MAST, maritime cyber attack matrix

Since the creation of this blog, I have regularly collected public maritime cybersecurity events for research and analysis. You regularly ask me for new statistics or analyses, and I take your suggestions with great interest, because they show the importance of this work, which I call incidentology. Understanding the past and the present better also means preparing for the future and protecting oneself better. Knowing one’s adversary better also means defending oneself better. I have therefore analysed the 4,752 cyber events currently in the database in order to classify them, as best I can, according to the MITRE ATT&CK Enterprise framework (Adversarial Tactics, Techniques, and Common Knowledge) [1], which describes how attackers operate. The columns correspond to tactics, meaning attacker objectives, and the cells to techniques, with the number of events describing them. The more marked a cell’s colour, the higher that number. The value of this kind of analysis is that it lets you see which techniques attackers actually use against the maritime sector, and compare them with your own detection and protection measures. A short user guide: clicking a cell shows the distribution of the technique by year, victim country, basin and activity, along with the software weaknesses (CWE, Common Weakness Enumeration) and the exploited vulnerabilities (CVE, Common Vulnerabilities and Exposures), when they are known. The CVEs of maritime equipment are in the list of maritime CVEs.

A few biases are worth knowing before drawing conclusions: 2,545 of the 4,752 records describe a denial of service, which makes this type of attack overrepresented. But that is precisely the value of this kind of matrix, which lets you “zoom in” on the part that interests you. Conversely, preparation and initial access techniques are underrepresented, because sources generally describe the impact and the full investigation is rarely made public. The dataset nonetheless rests on 6,357 distinct references from 2,515 sites. A technique not written in a record is therefore not inferred, except for the impact the attackers seek, detailed below, and doing so would raise an ethical or bias problem. So the absence of a technique says nothing about its real frequency. Infostealers and phishing are examples: clearly underrepresented, yet seldom described in incidents. For denial of service, the technique is read from the configuration of the attackers’ tool (most often DDoSia), which indicates the impact they are seeking. Encryption by ransomware is treated the same way: out of 1,123 records, 879 are tied to T1486, of which 71 state that the victim’s files were encrypted and 808 are limited to a confirmed attack or a listing on a leak site, which indicates the impact sought. The 244 records that describe only data theft are tied to T1567 (exfiltration). A claim most often remains a claim, rarely confirmed by public decisions.

These counts are recalculated every month with the new records and those read since. Last generated: 2026-10-27 12:12 UTC.

This matrix is named MAST (Maritime Attack Standard Techniques). It, or a figure from it, may be quoted freely with the mention “Source: maritimeinfosec.org, MAST, maritime cyber attack matrix, https://maritimeinfosec.org/mast/" and the date of consultation. Reproducing the matrix or its data requires prior written permission. MITRE ATT&CK is a trademark of The MITRE Corporation, used under the terms published by MITRE.

[1] MITRE ATT&CK, https://attack.mitre.org/