State-linked Chinese hackers have continuously intensified cyber attacks on maritime organizations in Europe. These threats are specifically focused on shipping, and the European Union Agency for Cybersecurity (ENISA) has pointed this out.
Increase in Cyber Attacks
A recent report by ENISA titled "Threat Landscape 2026" shows that China-linked groups have been particularly active in communications, shipping, semiconductors, manufacturing, and government organizations in 2025. Among these groups, "Mustang Panda," also known as "Earth Preta," has consistently carried out cyber attacks on maritime-related organizations in at least seven EU member countries.
Read more: WIND Acquires Shares of Tricore to Enhance Expertise in Cable Lifecycle
This group employs various methods such as targeted phishing, infected USB drives, and various malware, including customized versions of the remote access tool "PlugX." The main objective of these activities is to gather information and conduct cyber espionage to cause immediate operational disruption.
Impact on the Transportation Sector
Last year, the transportation sector accounted for 8 percent of all cyber incidents recorded by ENISA, with maritime transport making up 16.4 percent of incidents in the transportation sector. ENISA has also classified the maritime and rail sectors as "cyber risk areas" due to their heavy reliance on diverse and interconnected systems.
These findings continue patterns identified in previous years. In 2022, a report was published indicating that "CyberOwl" had discovered government-linked malware from the "PlugX" family on seven vessels belonging to a large shipping fleet. This malware provides attackers with remote access and complete control over infected computers, allowing them to manipulate files, execute commands, and spread within local networks.
Increase in Maritime Cyber Incidents
Recently, a report was released indicating that maritime cyber incidents saw a 103 percent increase in 2025. Infected USB drives have been one of the primary methods for introducing remote access malware into bridge systems. This combination is particularly associated with the "Mustang Panda" group, as the use of infected portable media may provide a pathway to maritime systems that their owners may believe are isolated from the internet.
ENISA has also pointed to broader Chinese campaigns targeting network infrastructure. China-linked groups are increasingly compromising routers and other edge devices, both for information theft and for using compromised infrastructure as gateways for subsequent attacks.
This warning comes as ship connectivity is rapidly increasing. Recently, reports have emerged showing assessments conducted by South Korean cybersecurity expert "CYTUR" identifying significant vulnerabilities requiring risk mitigation in most examined ship systems.
Read more: Ring Power Partnership with Cox Marine Expands in North America
