Two US-bound vessels apparently compromised by hackers, US officials say

US Coast Guard and FBI personnel boarded two commercial vessels bound for the United States in the Gulf of Mexico last month after indications that hackers had broken into their computer networks, the agencies said on Thursday.

The unusual operation, carried out on August 21 and August 24 aboard two foreign-flagged ships, comes as US authorities grapple with a series of cyber incidents that media reports have linked to Iran since the outbreak of conflict between Washington and Tehran.

The FBI said a joint Coast Guard-FBI team boarded the vessels after receiving "indications that the networks of both vessels were compromised."


The Coast Guard, which referred only to the August 21 boarding, said that "foreign cyber actors" were involved but did not identify them.

Neither agency provided further details about the incidents or explained the discrepancies between their accounts. The US Cybersecurity and Infrastructure Security Agency referred questions back to the Coast Guard.

Corey Ranslem, CEO of maritime security group Dryad Global, said that his firm had confirmed that one of the ships was the Liberian-flagged VL Prosperity. The vessel is currently anchored in waters around Galveston in Texas, according to LSEG and MarineTraffic ship tracking data. Liberia's flag registry did not immediately respond to a request for comment.

Iran's Mehr news agency reported on August 20 that VL Prosperity had suffered what it called "a major cyberattack" while transiting through the Strait of Gibraltar and that its communications had been knocked out for 30 hours.

Citing an unnamed crew member, Mehr reported that hackers had also infiltrated the engine-room systems, reduced the engine's cooling flow, increased the engine speed, and disabled the ship's fuel and engine-oil tank.

The Iranian news agency did not say who was thought to be behind the alleged attack.

Although dramatic in its effects, a ship-centered cyberattack is not that difficult to pull off, Ranslem said.

"We are expecting these types of attacks to continue and will expand in the very near future," he said.