Suspected cyber attack on supertanker VL Prosperity prompts US Coast Guard and FBI boarding
The US Coast Guard and FBI boarded the Liberian-flagged supertanker VL Prosperity mid-voyage after its network may have been compromised by a foreign actor. The vessel was carrying about 2.3 million barrels of crude oil from Egypt's Sidi Kerir terminal to Galveston, Texas. The Coast Guard reports no disruption to operations, injuries or environmental impact. No attribution has been presented, and the article notes that any link to Iranian-backed actors is speculation without evidence.
Detalhes técnicos
- The ship left Egypt on August 1. About a week later, near the Strait of Gibraltar, attackers allegedly penetrated its systems, interfering with fuel systems and engine speed and cutting communications for roughly 30 hours.
- A specialised FBI and Coast Guard team boarded the vessel two weeks later and spent four days investigating and helping the crew eradicate the threat from both IT and OT systems.
- OT expert Rob Lee told CBS News that large tankers may run navigation, propulsion, steering and command on a shared network behind a single firewall. Once that boundary is breached, interference with critical ship systems becomes possible.
- Rear Adm. Amy Grable, commander of Coast Guard Cyber Command, said attacks need not be sophisticated, that malicious code is readily available, and that AI is accelerating the pace of threats.
- The article does not state the initial access vector, malware or IOCs.
Remediação
- Grable recommends network segmentation, awareness of phishing attacks and basic cyber hygiene, saying basic precautions would prevent most such incidents.
Linha do tempo
-
Suspected cyber attack on supertanker VL Prosperity prompts US Coast Guard and FBI boarding
ler a análise desta fonte ocultar
The US Coast Guard and FBI boarded the Liberian-flagged supertanker VL Prosperity mid-voyage after its network may have been compromised by a foreign actor. The vessel was carrying about 2.3 million barrels of crude oil from Egypt's Sidi Kerir terminal to Galveston, Texas. The Coast Guard reports no disruption to operations, injuries or environmental impact. No attribution has been presented, and the article notes that any link to Iranian-backed actors is speculation without evidence.
Technical Details
- The ship left Egypt on August 1. About a week later, near the Strait of Gibraltar, attackers allegedly penetrated its systems, interfering with fuel systems and engine speed and cutting communications for roughly 30 hours.
- A specialised FBI and Coast Guard team boarded the vessel two weeks later and spent four days investigating and helping the crew eradicate the threat from both IT and OT systems.
- OT expert Rob Lee told CBS News that large tankers may run navigation, propulsion, steering and command on a shared network behind a single firewall. Once that boundary is breached, interference with critical ship systems becomes possible.
- Rear Adm. Amy Grable, commander of Coast Guard Cyber Command, said attacks need not be sophisticated, that malicious code is readily available, and that AI is accelerating the pace of threats.
- The article does not state the initial access vector, malware or IOCs.
Remediation
- Grable recommends network segmentation, awareness of phishing attacks and basic cyber hygiene, saying basic precautions would prevent most such incidents.