Good Morning Port Partners and Maritime Sector Stakeholders,
 
Given the ongoing activities in the Middle East, we wanted to provide you with an update on the cybersecurity threat situation here domestically as well as provide some resources and recommendations to assist you in securing your systems from outside threats.
 
While much of the overt cyber conflict is focused on the immediate combat zone, intelligence from CISA and the FBI indicates that Iranian-aligned threat actors are actively scanning and targeting U.S. networks. This cyber Attack Dashboard provides a clearer picture of the threat landscape: SOCRadar Iran-Israel Cyber War Dashboard.

A recent destructive cyberattack against a U.S. corporation, claimed by the Iranian threat group 'Handala', underscores the reality of this threat to domestic entities. (Iranian Hacktivists Strike Medical Device Maker Stryker in "Severe" Attack that Wiped Systems.   We have a list of Handala’s Indicators of Compromise (IOC’s) from CISA, including domain names, IP addresses, and hash values. As this list is designated TLP:AMBER, please contact me directly for a copy, as it cannot be shared in a group email.
 
We urge all maritime organizations to take immediate defensive measures. At a minimum, you should:

• Enforce Multi-Factor Authentication (MFA) on all critical and remote access systems.
• Aggressively patch known exploited vulnerabilities.
• Review and test incident response and data backup plans.
• Heighten employee awareness of phishing attempts.

 
For detailed intelligence, specific vulnerabilities being targeted, and comprehensive mitigation strategies, please review the attached advisories. We particularly recommend starting with the "Joint Advisory on Middle East Conflict" and the "Cybersecurity Control Measures for MARSEC Levels."  The following sites may also be referenced for additional information:
FBI Iran - Cyber Threat Overview: Iran — FBI
CISA Iran - Iran Threat Overview and Advisories | CISA
CISA Shields up - Shields Up | CISA
What Defenders Need to Know about Iran’s Cyber Capabilities - Check Point Blog
Surface Transportation Cybersecurity Toolkit | Transportation Security Administration

For our MTSA entities, breaches of security and suspicious activity incident reporting, including cyber incidents, are described in Navigation and Vessel Inspection Circular (NVIC) 02-24, Change 1. 
 
Thank you for your continued vigilence.  Please reach out to me with any questions or concerns.   In case of emergencies or if you need immediate assisteance, we can always be reached 24/7 thru our Sector Charleston Command Center at 833-453-1261.  Reports of Cyber Incidents, inclduing suspcious activities, should be reported to the National Response Center at 1-800-424-8802 in accordance with NVIC 02-24. 
 
Very Respectfully,

Bryan Johnson
Marine Transportation System Specialist - Cybersecurity
Prevention Dept
Sector Charleston, U.S. Coast Guard
Office: (571) 607-5409