pacific, Odfjell, and Louis Dreyfus.

The shipping industry is showing increasing interest in adding wind propulsion systems to their vessels. Several different technologies are competing and from the early results the installed systems are providing meaningful reductions in fuel consumption and supporting the goals to reduce emissions and meet emerging regulations.

 

 

Effort to Develop First U.S. Liquid Hydrogen-Fueled RoPax Ferry 

An effort is underway to leverage the cutting-edge technology for hydrogen-fueled vessels to develop the first RoPax vehicle ferry in the U.S. to be fueled by liquid hydrogen. SWITCH Maritime, the U.S. shipowner that launched the first hydrogen-powered ferry in the U.S. is in collaboration with LH2 Shipping and LMG Marin in Norway to commence construction in the U.S. of a hydrogen-fueled RoPax ferry.

SWITCH’s first hydrogen-powered vessel, the Sea Change, is a 75-passenger catamaran ferry featuring 600 kW of electric motor propulsion, powered by 360 kW of fuel cells with 246 kilograms of gaseous H2 (GH2) storage at 250 bar pressure. The Sea Change started public passenger service as part of the San Francisco Bay Ferry system in July 2024, after receiving its final Certificate of Inspection (COI) from the U.S. Coast Guard in May 2024.

“With rigorous planning, state-of-the-art engineering, and support from leading industry partners and the U.S. Coast Guard, we are ready to pioneer zero-carbon LH2 fueling for heavier, higher-horsepower workboats,” explains Pace Ralli, Founder & CEO of SWITCH.

They plan to develop a vessel using the designs from LMG Marin for an 80-car, 300-passenger RoPax vehicle ferry. The design is already DNV classed and is being successfully operated by Norled. Named MF Hydra, the ferry performs a triangular six nautical mile round-trip fueled with liquid hydrogen (LH2). The companies highlight it has a four-tonne LH2 tank (about the size of a 40-foot container) that fits easily on the top deck and receives fuel from an LH2 truck via a bunkering system using over-pressure in the truck to push the liquid to the ship. To date, MF Hydra has successfully received LH2 fuel approximately 50 times since starting hydrogen-powered operations in March 2023.

The RoPax vehicle ferry will have a service speed of 14 knots and is expected to require fueling only once per week (volume of 3000 kilograms from one LH2 truck) in a typical operation, with no requirement for shoreside electric charging infrastructure. While the design will require some further adapting to meet USCG requirements, SWITCH notes the larger steel hull of the vehicle ferry offers more flexibility in terms of space and weight compared to aluminum catamaran fast ferry designs, making it an ideal platform for introducing LH2 fueling in the U.S. The LH2 from the cryogenic storage tanks is vaporized onboard and used in the PEM fuel cells to create electricity for the electric motors. Like the GH2 fast ferries, the vessel’s only emissions will be pure H20 vapor, with zero carbon or other diesel-related emissions.

In addition to the Sea Change, SWITCH is also working on a 150-passenger, 25-knot catamaran to build for the SF Bay Ferry service, using the same gaseous H2 (GH2) storage and fuel cell equipment as the first vessel (to be revealed in Q1 2025). When designing larger zero-emissions harbor craft such as 300+ passenger ferries, vehicle ferries, and harbor tugs, SWITCH plans to transition from gaseous storage to cryogenic liquid H2.

SWITCH has focused on hydrogen for its potential to serve as a viable option highlighting its belief that other battery-only solutions fall short due to space and weight constraints. The company notes that generally, hydrogen as a fuel source can support greater range and power requirements due to its high energy density. Additionally, it simplifies zero-emissions vessel operations by eliminating the need for fixed shoreside charging infrastructure, allowing for fueling through established truck-to-ship or ship-to-ship practices. Compressed GH2 SWITCH says is well suited for small- to medium-sized vessels; however, as vessel size and energy demand increase, cryogenic LH2 becomes the preferred storage solution. Similar to Liquefied Natural Gas (LNG), cryogenic LH2 supports faster refueling speeds for large volumes (e.g. tons per hour).

Did You Know? Maritime Infostealer Incidents See Significant Rise in 2024

 

In the first half of 2024, the volume of cybersecurity incidents involving infostealers has increased significantly, and maritime victims have been no exception.

Infostealers are a type of malware designed to steal sensitive information from an infected system, such as login credentials, financial data, browser history, and other personal or corporate information.

