Ransomware Trends In The Aviation & Maritime Industries

The latest analysis carried out by by the security assessment and penetration testing experts at Jumpsec examines the reasons why ransomware attacks are on the rise in the aviation and maritime sectors. 

Aviation organisations in particular are experiencing increased levels of ransomware activity.  

In comparison to the 13% jump in total UK attack figures across all sectors from 2021 to 2022, European-wide reported ransomware attacks against the aviation sector rose between January 2021 and October 2022, constituting some 40% of all attacks in the sector, while attacker-reported ransomware incidents against European aviation organisations increased by over 200% in 2022.

But why such a large rise in attacks on this specific sector? Primarily, transport sector organisations have a distinctive profile from an attacker’s perspective, making them a lucrative prospect.

Cyber criminals know transport sector attacks have a high impact. The potential to cause serious business interruption for transport sector organisations is immense - making airports, shipping ports, rail operators and logistics companies prime ransomware targets.

This stands in stark contrast to other sectors, like construction, which attackers may find easy to breach but potentially difficult to extort, due to the inability to cause meaningful disruption. 

The transport sector also offers an extensive attack surface - transport and logistics organisations are highly dependent on supply chain integration and play a key role within the end-to-end value chain. They also use specific technical equipment like satellite communication and IoT technologies, increasing potential attack vectors leveraged by cyber criminals. Jumpsec has observed instances where interconnected shipping organisations were breached concurrently, illustrating the scope of supply chain risks to transport and logistics organisations. 

What’s more, cunning cyber criminals often capitalise on existing disruption. They strike at disrupted organisations to add to the chaos and maximise extortion potential.

Overall shipping and delivery times have risen, as capacity decreased by an estimated 10-15% globally in 2022 and the container shipping sector is reported to still suffering difficulties as a result if the Covid-19 pandemic.  However, attacker motivations for targeting an airport or shipping facility can be more diverse than simply financial gain, given the strategic geopolitical disruption that can be achieved by nation state threat actors and ecologically or politically motivated disruption caused by hacktivists.

Perhaps the most interesting development is the increase of ransomware attacks in the specific transport sub-sectors  of maritime and aviation.  

Sector-By-Sector Breakdown

The scale and ambition of attackers targeting the transport sector has seen a significant increase from 2021-22. In 2021, a considerable proportion of reported attacks were directed at smaller-sized national motor freight businesses . Jumpsec also observed increased attacks in aerospace, airport authorities, airlines, high-end manufacturers and larger international logistics organisations. 

LockBit ransomware  is one of the most prevalent global threat actor and is responsible for the majority of attacks against European transport organisations, but this varies within some specific sub-sectors such as the maritime, for example. In contrast to other notable attackers of European transport organisations, Lockbit has now claimed 62% of transport sector attacks in Jumpsec's initial ransomware figures for 2023. 

Aviation 

Ransomware trends for European aviation organisations have been broadly similar through 2021, 2022 and 2023 so far. ENISA reports that the highest number of attacks were data-related threats (at 44% of all attacks), followed by ransomware, which constituted 40% of attacks in the period assessed. Most notably, ransomware attacks leapt from 8% of annual attacks in 2021 to 32% in 2022.

In terms of sector-specific threats, airline customer data and original equipment manufacturers (OEM) proprietary information are prime assets targeted by attackers in aviation. Fraudulent website impersonation, particularly of airline companies, also became a significant threat in 2022, while ransomware attacks specifically targeting airports have increased.

  • Attacker-reported ransomware incidents against European aviation organisations increased by over 200% in 2022. Lockbit is marginally the most prevalent threat actor, along with a varied list of other groups similarly targeting the sector. 
  • Airlines experienced notable cyber-attacks and data breaches in 2022, including TAP Portugal, SpiceJet and Pegasus, and aviation technology firm Accelya also had sensitive data leaked by ransomware threat actors. 
  • Swissport International was affected by a severe ransomware attack, causing flight delays. The ransomware group responsible (BlackCat) followed up on their threats by leaking data including sensitive documentation, tax declarations, images of passports and ID cards and the personal information of interviewees. 

Maritime

The maritime sector has produced the most insightful findings and Jumpsec report a notable uptake in attacks in the sector as 2022 progressed. Unexpectedly, given Lockbit’s domination of the ransomware space, the PLAY ransomware group is the most prevalent threat to European maritime organisations. PLAY ransomware disproportionately targets European Maritime sector organisations compared to a generally lower volume of attacks when combining UK and Europe. 

Ransomware is the prime threat to the sector, with data from ENISA suggesting that around 27% of attacks featured ransom demands. Data-related threats and malware made up 20% of attacks on the maritime sector, followed by phishing attacks. 

Attacks in this domain are frequently politically motivated, perpetrated by state-sponsored attackers, motivated by a desire to cause operational disruption by targeting ports and vessels. As the sector experiences increasing attack rates, organisations should need no further motivation to build more effective security controls than being aware of the effects of NotPetya, which crippled shipping giant Maersk in 2017 and cost the firm more than US$300m. 

