U.S. Coast Guard personnel and FBI agents boarded two Texas-bound energy tankers last month after cyberattacks struck the vessels while they were traveling toward the United States, according to U.S. officials.

One of the vessels was the VL Prosperity, a 1,093-foot Liberian-flagged crude oil tanker headed to Galveston, Texas. Iranian state media identified the ship shortly after the incident and claimed hackers had gained access to its propulsion, navigation and cargo systems, knocking out communications for 30 hours.

The Coast Guard has not publicly pinned the attacks on Iran. But Rear Adm. Amy Grable, commander of U.S. Coast Guard Cyber Command, told WTX US News in a network exclusive interview that investigators did find evidence of a malicious cyber actor. 

“They started out by doing an assessment of the information technology and the other systems on board the vessel, and they did find malicious cyber activity,” Grable said.

The U.S. is investigating whether the two cyberattacks are connected and whether Iran or another foreign adversary was behind the attacks.

What happened?

The VL Prosperity is what’s known as a supertanker — more than three football fields long and capable of carrying roughly 2.3 million barrels of oil. 

Public vessel data shows the ship departed Egypt’s Sidi Kerir oil terminal on Aug. 1 headed for Galveston. U.S. officials say it slowed near the Strait of Gibraltar around the time of the cyberattack before continuing across the Atlantic and toward the U.S.

Iran’s Mehr News Agency reported on Aug. 20 that the VL Prosperity had been attacked on Aug. 7 while transiting through the Strait of Gibraltar. Citing an unnamed crew member, Mehr alleged hackers breached the engine room, reducing engine cooling flow, increasing engine speed and interfering with fuel systems.

Rob Lee, CEO of Dragos, an industrial cybersecurity firm specializing in operational technology, said the Iranian report’s details were technically plausible, but warned that authorities have not yet revealed who was behind the incident. 

“The details that they published, from what we understand of these types of vehicles and ships and similar, is spot on,” Lee said. “Everything they’re saying is very realistic.”

The next day, Aug. 21, Coast Guard cyber personnel, law enforcement officers, a vessel inspector and FBI Cyber Action Team operators boarded the ship for four days. 

Grable said Coast Guard teams had been alerted by interagency partners and went offshore with the FBI to climb aboard — one of roughly 40 to 50 missions the Coast Guard’s Cyber Protection Team has undergone in the past year.

She said investigators were hunting for malware and combing through information technology systems to root out malicious activity.

“The real thing we’re concerned about is those IT systems being connected to other systems on the ship that control propulsion, navigation and other systems that are critical to the safety of that vessel,” Grable added.

Typically, investigators collect data that is later analyzed, and Grable told WTX US News that the Coast Guard plans to provide the vessel owner with recommendations for patching vulnerabilities. She stressed that response teams did not find any evidence indicating the ship had become unsafe to navigate when they boarded it.

How difficult is it to attack a ship?

The concern surrounding large cargo vessels and maritime critical infrastructure transcends stolen files or disrupted communications.

More and more, modern commercial vessels run on internet-connected systems, relying on them for navigation, propulsion, steering, ballast and additional critical machinery. A cyberattack that penetrates those operational systems could potentially be weaponized or manipulated. 

“When these vessels are highly connected, they’re susceptible to cyber threats,” Grable said, warning that an attack could lead to “a vessel blocking a waterway or a pollution incident or any other number of safety and security hazards to our ports and waterways.”

The danger that a large vessel could be compromised near an American port is something that authorities fear.

“Of course we’re worried about a collision, an explosion, anything that blocks the channel for other vessels to safely enter and exit the port, pollution incidents — we’re kind of worried about the whole gamut,” Grable said.

The potential economic impact is also colossal. Grable said $5.4 trillion in commerce flows through U.S. ports annually — which could mean high economic stakes for even a relatively small disruption.