The maritime industry relies heavily on interconnected systems and digital platforms to manage logistics, shipping routes, and vessel operations. If compromised by infostealers, these systems can expose the sector to significant risks, such as unauthorised access to operational controls, data breaches, financial fraud, and even larger-scale cyberattacks.

Among the most common infostealers spotted during the first half of 2024 are RedLine, Raccoon, Vidar, Mars Stealer, and LokiBot, according to the report from Marlink’s Security Operations Center on cyber security threats.

The U.S. Coast Guard (USGC) plans to introduce new cyber security rules soon, with implications for maritime and offshore energy cyber space as well.

If you are in New Orleans on November 13, 2024, sign up now for a free lunch and moderated conference discussion to learn more about the new USGC cyber security rules and their impact on the vessel owner/operators, OEMs and shipyards. Featured speakers include:

• Rear Admiral Wayne R. Arguin Jr., Assistant Commandant for Prevention Policy (CG-5P), U.S. Coast Guard
• Dain Detillier, Executive VP – LNG Operations, Harvey Gulf, LLC
• Stewart Alpert, Chief Information Security Officer & Head of Technology, Hornblower Group
• Angeliki Zisimatou, Director, Cybersecurity, American Bureau of Shipping
• Phillip Bannerman, VP Sales Americas, Marlink

Sofia Offshore Wind Farm Construction Well Underway

 

Van Oord has installed over a quarter of the foundations which will support Sofia offshore wind farm’s 100 wind turbines in the North Sea since the start of operations in May.

The Dutch contractor Van Oord is using the Port of Tyne’s Clean Energy Park as a storage and marshalling base, benefitting from direct access to its deep-water quay and connection to the North Sea.

The port has been welcoming the tallest offshore installation vessel in its history, the Aeolus. Purpose-built to construct offshore wind farms, the Aeolus has a crane boom height of 155 metres and is 175 metres in length, which is the equivalent of more than 14 double decker buses.

Since May, over a quarter of the foundations have been installed in the North Sea, each measuring to 90 meters in length and weighing between 1,200 to 1,550 tonnes.

The wind farm will use 100 Siemens Gamesa 14 MW offshore wind turbines of SG 14-222 DD type.

First Turbine Blade for Sofia Offshore Wind Farm Sees the Light of Day

All of the components which will be used to build the wind turbines have been delivered to the UK. The range of large-scale items include external platforms, boat landings, and ladders, which have made the journey from Poland to the Port of Tyne. Monopiles are still be fabricated with delivery planned into 2025.

Once complete, RWE’s Sofia offshore wind farm will be roughly the same size as the Isle of Man spanning 593 km2, with the capability to provide 1.2 million typical UK homes with their electricity needs from its 1.4 GW capacity.

The Sofia offshore wind farm is expected to become operational in 2026.

“Since partnering with Van Oord earlier this year, real strides have been made in their construction of Sofia, accelerating the region’s path towards a clean energy future.

“It’s why we’ve developed our Tyne Clean Energy Park, which has been earmarked for renewable energy production tenants, while supporting our intentionally ambitious vision for a cleaner, greener future, both for the Port and wider region,” said Matt Beeton, CEO at the Port of Tyne.

“Seeing the first foundations being installed at sea is a hugely symbolic moment in the construction of every wind farm. The Sofia project is around fourteen years in the making and the construction phase has around two further years yet to go,” said Matthew Swanwick, Project Director for the Sofia offshore wind farm.

 

Solstad Offshore Scoops $54M in New Vessel Contracts in Brazil.

 

Norwegian offshore vessel owner Solstad Offshore has secured multiple contract awards with clients in Brazil for two of its anchor handling tug supply (AHTS) vessels and one construction support vessel (CSV).

Solstad’s Normand Topazio and Normand Turmalina AHTS vessels have been awarded one-year contracts each, starting in October and November 2024, respectively. Both awards are in direct continuation of current contracts.

Also, Normand Cutter CSV has been awarded a 9-month contract for subsea construction activities with the start in October 2024 in direct continuation of current contract.

The combined gross contract value is approximately $53 million, and all three vessels will be put to work offshore Brazil.

To note, Normand Topazio and Normand Turmalina AHTS vessels are fully owned by Solstad Offshore, while Normand Cutter PSV is owned by Solstad Maritime, in which Solstad Offshore holds 27,3% stake.