Foreign interference on a ferry in Sète: between Raspberry Pi, RAT and media overreaction

24/12/2025 1054 words 5 minutes

Contents

The case of the ferry Fantastic (operated by the Italian company Grandi Navi Veloci, GNV) in Sète, in December 2025, is interesting for several reasons. Not so much for its technical sophistication — which remains limited — but for what it reveals about how cyber incidents are handled, particularly in the maritime domain.

Very quickly, the event was portrayed as a potentially serious case of foreign interference, or even as a scenario involving remote control of a vessel. The reality, as it gradually emerges from publicly available information, is more nuanced — and probably more instructive.

A timeline shaped by uncertainty

The first reports on December 16, 2025 mentioned the discovery of a “spy device” or a “RAT” (without clarification) on board the ferry. CNEWS and Euronews quickly adopted strong, sometimes speculative language, suggesting the possibility of “steering the vessel remotely”.

At the same time, French authorities, through the Interior Minister, quickly oriented the narrative toward foreign interference. Laurent Nuñez described the incident as “extremely serious” and explicitly referred to the possibility of external involvement, stating that “one country is often behind this type of interference”, without naming it — though in the current geopolitical context, the implicit reference to Russia is difficult to ignore.

This framing emerged while technical information publicly available remained very limited.

T for “Tool” or T for “Trojan”?

A key issue, insufficiently clarified in early reporting, concerns the term “RAT”.

Some sources, including social media discussions such as LinkedIn, use the term interchangeably. However, RAT may refer to:

a Remote Access Tool (a physical or software-based remote administration or access mechanism, which may be legitimate or not),
or a Remote Access Trojan (malicious software).

This semantic shift has immediate consequences. A trojan is a fairly common type of malware in maritime environments, usually handled effectively by antivirus or EDR solutions. It is typically delivered remotely, often through phishing emails, and only rarely introduced physically (for example via USB drives). This suggests a higher likelihood of remote external compromise.

By contrast, a tool, especially when implemented as a physical device, points toward a very different scenario. It introduces more unusual detection challenges and, above all, implies physical access to the vessel — and therefore a potential insider threat.

Later publications, including those cited by Le Monde Informatique and CSO Online, describe something far simpler: a Raspberry Pi-type device, combined with a cellular modem, enabling remote access to the vessel’s “internal network”.

What we know… and what we still don’t know

The most recent and consistent information points to the presence of a small clandestine computing device physically installed on board.

However, a key question remains unresolved publicly:
what exactly was this device connected to?

Sources refer to access to “a network” on board, but without clear detail:

an office network?
an intermediate technical segment?
or something more critical?

This uncertainty is crucial, as it entirely determines the actual level of risk.

Foreign interference: a dominant hypothesis, but not the only one

In the absence of additional public evidence, and given official communication from the French Interior Ministry, the focus quickly shifted toward foreign interference (hence the involvement of DGSI).

However, it is important to maintain analytical caution while awaiting further elements, if they ever become public.

Other scenarios remain credible, and in some cases more consistent with known modus operandi:

opportunistic cybercrime,
pre-positioning for future operations (pivoting toward the shipowner),
or indirect links to criminal activities (trafficking, logistics).

The vessel’s operational environment — particularly in the Mediterranean and towards North Africa — does not exclude such possibilities.

There are precedents. In the ports of Antwerp and Rotterdam, documented cases have shown the use of very simple techniques (infected USB drives, insider access, even physical keyloggers) to compromise port systems in the context of drug trafficking.

See for example:

A far less spectacular technical scenario

Contrary to some media claims, no public element currently demonstrates any real capability to remotely take control of the vessel. No source confirms access to navigation or propulsion systems.

Several articles explicitly distance themselves from this scenario, notably Le Parisien, which describes the risk as “close to zero”. Achieving such control would require disabling multiple physical and logical safeguards, not to mention the expertise of onboard crew and existing operational procedures.

By contrast, some headlines lean more toward projection than analysis, such as CNEWS or
https://www.lagazettedemontpellier.fr/justice/2026-01-08-a-sete-un-espion-russe-dans-le-ferry/

A simpler reality: physical access and insufficient control

The most robust aspect of this case remains the initial access vector.

Such a device implies:

physical access to the vessel (which is confirmed, with crew members questioned and one released),
the ability to connect equipment to the network,
and a lack of immediate detection (although the exact detection timeline remains unclear).

This directly points to insider threat issues — often underestimated, particularly in environments with multinational crews — and to physical security.

That said, such a device is neither sophisticated nor inherently stealthy. If connected to the network, it can be detected through:

identification of unknown devices,
traffic analysis,
or active network monitoring.

It is likely that such monitoring mechanisms contributed to its detection — or, alternatively, that a vigilant crew member identified it.

As highlighted by Le Monde Informatique and CSO Online, this incident is above all a reminder of the importance of physical security in IT and OT environments.

Conclusion

What stands out in this case is not the sophistication of the attack, but the gap between technical facts and their interpretation.

Between a Raspberry Pi physically introduced on board and connected to a network, and the idea of a remotely controlled vessel, there is a considerable gap. Yet this gap is quickly filled in public discourse, often before technical facts are fully established — and while the investigation is still ongoing.

It is therefore worth allowing time for experts to reach conclusions, and accepting that full public disclosure may never occur.

The Sète incident highlights two essential points.

First, insider threats and physical integrity of systems remain central issues, sometimes more critical than complex remote attacks, less frequent perhaps, but increasingly overlooked in favor of external threat narratives.

Second, the ability to accurately characterize a cyber incident — without overinterpretation, but without minimization — remains a collective challenge, especially in a tense geopolitical context.

In this domain, technical accuracy remains the best safeguard against premature conclusions.