NATO warns of state-linked cyberattacks on Europe’s civilian ports, exposing critical gaps in maritime defense

Anna Ribeiro

This briefing was first published by Industrial Cyber on 28 July 2025 and is republished with the kind permission of the author

Maritime ports, responsible for 80 percent of global trade and serving as critical NATO logistics hubs, are facing a surge in cyberattacks from state-linked actors, according to a new policy brief from the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE). The report highlights a sharp rise in threats targeting European and Mediterranean port facilities, with many attacks traced to Russia, Iran, and China. It revealed that nearly all surveyed countries have experienced cyber attacks within the past five years, with access control systems and vessel traffic management systems identified as the main reported risks.

As cyber operations increasingly disrupt access control and vessel traffic systems, the lack of clear coordination between military and civilian stakeholders is becoming a strategic vulnerability. Despite the civilian ownership of most port infrastructure, these facilities play an essential role in NATO’s defence network, yet NATO’s current maritime strategy lacks formal frameworks for engagement with commercial port operators, despite their critical role in maritime security and NATO logistics operations.

In its policy brief titled, ‘Addressing State-Linked Cyber Threats to Critical Maritime Port Infrastructure,’ NATO CCDCOE identified that maritime port facilities face a range of threats from state-sponsored advanced persistent threats (APTs), financially motivated cybercriminals, and politically driven hacktivists. These threats are remarkably consistent regardless of geographical location, and the tactics, techniques, and procedures (TTPs) are the same if not identical across Europe, the Americas, and the Asia Pacific regions. 

Read the full analysis in the attached pdf.