ISCAP Proceedings: Abstract Presentation
Identifying Adversary Patterns in Maritime Cyber Incidents Using MITRE ATT&CK
Garrett Barnes
University of North Carolina Wilmington
Bilge Karabacak
University of North Carolina Wilmington
Caleb Cloutier
University of North Carolina Wilmington
Brody John Fortuin
University of North Carolina Wilmington
Jakeb Allen Rowland
University of North Carolina Wilmington
Ulku Clark
University of North Carolina Wilmington
Abstract
The maritime industry has become a very attractive target for cyber threat actors because of its reliance on interconnected information technology (IT) and operational technology (OT) systems. These systems support global shipping, logistics, and critical infrastructure. As cyber threats continue to become more advanced, understanding adversary behaviors is essential for maritime cyber defense. This study analyzed 25 documented maritime cyber incidents by mapping each attack to the MITRE ATT&CK framework and the MITRE ATT&CK for Industrial Control Systems (ICS) framework using MITRE ATT&CK Navigator. The resulting ATT&CK Navigator matrices provide a standardized approach for comparing incidents and identifying common tactics, techniques, and attacks across enterprise and industrial control systems. Analysis of the mapped incidents showed that enterprise attacks most frequently involved the Impact, Initial Access, and Execution columns, while Service Stop, Data Encrypted for Impact, and File and Directory Discovery were the most commonly observed techniques. Industrial control system incidents most commonly resulted in Loss of Productivity and Revenue, highlighting the significant operational consequences of attacks targeting maritime infrastructure. Collectively, the ATT&CK Navigator layers reveal consistent attack patterns across ports, shipping companies, and other maritime organizations while showing the effectiveness of ATT&CK-based analysis for identifying adversary behavior. The findings provide a structured foundation for threat defense by helping cybersecurity professionals prioritize detection, reduction, and resilience efforts and by improving the protection of critical maritime infrastructure against new and current cyber threats.
Keywords: Maritime cybersecurity, MITRE ATT&CK, MITRE ATT&CK Navigator, Industrial Control Systems, Cyber incident analysis, Threat-informed defense