Attack techniques recorded in maritime cyber incidents

The attack techniques described in the 4,745 records of this site’s dataset of maritime cyber incidents, all public, are classified here following the MITRE ATT&CK Enterprise framework (Adversarial Tactics, Techniques, and Common Knowledge). The columns correspond to tactics, meaning attacker objectives, and the cells to techniques, with their identifier and the number of records describing them. Clicking a cell opens its distribution by year, victim country, basin and activity, with the software weaknesses (CWE, Common Weakness Enumeration) and vulnerabilities (CVE, Common Vulnerabilities and Exposures) cited. The CVEs of maritime equipment are in the list of maritime CVEs.

2,544 of the 4,745 records describe a denial of service, with one record per entity targeted by a campaign. These cells do not share the unit of those for an intrusion or ransomware, where a record is one incident. The denial-of-service techniques come from the configurations of DDoSia, the tool of the NoName057(16) group, archived for the targeted hosts. For the other threats, 3,880 of 4,745 records were read by a large language model, which quotes the passage supporting each technique. A check discards quotations not found in the record: 82 of 6,583.

These counts are recalculated every month with the new records and those read since. Last generated: 2026-10-26 22:59 UTC.

The matrix or a figure from it may be quoted freely with the mention “Source: maritimeinfosec.org, techniques matrix, https://maritimeinfosec.org/cve-maritimes/matrice/" and the date of consultation. Reproducing the matrix or its data requires prior written permission. MITRE ATT&CK is a trademark of The MITRE Corporation, used under the terms published by MITRE.