Adriatic Port Cyber-Attack Sparks Warning Over Maritime Security
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-26399 | Unauthenticated Deserialization RCE in SolarWinds Web Help Desk SolarWinds Web Help Desk contains an unauthenticated deserialization of untrusted data vulnerability (CWE-502) in its AjaxProxy component that allows remote attackers to run arbitrary commands on the host machine without any credentials or user interaction. It is triggered by sending a crafted request to the AjaxProxy endpoint of an affected Web Help Desk installation. Successful exploitation yields full code execution on the server, and the flaw is known to be used in ransomware campaigns. Any organization running SolarWinds Web Help Desk is affected, including installations already patched for the earlier CVE-2024-28988 and CVE-2024-28986, since this flaw is a patch bypass of both. The flaw carries a very high exploitation probability (EPSS ~89.5%) and was added to CISA's Known Exploited Vulnerabilities catalog on 2026-03-09 with known ransomware use. Do: Immediately apply SolarWinds' hotfix for CVE-2025-26399 per the vendor's instructions — organizations that previously patched CVE-2024-28988 or CVE-2024-28986 must apply the new hotfix because those patches do not close this flaw. If the hotfix cannot be applied right away, restrict network access to Web Help Desk (firewall/VPN, limit exposure of the service to the internet) and discontinue use if mitigations are unavailable, per CISA KEV/BOD 22-01 guidance. Given known ransomware use, review Web Help Desk hosts for signs of compromise, including unexpected process execution and accounts or data accessed via the server. | 9.8 | 90% | KEV ransomware |
| moderatelow thousands of internet-exposed Web Help Desk instances, with a total on-prem install base plausibly in the tens of thousands | |
| CVE-2025-5777 | Out-of-Bounds Read (Memory Overread) in Citrix NetScaler ADC and Gateway Citrix NetScaler ADC and NetScaler Gateway contain an out-of-bounds read (CWE-125) caused by insufficient input validation, which can cause the appliance to read beyond the intended memory buffer (a memory overread). The flaw is only triggerable when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server, so attackers who can reach those services can potentially induce the overread and obtain sensitive memory contents. Such disclosure could aid follow-on compromise, for example by exposing session or authentication data, and CISA notes known ransomware use. Organizations running NetScaler ADC or NetScaler Gateway in the affected Gateway/AAA configurations are exposed. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2025-07-10 with known ransomware use and an EPSS of 100% (100th percentile), indicating active exploitation, while no public PoC is known and a CVSS score has not yet been assigned. Do: Apply the fixed NetScaler ADC/Gateway builds per Citrix's security advisory (exact affected/fixed version ranges are not in the available data, so consult the bulletin); per CISA KEV, apply vendor mitigations, follow BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable. Inventory appliances for Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server configurations, since unconfigured/other deployments are not triggerable. After patching, terminate active and idle VPN sessions and hunt for anomalous access, given the known ransomware exploitation and the information-disclosure nature of the flaw. | 9.3 | 100% | KEV ransomware |
| massplausibly hundreds of thousands of installed/internet-exposed NetScaler ADC and Gateway appliances (public scans have historically shown on the order of… |
Full article417 words · extracted from infosecurity-magazine.com · click to collapse
An attack by the Anubis ransomware group on a port authority on the Adriatic has been cast as a warning to maritime infrastructure.
New analysis, published on June 11 by threat intelligence firm Resecurity, examined a cyber-attack which saw Anubis list the Adriatic Port Authority on its data leak site.
The Adriatic Port Authority (Autorità di Sistema Portuale del Mare Adriatico Centrale), which runs the Italian port of Ancona, said the breach dated back to December 11 2025 and was attributed to Anubis in January 2026, when the group claimed it and leaked the data.
The authority put the loss at about 2% of its data, with backups preserving the rest, and described most of the stolen material as public or soon-to-be-public, though employee records reached the dark web.
Resecurity's account went further, describing crippled operations, rerouted vessels and a reported $10m Bitcoin ransom demand.
Read more on ransomware at ports: Nagoya Port Faces Disruption After Ransomware Attack
The stolen data, according to Resecurity, included contracts, employee records and, more sensitively, port safety plans and details of security operations, the kind of information prized by groups involved in smuggling or insider recruitment.
The firm believes the attackers gained access through a spear-phishing email targeting staff at the company that manages the port, then laterally moved to core systems.
It said the attack did not need to target operational technology, working purely through IT weaknesses such as insecure cloud accounts managing Office 365 and Azure.
The Anubis Affiliate Machine
Anubis surfaced in December 2024 and launched an affiliate program in February 2025, renting out its toolkit through a ransomware-as-a-service (RaaS) model built around double extortion. It is unrelated to the older Android banking malware of the same name.
Rather than a flat cut, the group offers affiliates 80% for deploying ransomware, 60% for data extortion and 50% for initial access brokers. A model it boasts has earned more than $20m, with victims across healthcare, construction and engineering.
Resecurity tied the group to mass exploitation of internet-facing systems, often via known but unpatched flaws, including:
-
SonicWall VPNs left without multi-factor authentication
-
SolarWinds Web Help Desk (CVE-2025-26399)
-
Cisco SSL VPNs
-
The CitrixBleed 2 flaw (CVE-2025-5777)
Beyond the port itself, Resecurity placed the attack in a run of ransomware hits on ports, from Maersk to Japan's Nagoya, and warned that outdated port IT and thin cyber maturity leave the sector exposed as digitization widens the attack surface, a growing maritime security concern it expects to deepen through 2030.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/anubis-ransomware-adriatic-port/