Mustang Panda Escalates Cyberattacks on European Maritime Sector

• •Mustang Panda targeted maritime organizations in seven EU states in 2025.
• •The group uses spear-phishing and compromised USB drives to deploy malware.
• •Maritime transport is classified as a cyber 'risk zone' by ENISA.

Chinese hacking group Mustang Panda has intensified cyberespionage campaigns targeting maritime organizations across at least seven EU member states throughout 2025. The European Union Agency for Cybersecurity (ENISA) reported that these attacks primarily focus on espionage and strategic intelligence collection, with Mustang Panda employing methods such as spear-phishing and the use of compromised USB drives to introduce malware, including customized versions of the PlugX remote-access tool. The maritime transport sector accounted for 16.4% of transport-related cyber incidents in the EU last year, highlighting its vulnerability. ENISA has classified maritime transport as a cyber 'risk zone' due to its strategic importance and reliance on interconnected systems. The group is believed to be state-sponsored, with prior attacks linked to EU diplomatic missions and Russian defense companies. Recent assessments indicate that vulnerabilities in shipboard systems are widespread, necessitating immediate risk treatment.