Key Takeaways
- The Anubis ransomware group compromised the Adriatic Port Authority via a spear‑phishing email, then moved laterally by exploiting unpatched vulnerabilities and privilege‑escalation techniques.
- The attack encrypted core IT systems supporting cargo tracking, shipping schedules, and customs processing, while exfiltrating contracts, employee records, and security‑plan data.
- A ransom demand of US$10 million in Bitcoin was issued, with a seven‑day deadline and threats to publish stolen data on the dark web.
- Although operational technology (OT) was not directly targeted, the disruption caused significant maritime‑trade delays, vessel rerouting, and multimillion‑dollar economic losses across the Adriatic region.
- The incident illustrates how weak cybersecurity hygiene, aging infrastructure, and limited security maturity make port authorities attractive targets for ransomware groups seeking financial gain or intelligence for criminal enterprises.
- Response efforts included system isolation, forensic investigations, backup‑based recovery, and coordination with law enforcement; authorities generally advise against paying ransoms to avoid encouraging further attacks.
- The case underscores the growing convergence of IT and OT risks, highlighting the need for robust cybersecurity measures, regular patching, employee awareness training, and resilient backup strategies across critical transportation infrastructure.
Overview of the Attack
In December 2025 the Adriatic Port Authority (Autorità di Sistema Portuale del Mare Adriatico Centrale), which manages the Port of Ancona in Italy, suffered a cyber intrusion that was later attributed to the Anubis ransomware group in January 2026. The attackers gained an initial foothold through a spear‑phishing email containing a malicious attachment sent to employees. Once opened, the payload deployed ransomware across the authority’s IT network, marking the start of a coordinated extortion campaign.
Initial Infection Vector
Resecurity’s analysis identified the spear‑phishing email as the primary infection vector. The email appeared legitimate, prompting recipients to open an attachment that executed the ransomware loader. This method exploited human factors—specifically, the perceived trust in internal communications—and highlights why employees with privileged access remain a frequent weak link in critical‑infrastructure defenses.
Lateral Movement and Privilege Escalation
After establishing a foothold, the attackers leveraged privilege‑escalation tactics and exploited unpatched vulnerabilities to move laterally within the network. They targeted insecure accounts managing Office 365/Azure environments, allowing them to harvest credentials and gain deeper access. This step‑by‑step progression enabled the ransomware to reach systems that controlled essential port functions without needing to breach operational‑technology (OT) layers directly.
Encryption of Critical Systems
The ransomware encrypted thousands of files across systems responsible for cargo tracking, shipping schedules, and customs processing. As a result, the authority could not generate or update manifests, monitor vessel arrivals/departures, or facilitate customs clearance. The encryption effectively halted the digital workflow that underpins the port’s logistics chain, despite the physical infrastructure remaining intact.
Data Exfiltration and Threats
In addition to encryption, the attackers exfiltrated sensitive information, including commercial contracts, employee personnel files, and detailed safety‑plan documents. The stolen data was later threatened for release on the dark web unless a ransom was paid. Such information is valuable to organized‑crime groups involved in smuggling, contraband trafficking, and potential insider recruitment, amplifying the strategic impact beyond mere financial extortion.
Ransom Demand and Negotiation Context
Anubis demanded a payment of US$10 million in Bitcoin, stipulating a seven‑day window before the threatened publication of the stolen data. A ransom note left on infected systems warned of severe consequences for non‑compliance. While official guidance discourages ransom payment to deter future attacks, reports suggest that the authority may have engaged in negotiations to gain additional time for recovery and to assess the feasibility of restoring operations from backups.
Operational and Economic Impact
The disruption forced the Adriatic Port Authority to suspend processing of inbound and outbound shipments. Vessels were rerouted to alternative ports, causing delays throughout the Adriatic maritime trade network. Businesses reliant on the port experienced supply‑chain interruptions, leading to estimated losses in the millions of euros. The incident also eroded confidence in the port’s ability to safeguard its digital assets and maintain resilient operations.
Response and Recovery Efforts
Following the detection, the authority’s IT team isolated affected systems to prevent further ransomware spread. External cybersecurity specialists were engaged to conduct forensic analysis, identify the root cause, and preserve evidence for law‑enforcement investigations. Recovery relied on restoring encrypted data from backup systems; however, outdated backup procedures slowed the restoration timeline, underscoring the importance of modern, regularly tested backup strategies.
Broader Implications for Critical Infrastructure
The attack exemplifies how ransomware groups can inflict substantial cyber‑physical consequences without directly targeting OT systems. By compromising the IT layer that supports logistics and administrative functions, threat actors can disrupt the flow of goods, trigger economic losses, and gain intelligence useful for illicit activities. The case reinforces the need for port authorities—and similar critical‑infrastructure operators—to adopt a holistic security posture that addresses IT vulnerabilities, enforces strict patch management, conducts regular employee phishing simulations, and maintains segregated, immutable backups.
Conclusion and Recommendations
Resecurity concludes that the Anubis ransomware incident serves as a stark reminder that no organization is immune to evolving cyber threats. Proactive preparation—including continuous vulnerability scanning, timely patch deployment, multi‑factor authentication for privileged accounts, and robust incident‑response planning—is essential to mitigate ransomware risk. As maritime supply chains become increasingly digitized and interconnected, investment in cybersecurity maturity, employee awareness, and resilient recovery capabilities will be vital to safeguarding critical transportation infrastructure against the escalating ransomware epidemic.