Coast Guard cyber teams found malicious activity aboard Texas-bound tanker and second vessel in Gulf of Mexico

The engine-room interference and the roughly 30-hour communications outage rest on Mehr News Agency's Aug. 20 report, sourced to an unnamed crew member ^[7][8]. Iranian state media was circulating the story before US authorities acknowledged the boarding ^[27]. Mehr published 13 days after the date it gave for the attack ^[29].

The Coast Guard has not publicly linked either attack to Iran, and investigators are still working out whether the two incidents are connected ^[12]. "They started out by doing an assessment of the information technology and the other systems on board the vessel, and they did find malicious cyber activity," Grable told CBS News ^[11]. She said nothing found during the inspection suggested the tanker was unsafe to operate ^[13]. The boarding party arrived on Aug. 21, one day after Mehr published, and stayed four days ^[9]. The second ship was boarded on Aug. 24, according to The Wall Street Journal ^[10].

Quinton DuBose, a former Coast Guard cyber official, disputed the idea that hackers could take full command of a supertanker and said the realistic risk is degrading enough individual systems to make safe operation difficult, SecurityWeek reported ^[21]. He urged caution about the Iranian coverage, noting that Iran-linked actors have a history of overstating their cyber capabilities ^[22]. The Wall Street Journal reported in June that Coast Guard cyber teams have been investigating dark fleets carrying sanctioned Iranian and Russian oil, which rely on digital masking and carry enhanced cyber risk ^[25].

Aboard, the teams hunted for malware and looked specifically at whether the vessels' IT systems were connected to propulsion, navigation and other critical safety systems ^[19]. On some vessels, according to Security Affairs, satellite internet is separated from those systems by little more than a firewall, with navigation, propulsion, steering and ballast sharing one network ^[20].

Grable put the boarding among roughly 40 to 50 missions the Coast Guard's Cyber Protection Team has run in the past year ^[14]. That is a vessel every seven to nine days ^[15]. She also said about $5.4 trillion in commerce moves through US ports annually ^[16], which works out to close to $15 billion a day ^[17]. "Of course we're worried about a collision, an explosion, anything that blocks the channel for other vessels to safely enter and exit the port, pollution incidents," Grable said ^[18].

The boardings came days after the Coast Guard announced an Office of Maritime Cybersecurity Policy as its central authority for cyber safety and security policy across the marine transportation system ^[23]. Its authority to respond offshore dates to an executive order signed in 2024, which cited the risk that a maritime cyber incident could cause cascading harm to the global supply chain ^[24].