“Any small delay, because of a cyber breach, like, for example, if a port has to shift to manual operations, it causes a big delay with tankers and cargo vessels coming in and out of the port,” she said.

Perhaps most concerning, Grable said the technical barrier may not be as high as the public assumes.

How sophisticated would an attacker have to be to move beyond breaking into a computer network to manipulating machinery aboard a modern tanker?

“Not necessarily that sophisticated,” Grable told WTX US News. “There is malicious source code that people can get their hands on.”

Grable said that code is available right now, and added that “artificial intelligence is accelerating the rate at which we need to take action.”

She urged operators to zero in on network segmentation, phishing attacks and basic cyber hygiene. “Just taking basic precautions would prevent most of these occurrences.”

Just one firewall away 

On many ships, the barrier between a satellite internet connection and critical onboard systems can be as fragile as a single firewall.

Behind that firewall, Lee said, can be a shared network containing “navigation, propulsion, ballast, steering, ship command — everything on one shared network.”

Lee explained that artificial intelligence could make that problem worse because it can assist attackers in picking out weakly protected systems, speeding up attempts to breach internet-facing systems on energy carriers.

“The very thing that we think is our one protection — not that you should have one protection — is the very thing that AI is actually really good at,” Lee said.

Still, experts concede that while older vessels may not have the same digitally connected control systems, even on modern ships, reaching critical machinery still requires some knowledge of the onboard environment.

Is ‘remote hijacking’ a real threat?

Asked whether cyber access to a ship could amount to a form of remote hijacking, Grable called it a fair description of the broader risk.

“That’s a good way to characterize it, and yes, it is a concern,” she said.

Lee agreed that the scenario is realistic if an attacker gains a foothold. 

“I do think there’s a realistic concern,” Lee said, describing the possibility of remotely messing with a maritime asset, even running it aground.

But former Coast Guard cyber official Quinton DuBose seemed skeptical of the notion that hackers could simply take over an entire supertanker like a remote-controlled vehicle.

“I’d be kind of cautious about saying that somebody can just take control of the ship,” DuBose said. “Ships are incredibly complicated systems.”

The more realistic threat, he said, may be an attacker disrupting one or more critical subsystems enough to make the vessel unsafe.

“Rather than looking at it as, ‘okay, I’m going to take full control of this thing,’ it’s, ‘what systems can I disrupt to the point where it affects the safe handling and makes the ship less safe to operate,'” DuBose said.

Iranian state media claims under scrutiny

The U.S. has not publicly stated who is behind either cyberattack. But Iranian state media began pushing out content around the VL Prosperity incident before U.S. authorities even publicly acknowledged the boarding.

Four days after Mehr’s initial report, Iran’s Tasnim News Agency published an article with the headline, “No American Vessel Is Safe Anymore: Will Cannons Give Way to Codes?”

DuBose stressed that the Iranian narrative remains unverified, cautioning that Iranian-linked actors are often quick to oversell their cyber influence. 

Attribution in cyberspace can take weeks or months, DuBose added. 

According to Grable, investigators typically compare the attacker’s tactics, techniques and procedures — effectively their digital fingerprints — against known threat actors.

“We look at things called TTPs, which are tactics, techniques and protocols that certain adversaries use — kind of like their trademark fingerprints on how they gain access to systems and what they do and what their payloads are,” she said.

A warning to the maritime industry

For Coast Guard Cyber Command, the growing concern is that increasingly connected vessels create more porous entry points for attackers, as ships adopt satellite communications and connect IT networks with their onboard control systems.

“Because they’re facing the internet, that is a vector for attackers to gain access and deploy malicious activity on the vessels,” she said.

DuBose said the industry should take the threat seriously, while resisting the notion that all vessels are suddenly vulnerable to remote takeover.

He added that maritime infrastructure is so critical that the federal government “has increasingly imposed baseline cyber requirements across the sector.”

Grable’s warning to vessel owners and operators was blunt: “We need everybody to pay attention to this.”