{"id":6419,"date":"2025-08-26T10:03:40","date_gmt":"2025-08-26T10:03:40","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/08\/26\/hackers-sabotage-iranian-ships-using-maritime-communications-terminals-in-its-mysql-database\/"},"modified":"2025-08-26T10:03:40","modified_gmt":"2025-08-26T10:03:40","slug":"hackers-sabotage-iranian-ships-using-maritime-communications-terminals-in-its-mysql-database","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/08\/26\/hackers-sabotage-iranian-ships-using-maritime-communications-terminals-in-its-mysql-database\/","title":{"rendered":"Hackers Sabotage Iranian Ships Using Maritime Communications Terminals in Its MySQL Database"},"content":{"rendered":"

Hackers Sabotage Iranian Ships Using Maritime Communications Terminals in Its MySQL Database
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A sophisticated campaign of cyber sabotage unfolded against Iran\u2019s maritime communications infrastructure in late August 2025, cutting off dozens of vessels from vital satellite links and navigation aids.<\/p>\n

Rather than targeting each ship individually\u2014a logistical nightmare across international waters\u2014the attackers infiltrated Fanava Group, the IT provider responsible for satellite communications to Iran\u2019s sanctioned tanker fleets.<\/p>\n

By compromising the company\u2019s outdated iDirect Falcon terminals, they gained root access to Linux systems running kernel 2.6.35 and mapped the entire constellation of vessels through a centralized MySQL database<\/a>.<\/p>\n

The initial breach vector appears to have exploited unpatched vulnerabilities in legacy Falcon management consoles, allowing the threat actors to execute privileged commands and exfiltrate network mappings.<\/p>\n

Once inside, they harvested modem serial numbers, network IDs, and IP phone system configurations in plain text, including credentials such as \u201c1402@Argo\u201d and \u201c1406@Diamond.\u201d<\/p>\n

These details were then weaponized to orchestrate a synchronized blackout: email and FBB SIM communications failed, automated weather updates ceased, and port coordination signals vanished almost instantaneously.<\/p>\n

Nariman Gharib researchers identified<\/a> that the campaign, dubbed Lab-Dookhtegan, was not a one-off disruption.<\/p>\n

Email logs dating back to May revealed persistent access and periodic \u201cNode Down\u201d tests, confirming that the attackers maintained control over the networks for months before launching a destructive finale.<\/p>\n

On August 18, they executed a \u201cscorched earth\u201d sequence, overwriting multiple storage partitions on satellite modems with zeroed data, rendering remote recovery impossible.<\/p>\n

\n
\"\"
FANAVA (Source \u2013 Nariman Gharib)<\/figcaption><\/figure>\n<\/div>\n

By crippling Iran\u2019s sanctioned fleets\u2014NITC and IRISL\u2014at a time when covert oil transfers to China intensify, the attackers dealt a blow to the country\u2019s sanctions-evasion capabilities.<\/p>\n

Without communication links, tankers risk drifting off-course or becoming easy targets for boarding and seizure. The operation\u2019s precision underscores a deep reconnaissance<\/a> phase, allowing the threat actors to deliver maximally disruptive payloads at the worst strategic moment.<\/p>\n

Infection Mechanism<\/strong><\/h2>\n

The malware\u2019s infection mechanism relied on a multi-stage approach: initial access through unprotected management ports, lateral movement via SSH keys harvested from MySQL dumps, and deployment of destructive scripts.<\/p>\n

After gaining root on a compromised Falcon console, the attackers executed commands akin to:-<\/p>\n

dd if=\/dev\/zero of=\/dev\/mmcblk0p1 bs=1M\ndd if=\/dev\/zero of=\/dev\/mmcblk0p2 bs=1M<\/code><\/pre>\n
These commands systematically wiped primary storage partitions and recovery slices, ensuring the terminal\u2019s firmware and configurations were irrecoverable without physical intervention.<\/p>\n
\n
\"\"
IP addresses and passwords in plain text (Source \u2013 Nariman Gharib)<\/figcaption><\/figure>\n<\/div>\n
Simultaneously, SQL queries extracted the fleet blueprint:-<\/p>\n
SELECT serial_number, vessel_name, network_id\nFROM modems;<\/code><\/pre>\n
Armed with this data, the attackers automated credential<\/a> injection and shutdown sequences across 64 vessels with a single orchestration script.<\/p>\n
\n
\"\"
PoCs (Source \u2013 Nariman Gharib)<\/figcaption><\/figure>\n<\/div>\n
By embedding malicious cron entries, they achieved both persistence and timed execution, triggering the blackout at a moment calculated to maximize operational chaos.<\/p>\n
This infection chain highlights the importance of isolating management interfaces and enforcing strict patch regimes on critical satellite communication systems.<\/p>\n
Boost\u00a0your\u00a0SOC and help your team protect your business with free top-notch threat intelligence:\u00a0Request TI Lookup Premium Trial<\/a>.<\/code><\/strong><\/p>\n
The post Hackers Sabotage Iranian Ships Using Maritime Communications Terminals in Its MySQL Database<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n
 \t

\n 
<\/BR>
\n    Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n 
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"
Hackers Sabotage Iranian Ships Using Maritime Communications Terminals in Its MySQL Database A sophisticated campaign of cyber sabotage unfolded against Iran\u2019s maritime communications infrastructure in late August 2025, cutting off dozens of vessels from vital satellite links and navigation aids. Rather than targeting each ship individually\u2014a logistical nightmare across international waters\u2014the attackers infiltrated Fanava Group, […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-6419","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/6419"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=6419"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/6419\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=6419"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=6419"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=6419"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}