Other Industries

Current or potential supply chain partners across other transport sectors should clearly take appropriate security precautions to protect their organisation. 

Road:   The automotive industry, especially original equipment manufacturers (OEM) and tier-X suppliers has been targeted by ransomware, leading to production disruptions in 2022. Data-related threats primarily targeting IT systems to acquire customer and employee data as well as proprietary information have also been common.
Road sector breakdown 2021 vs 2022. Interestingly for motor racing fans, the company behind Silverstone, which falls outside the usual categorisation, was also attacked in late 2022. 

Logistics:   Road logistics, often standard freight trucks and smaller national-sized companies, were heavily targeted in 2022, however, attack rates reduced in 2022 – perhaps due to a lack of profitability for attackers, as smaller companies may not be sufficiently lucrative targets (as we have seen with the attack rate in education and construction). 

Manufacturers:   There are no records of road transport manufacturers being targeted prior to 2022.  But now, lesser-known road manufacturing companies and high-profile organisations such as Ferrari, Continental and Vauxhall are facing increasing attacks. 

Transport Authorities:   Several regional road authorities in Spain and Portugal have fallen victim to ransomware attacks. However, as is the case with ransomware generally, public sector organisations are generally not frequently targeted (JUMPSEC data shows that <8% of total UK ransomware reports are public sector).

Geo-political attacks:   While far less frequently targeted in geo-politically motivated attacks than maritime or rail for instance, there have been several transport sector attacks linked to hacktivism, relating to the Ukraine war in 2022. 

Jumpsec report several companies not strictly considered to fall within the transport sector - such as large supermarkets with their own in-house logistics operations - are also subject to the same attacks, purely by virtue of being closely intertwined with road transport in terms of logistics. The retail and wholesale trade organisations and transport and logistics organisations should be highly vigilant in relation to potential risks posed by organisations within their supply chain. 

Across all transport-related subsectors, larger, more cyber mature businesses should treat their supply chain (of typically smaller, less mature businesses) as a part of their own organisation’s digital footprint. They should look to leverage their security resources to support and uplift the resilience of the entire supply chain, reducing the overall risk posed to their organisation in the process.

Jumpsec:

You Might Also Read: 

Maritime Technologies Are Transforming The Shipping Industry:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Cyber Security Insurance - What You Need To Know
A House Of Cards »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

British Insurance Brokers’ Association (BIBA)

British Insurance Brokers’ Association (BIBA)

BIBA is the UK’s leading general insurance intermediary organisation. Use the ‘Find Insurance‘ section of the BIBA website to find providers of cyber risk insurance in the UK.

Veridify Security

Veridify Security

Veridify Security (formerly SecureRF), develops and licenses quantum-resistant, public-key security tools for the low-resource processors powering the Internet of Things.

Fox-IT

Fox-IT

Fox-IT prevents, solves and mitigates the most serious cyber threats with smart solutions for governmental bodies, defense, law enforcement, critical infrastructure, banking and large enterprises.

IPQualityScore (IPQS)

IPQualityScore (IPQS)

IPQS anti-fraud tools provide a real-time fraud score to analyze how likely a user or visitor is to engage in fraudulent behavior.

Cyfirma

Cyfirma

CYFIRMA offers Cyber threat visibility and intelligence suite and services aimed at keeping your organization’s cybersecurity posture up-to-date.

IAmI Authentications

IAmI Authentications

IAmI is a first in Tokenization Cloud-based IAM Security Services, delivering the most advanced form of Two-Factor Authentication.

DataDome

DataDome

DataDome offers real-time AI protection against all OWASP automated threats, including credential stuffing, layer 7 DDoS attacks, SQL injection & intensive scraping.

Bradley-Morris

Bradley-Morris

Bradley-Morris is a leading recruiting firm specializing in transitioning military and veteran talent into civilian careers including Cybersecurity.

Illuma Labs

Illuma Labs

Illuma Labs delivers real-time voice authentication and fraud prevention solutions.

Zephyr Project

Zephyr Project

The Zephyr Project strives to deliver the best-in-class RTOS for connected resource-constrained devices, built to be secure and safe.

Avetta

Avetta

Avetta One is the industry’s largest Supply Chain Risk Management (SCRM) platform. It enables clients to manage supply chain risks and suppliers to prove the value of their business.

Acrisure

Acrisure

Acrisure is powered by the best of human and high-tech and offers insurance, reinsurance, real estate, cyber and more solutions to millions of clients around the world.

Paubox

Paubox

Paubox offers secure, HIPAA compliant email and marketing solutions to fit the needs of modern healthcare organizations of every size.

Normalyze

Normalyze

Normalyze are solving some of the most painful problems enterprise IT security teams face in the cloud and data security space. We help enterprises protect all the data they run in the cloud.

COPA-DATA

COPA-DATA

COPA-DATA is the only independent software manufacturer to combine in-depth experience in automation with new possibilities of digital transformation – reliable, future-proof and operating worldwide.

Bulletproof Solutions

Bulletproof Solutions

Bulletproof provides IT expert support, services, and guidance to businesses small and large as they grow and adapt to today’s complex IT, cybersecurity, and compliance needs.