The maritime logistics sector is navigating turbulent waters. As shipping routes become geopolitical focal points and port operations rely more heavily on digital execution, the maritime attack surface is expanding rapidly.
To help defense teams navigate this shifting environment, U.S. Coast Guard Cyber Command (CGCYBER) released its fifth annual Cyber Trends and Insights in the Marine Environment (CTIME) report.
Grounded in data collected from 42 comprehensive operations conducted by Coast Guard Cyber Protection Teams (CPTs) and industry incident telemetry, the report provides a vital roadmap for securing the Marine Transportation System (MTS).
The headline metric from the report demands immediate attention: reported maritime cyber incidents spiked 17% over the previous calendar year. Here is what the data reveal about this evolving threat landscape and what it means for critical infrastructure protectors, corporate legal teams, and the general public.
The critical shipping industry and ports: target systems
For ports and the global shipping firms that keep supply chains moving, the Cyber Trends and Insights in the Marine Environment report isolates two major operational realities: the vulnerabilities embedded in terminal logistics software and the aggressive exploitation of foundational access vectors.
Terminal Operating Systems (TOS) under scrutiny
For the first time, CGCYBER dedicated multiple targeted assessment missions to Terminal Operating Systems—the specialized software responsible for managing yard stacking, gate automation, and rail operations. Because a modern TOS orchestrates everything from automated cranes to waterside berth management, compromising it can instantly halt port productivity and cause catastrophic financial exposure. The CPT assessments exposed several recurring operational gaps across these networks:
-
Public exposure of internal assets: Internal login portals and administrative panels left entirely exposed to the public internet without firewall isolation.
-
Legacy architecture anchors: Active reliance on end-of-life, unpatched infrastructure—including legacy versions of Windows Server 2008 supporting core terminal functionality.
-
Bridged perimeters: Improper or entirely missing network segmentation, allowing commodity IT traffic to coexist alongside sensitive, operational TOS environments.
-
The persistence of fundamental attack vectors: Despite widespread enterprise cloud migrations and growing multi-factor authentication (MFA) adoption, threat groups are achieving consistent success by simply refining classic attack methodologies.
Phishing remains the undisputed preferred pathway for initial access, contributing to 43% of all reported maritime incidents—a major 18-point increase year-over-year. Ransomware also remains a persistent menace, appearing in 19% of attack paths.
Sophisticated threat syndicates like Scattered Spider are exploiting these gaps by combining advanced phishing with voice impersonation (vishing) campaigns to compromise IT help desks and bypass poorly-configured MFA parameters.
The global joint front: enter the cyber control teams
One of the most notable additions to the report details how CGCYBER is projecting federal defensive capabilities beyond traditional coastlines. To protect strategic maritime interests, specialized Cyber Control Teams forward-deployed alongside traditional law enforcement and assault boarding units during Maritime Interdiction Operations targeting Dark Fleet Vessels.
"The collaborative work between our exceptional workforce and our partners in the public and private sectors is the true foundation of our ability to secure our ports and waterways against any threat," said Rear Admiral Jason Tama, Commander, Coast Guard Cyber Command.
Operating intentionally outside international oversight, these stateless or foreign vessels bypass standard security frameworks, introducing severe operational risk to global waters. The Cyber Control Teams documented pervasive threats aboard these vessels, including the deployment of Lumma Stealer malware, persistent remote access tools configured for unattended connections (AnyDesk, ScreenConnect), and specialized hardware setups designed to execute Automatic Identification System (AIS) spoofing to mask illicit maritime trade routes.
What this means for the general public
While the maritime network layer feels distant from the everyday consumer, its stability directly impacts global safety and economic health.
-
Supply chain continuity: The Marine Transportation System handles approximately 40% of U.S. international trade value. A successful cyberattack targeting a major port terminal's TOS can trigger immediate downstream cargo stagnation, causing manufacturing delays, localized store shortages, and increased consumer costs.
-
Physical and environmental safety: The report documents instances where ransomware successfully compromised passenger cruise ships, encrypting onboard hotel management applications. While network segmentation preserved critical steering and propulsion systems, the convergence of IT and OT means that unsegmented port networks or compromised container ships introduce very real physical navigation hazards to public waterways.
The artificial defender: lessons on AI implementation
The report also provides a crucial reality check for security vendors and enterprise technology teams rapidly deploying automated safeguards.
In 2025, Coast Guard CPTs evaluated several maritime partners that had fully integrated Artificial Intelligence Cybersecurity Platforms into their defensive perimeters. The operational returns were highly polarized, demonstrating that AI is not a plug-and-play cure.
-
The configured value: In a properly configured environment where the AI tool was trained to understand the baseline behaviors of the network, it proved exceptional—detecting and blocking custom intrusion scripts within 30 seconds.
-
The default vulnerability: Conversely, when organizations deployed these tools with default out-of-the-box settings and failed to tune them to their unique technical architecture, the AI platforms failed to detect any malicious red-team behaviors.
-
The CISO takeaway: Advanced tooling is only as effective as its configuration. Capital investment must always be matched with proper environment setup and persistent data governance.
For security practitioners operating across the maritime domain, the timeline for compliance has officially begun. The Coast Guard’s 33 CFR Part 101 Subpart F regulations are now active, making cyber incident reporting mandatory for MTSA-regulated facilities. Organizations have until July 16, 2027, to complete formal Cybersecurity Assessments and submit their final Cybersecurity Plans for official review.
