How did they get aboard my ship?: Analysing vessel cyber incidents using the Cyber Kill Chain

Jeroen Pijpker; Stephen McCombie

doi:10.34190/iccws.21.1.4397

How did they get aboard my ship? Analysing vessel cyber incidents using the Cyber Kill Chain

Jeroen Pijpker, Stephen McCombie

Research output: Contribution to journal › Conference paper › peer-review

5 Downloads (Pure)

Abstract

The Global Maritime Transportation System (GMTS) is increasingly reliant on digitized and interconnected systems. This trend also applies to one of the most essential elements of the GMTS, vessels themselves. The Maritime Cyber Attack Database (MCAD) contains listings of maritime cyber incidents from public sources, including those involving vessels. Utilizing MCAD in this paper, we categorize and analyse these specific listings related to vessels. Vessels have complex networks of Information Technology (IT) and Operational Technology (OT). In this paper, we further categorize and systematically analyse selected cyber-attacks against vessels with the Lockheed Martin Cyber Kill Chain. This work also shows a significant rise in attacks against vessels since 2016. These case studies help industry more clearly understand the specific tactics and techniques used in cyber-attacks on vessels.

Original language	English
Pages (from-to)	374-382
Number of pages	9
Journal	International Conference on Cyber Warfare and Security: conference proceedings
Volume	21
Issue number	1
DOIs	https://doi.org/10.34190/iccws.21.1.4397
Publication status	Published - 19 Feb 2026
Externally published	Yes
Event	International Conference on Cyber Warfare and Security (21st : 2026) - University of North Carolina, Wilmington, United States Duration: 5 May 2026 → 6 May 2026

Bibliographical note

Copyright the Author(s) 2026. Version archived for private and non-commercial use with the permission of the author/s and according to publisher conditions. For further rights please contact the publisher.

Keywords

maritime cybersecurity
Cyber Kill Chain
MCAD
GMTS

Access to Document

10.34190/iccws.21.1.4397

Publisher version (open access)Final published version, 0.98 MBLicence: CC BY-ND

Cite this

@article{aec6367a9ab3453e9fee12b8023e5c24,

title = "How did they get aboard my ship?: Analysing vessel cyber incidents using the Cyber Kill Chain",

abstract = "The Global Maritime Transportation System (GMTS) is increasingly reliant on digitized and interconnected systems. This trend also applies to one of the most essential elements of the GMTS, vessels themselves. The Maritime Cyber Attack Database (MCAD) contains listings of maritime cyber incidents from public sources, including those involving vessels. Utilizing MCAD in this paper, we categorize and analyse these specific listings related to vessels. Vessels have complex networks of Information Technology (IT) and Operational Technology (OT). In this paper, we further categorize and systematically analyse selected cyber-attacks against vessels with the Lockheed Martin Cyber Kill Chain. This work also shows a significant rise in attacks against vessels since 2016. These case studies help industry more clearly understand the specific tactics and techniques used in cyber-attacks on vessels.",

keywords = "maritime cybersecurity, Cyber Kill Chain, MCAD, GMTS",

author = "Jeroen Pijpker and Stephen McCombie",

note = "Copyright the Author(s) 2026. Version archived for private and non-commercial use with the permission of the author/s and according to publisher conditions. For further rights please contact the publisher.; International Conference on Cyber Warfare and Security (21st : 2026), ICCWS 2026 ; Conference date: 05-05-2026 Through 06-05-2026",

year = "2026",

month = feb,

day = "19",

doi = "10.34190/iccws.21.1.4397",

language = "English",

volume = "21",

pages = "374--382",

journal = "International Conference on Cyber Warfare and Security: conference proceedings",

issn = "2048-9889",

number = "1",

}

TY - JOUR

T1 - How did they get aboard my ship?

T2 - International Conference on Cyber Warfare and Security (21st : 2026)

AU - Pijpker, Jeroen

AU - McCombie, Stephen

N1 - Copyright the Author(s) 2026. Version archived for private and non-commercial use with the permission of the author/s and according to publisher conditions. For further rights please contact the publisher.

PY - 2026/2/19

Y1 - 2026/2/19

N2 - The Global Maritime Transportation System (GMTS) is increasingly reliant on digitized and interconnected systems. This trend also applies to one of the most essential elements of the GMTS, vessels themselves. The Maritime Cyber Attack Database (MCAD) contains listings of maritime cyber incidents from public sources, including those involving vessels. Utilizing MCAD in this paper, we categorize and analyse these specific listings related to vessels. Vessels have complex networks of Information Technology (IT) and Operational Technology (OT). In this paper, we further categorize and systematically analyse selected cyber-attacks against vessels with the Lockheed Martin Cyber Kill Chain. This work also shows a significant rise in attacks against vessels since 2016. These case studies help industry more clearly understand the specific tactics and techniques used in cyber-attacks on vessels.

AB - The Global Maritime Transportation System (GMTS) is increasingly reliant on digitized and interconnected systems. This trend also applies to one of the most essential elements of the GMTS, vessels themselves. The Maritime Cyber Attack Database (MCAD) contains listings of maritime cyber incidents from public sources, including those involving vessels. Utilizing MCAD in this paper, we categorize and analyse these specific listings related to vessels. Vessels have complex networks of Information Technology (IT) and Operational Technology (OT). In this paper, we further categorize and systematically analyse selected cyber-attacks against vessels with the Lockheed Martin Cyber Kill Chain. This work also shows a significant rise in attacks against vessels since 2016. These case studies help industry more clearly understand the specific tactics and techniques used in cyber-attacks on vessels.

KW - maritime cybersecurity

KW - Cyber Kill Chain

KW - MCAD

KW - GMTS

U2 - 10.34190/iccws.21.1.4397

DO - 10.34190/iccws.21.1.4397

M3 - Conference paper

SN - 2048-9889

VL - 21

SP - 374

EP - 382

JO - International Conference on Cyber Warfare and Security: conference proceedings

JF - International Conference on Cyber Warfare and Security: conference proceedings

IS - 1

Y2 - 5 May 2026 through 6 May 2026

ER -