Two Countries Uncover Pro-Russia Hacker Network, Plant Espionage Devices on Ferries

Two countries have uncovered an international cyber-espionage network believed to be linked to pro-Russian groups and targeting ferries owned by the Italian shipping company Grandi Navi Veloci (GNV). The investigation, coordinated by the Italian National Prosecutor’s Office for the Fight Against Mafia and Terrorism, found that the group allegedly gained access to ship computer systems to install hidden electronic devices to steal sensitive data and potentially take control of vessels remotely. The case began in December 2025 after GNV filed a report with the Liguria Police’s Cyber Security Center regarding suspected illegal access to the company’s digital systems. The inquiry led to the arrest of three Latvian nationals suspected of involvement in the operation. Two suspects, aged 24 and 25, were arrested six months ago aboard the ferries Fantastic and Bridge at the ports of Sète, France, and Naples, Italy. Investigators say they allegedly received thousands of euros to manipulate the ships’ systems, according to Euronews. Meanwhile, a third suspect believed to be the link to the network’s leaders was arrested in Spain last week. The figure believed to be the mastermind—a 40-year-old Latvian—is thought to be currently in Moscow. One of the arrested suspects admitted involvement and confirmed that he was paid to install the devices, but refused to provide information about those thought to be the brains of the operation. Although there is yet to be an official statement directly accusing the Kremlin, international investigators see strong indications of ties to Russia. After the initial arrests, French Interior Minister Laurent Nunez warned of rising allegations of foreign influence operations. “Foreign interference is now very often the work of a single country,” Nunez said on Tuesday (19/5/2026). The case has also raised fresh concerns about patterns of sabotage and hybrid warfare in European waters. The Strategic Counter-Terrorism Analysis Committee (Casa) is examining the possibility that the GNV case is linked to other suspicious maritime incidents in Europe. One such incident was the collision between Portugal’s container ship Solong and Sweden’s tanker Stena Immaculate in the North Sea last year; the tanker was known to be carrying paraffin for the US military. Although the captain of the Solong was found guilty of negligence and murder, international investigators are still examining whether deliberate sabotage was involved in that incident. The Genoa Prosecutor’s Office is continuing investigations into suspected illegal access to ship computer systems, and authorities are also examining the possibility that foreign states used proxy actors to target Western logistics hubs and civilian infrastructure through covert cyber operations and sabotage.