Iran-Linked Hackers Mapped Ship AIS Data Days Before Real-World Missile Strike Attempt

"The development is a sign that the lines between state-sponsored cyber attacks and kinetic warfare are increasingly blurring, necessitating the need for a new category of warfare, the tech giant's threat intelligence team said in a report shared with The Hacker News. While traditional cybersecurity frameworks have treated digital and physical threats as separate domains, CJ Moses, CISO of Amazon Integrated Security, said these delineations are artificial and that nation-state threat actors are engaging in cyber reconnaissance activity to enable kinetic targeting."

"As an example, Amazon said it observed Imperial Kitten (aka Tortoiseshell), a hacking group assessed to be affiliated with Iran's Islamic Revolutionary Guard Corps (IRGC), conducting digital reconnaissance between December 2021 and January 2024, targeting a ship's Automatic Identification System (AIS) platform with the goal of gaining access to critical shipping infrastructure. Subsequently, the threat actor was identified as attacking additional maritime vessel platforms, in one case even gaining access to CCTV cameras fitted on a maritime vessel that provided real-time visual intelligence."

Nation-state threat actors with ties to Iran are conducting cyber reconnaissance specifically to facilitate physical, real-world attacks, a practice labeled cyber-enabled kinetic targeting. Traditional cybersecurity frameworks that separate digital and physical threats are proving inadequate as adversaries integrate cyber and kinetic operations. Observed activity by Imperial Kitten (aka Tortoiseshell), assessed as affiliated with the IRGC, included AIS targeting from December 2021 to January 2024 and access to maritime CCTV for real-time intelligence. Targeted AIS searches on January 27, 2024 preceded a missile strike days later on the same vessel by Iranian-backed Houthi militants. The pattern underscores the need for updated defensive approaches addressing combined cyber-to-kinetic campaigns.

Read at The Hacker News