The Korea Internet & Security Agency (KISA) has organised a joint cyber incident response exercise in Busan, bringing together five shipping companies and several maritime industry organisations to test their ability to detect, share information about and respond to cyber threats targeting vessels and shore-based operations.
The exercise involved HMM Ocean Service, POS SM, Hyundai LNG Shipping, and G-Marine Service. Pan Ocean participated as an observer. Other participants included the Korea Coast Guard, Korea Shipowners’ Association and Korea Ship Managers’ Association, while Korea Maritime and Ocean University, IGLOO Corporation and Korean Register attended as observers.
Supply Chain Attack Scenario Targets Shipboard Systems
The exercise simulated a multi-stage cyberattack beginning with an attacker impersonating a port authority to distribute malicious emails to shipping companies and vessels.
The scenario then escalated through a compromised supplier computer, which was used to manipulate a software update intended for a vessel. Once deployed, the altered update infected onboard computers and communications servers, disrupting communications between ships and shore-based operations.
The scenario highlighted the potential consequences of compromised third-party systems and software supply chains, particularly where shipping companies depend on external suppliers for software updates and technical services.
Four Stages of Incident Response
The exercise was structured around four stages, covering phishing detection and information sharing, malware removal and system recovery, supply chain attacks involving AI-based attack tools, and coordinated incident analysis.
Responsibilities were distributed among the participating companies. G-Marine Service handled the initial identification of suspicious emails and the exchange of threat information. Hyundai LNG Shipping and KLNG focused on malware removal and system recovery, while HMM Ocean Service and POS SM addressed the simulated supply chain intrusion.
KISA and other participating organisations supported incident analysis and the exchange of cyber threat intelligence.
Industry-Wide Threat Intelligence Sharing
A key objective was to assess how cyber threat information identified by one shipping company could help other operators detect and prevent similar attacks.
This approach reflects a growing concern within the maritime sector: vulnerabilities affecting shared systems, software providers and service suppliers can potentially expose multiple shipping companies to similar cyber threats.
KISA stated that the findings would be shared with participating companies to support improvements to their individual cyber incident response procedures.
