According to the Cybersecurity Threat AgencySOCRadar，includingPremierAllianceONEIncluding Zhenhua Heavy Industry, Zhonglian Shipping, Dexiang Shipping, Busan New Port, etc38Home port shipping institutions and enterprises are subjected to hacker extortion, extortion ransom240From 10000 US dollars to1400Ten thousand dollars or more。
10moon12Day, hacker organizationn0nA group of maritime industry companies have been posted on the dark web, claiming to have stolen their data and threatening them,10moon19Recently, without paying the ransom, the data of these companies was released.At present, these companies have not publicly confirmed any system intrusion or data leakage incidents. According to the port circle, a company involved who does not want to disclose their identity stated that this extortion incident mainly targeted Cyberlogitec, a South Korean software company that the above-mentioned companies cooperate with, and did not directly extort these companies. Cyberlogitec is currently cooperating with KISA to actively deal with this matter.
Channels
38 port and shipping companies were extorted! Involving well-known port and shipping companies and upstream and downstream enterprises such as Zhenhua Heavy Industry, Zhonglian Shipping, Dexiang Shipping, Busan New Port, Algeciras TTI Terminal, Oumen Group Tangier Container Terminal, Ocean Connected Shipping (ONE), Premier Alliance, etc. #Hacker # Network Security # Port # Dock # EDI
The stolen data mainly consists of operational data, includingEDIMessage and business exchange data (shipping schedule, container manifest, etc.), on-site operation records (gate entry and exit, equipment handover, and container damage, etc.), system configuration and deployment information, commercial and financial records, accounts and credentials, etc. Victims are distributed in18All countries are engaged in port, shipping, and logistics related businesses, with Korean companies accounting for12home,The largest quantity.
Hackers roughly divide these companies into five categories based on their business types. The first type is terminal operators,together12Home, including BrazilSantos Brasil、PortonaveandSuperterminais，And the Busan New Container Terminal and Busan New Port Company in South Korea. The rest are scattered around the world,They are the ports of Asia in Türkiye and Algeciras in SpainTTIPort, Tangier Container Terminal of Euromen Group in Tangier, Morocco, and Kandla Port in IndiaNCTDock, Nam Dinh Wu Port in Vietnam,And Saudi Arabia's New Future City Port.
The second type is portsIT、EDIAnd terminal system service providers,together5Home. These types of enterprises do not operate docks themselves,The main business is to safeguard and exchange operational data for ports and shipping companies,includingGNCNet/DGT Busan、GCS Kuwait、ILCS Pelindo、HPC Hamburg Port Consulting, andT2S。
The third category includes shipping companies and ship operators,together10Home. Except for the sixth largest shipping company in the worldONE，There are also China's Zhonglian Shipping and Dexiang Shipping, South Korea's Polaris Shipping, East Asia Tanker, Three Continents Shipping, and South Korean Ferry, Japan's Camellia Shipping and Changshi Shipbuilding/Shenyuan Steamship,Samudra in Indonesia(Samudera)。
The fourth category includes agencies, logistics, storage yards, and inspection institutions,together8Home. South Korea accounts for3Home:Shihan Shipping, Yuxiu Logistics, andBKHInland container yard, Indonesia hasApril AsiaandGlobalNet LCLThe rest3Home are Japan Post Shipping Logistics(Hong Kong)The Netherlands'PremierThe Alliance and the United KingdomBMT IQIt is worth noting that, PremierAlliance byONE、HMMAlso composed of Yangming Shipping, but listed as a Dutch company by hackers, possibly due to a misclassification.
The fifth category is related industry enterprises,together3Home, they areZhenhua Heavy Industry, Peak Group, and Dongguo Steel.
Each victim of extortion is marked with the words' exposed without payment 'and a countdown for exposure has been set
The practice of extortion is quite distinctive, with the victim's page displaying "unpaid"-The words' exposure ',There is also a countdown, with each page marked with a fixed USD ransom and corresponding Bitcoin address,Hackers claim to destroy data and remove pages after payment.n0nThe price varies for each victim, and Yuxiu Logistics only60MBData, but requires1400A ransom of ten thousand dollars,ILCS Pelindo 2.4GBThe data, asking price240Ten thousand dollars, and some victims need to pay first10%The entrance fee is required to enter the private negotiation room for negotiations.
n0nHe's a new face,SOCRadarIt is called a hacker gang with the goal of making money,2026year9The moon appeared for the first time,Suspected to be from Russia. The previous victims involved various industries such as investment, telecommunications, retail, education, and pharmaceuticals,This time, it mainly targets the maritime industry, and the victims of extortion are mostly in the Asia Pacific region.
If the stolen data is true, these operational data may expose the flow of goods, booking relationships, and partner information,Affected shipping companies and shippers who have dealings with these institutions; System configuration, deployment materials, and credentials may be used to launch subsequent attacks; Business records such as invoices and prepaid accounts,May involve commercially sensitive information of customers.
The most eye-catching,The data may come from the same source. Due to the similarity of the leaked data content,SOCRadarIt is speculated that the data source may be a shared platform among multiple companies, which also means that the affected objects may exceed38Home, other users who have used related platforms and exchanged with themEDIThe shipping companies and partners of the data may also face the risk of data leakage.
Maritime Network Security CompanyCydomeIt is speculated that this incident may be related to a South Korean maritime software supplierCyberLogitecrelatedCyberLogitecBoth Yuxiu Logistics (one of the extorted individuals) are subsidiaries of Yuxiu Holdings, providing terminalsTOSAirline routes, cargo management systems, freight forwarding software, etc.CyberLogitecThe Terminal Operating SystemOPUS TerminalDeploy globally30Multiple docks were extorted this time12Among the dock operators, there are9Everyone at home has used itTOS。ONEShenyuan Steamship and others also use other software from the company.
Port Circle（ID:gangkouquan)It is believed that,Cyber attacks are not uncommon in the maritime industry, including Maersk, Daffy, Nagoya Port, and AustraliaDP WorldDocks and other facilities have been subjected to cyber attacks or extortion, resulting in operational interruptions and other consequences.
With the acceleration of digitalization in the industry, network security has become increasingly important, and the threshold for network attacks is decreasing. At the same time, the difficulty of security defense is increasing, and even multiple top tier companies are facing challengesAIThe companies have all appearedAIAn event that crosses the network defense line. Although many domestic port enterprises have chosen self-developed software to ensure system autonomy and controllability, this does not mean that security, vulnerabilities, account management, and third-party data sharing all require continuous protection. In film and television works, it is often depicted that a cyber attack causes a global supply chain shutdown. In the future, this phenomenon is likely to exist beyond imagination.
