News / Warning of increased cyber threat to western supply chain players

© Andriezas

Nato governments have issued a joint notice warning of increased threat to western logistics from Russian cyber-attacks, and urging the separation of operational technology and IT networks.

Russia’s military intelligence service, the GRU, has been carrying out cyber-attacks against private and public entities involved in the provision of support since the start of the invasion of Ukraine in 2022, targeting transport operators and hubs, particularly in the air and maritime sector.

The joint-statement notes: “Russian military forces failed to meet their military objectives and western countries provided aid to support Ukraine’s territorial defence. Consequently, [the GRU has] expanded its targeting of logistics entities and technology companies involved in the delivery of aid.

“These actors have also targeted internet-connected cameras at Ukrainian border crossings to monitor and track aid shipments.”

Global Shippers’ Forum (GSF) director James Hookham told The Loadstar logistics businesses were facing “dark forces”.

With the wider sector seemingly a target, his opposite number at the Airforwarders’ Association (AFA), Brandon Fried, said that while he did not want to create “unnecessary alarm”, it was important the industry recognised the advisory as credible.

“It should be taken seriously – particularly by logistics companies that maintain critical infrastructure systems or support sensitive supply chains,” Mr Fried told The Loadstar.

“The threat actors described are known to be stealthy and patient, with a long-term focus on pre-positioning within networks rather than immediate disruption. This raises the stakes for all of us in the transportation and logistics sector.”

He urged his membership to follow the report’s mitigation guidance, which includes recommendations on separating operational technology and IT networks.

Mr Hookham noted that it was precisely the sort of cyber threats posed by the GRU that prompted the GSF, in partnership with Fiata, to issue its Data Governance Charter in 2023, obligating members to report data loss and unauthorised access of their systems to relevant stakeholders.

“There is not much we can do about the GRU, but affected businesses should be under obligation to notify clients of data breaches as holders of personal data,” Mr Hookham said.

“We’re not looking for new legislation, but a commitment to notify in terms & conditions and user agreements – certainly something shippers and forwarders should be asking booking platform providers about.”