Cybersecurity firm Resecurity has published research detailing a ransomware attack by the Anubis group against an Adriatic Port Authority, as reported by Industrial Cyber on June 16, 2026. The disclosure is being framed as a detailed look at how ransomware operators are reaching into maritime critical infrastructure — a sector where information technology (IT) systems and operational technology (OT, the systems that control physical processes like cranes, gates, and cargo handling) are increasingly intertwined.
Executive Summary
According to the report, threat-intelligence firm Resecurity has documented an intrusion attributed to Anubis — a ransomware-as-a-service operation that surfaced in underground markets in late 2024 and drew attention for pairing conventional encryption with a destructive file-wiping capability — against a port authority on the Adriatic coast. Port authorities are the public bodies that govern harbor operations, vessel traffic, and often the digital systems that commercial terminals depend on, which makes them an unusually consequential ransomware target.
The significance is less the individual incident than what it illustrates: ports sit at the junction of national logistics, customs, energy imports, and military mobility, and a single compromised authority can ripple across all of them. Vendor research that documents such an attack in technical detail is valuable to defenders — though, as with any single-vendor disclosure, the claims that matter most (scope of access, operational impact, and how the intrusion happened) deserve independent confirmation, and the public reporting available at publication is thin on those specifics.
Why Ports Are Ransomware’s Ideal Target
Modern ports run on software to a degree that surprises outsiders. Terminal operating systems schedule every container move; gate systems decide which trucks enter; berth management coordinates vessel arrivals; customs and port-community platforms link the authority to shippers, freight forwarders, and government agencies. When ransomware locks those systems, cargo does not merely slow — it physically stops, because cranes and yard equipment have nowhere to be told to go. That is why the sector’s precedents are so costly: the 2017 NotPetya incident forced Maersk to rebuild its global IT estate at a cost the company put in the hundreds of millions of dollars, and ransomware halted container operations at Japan’s Port of Nagoya in 2023. An Adriatic port authority fits the same profile: high downtime costs, public-sector budget constraints, and a web of third-party connections that widens the attack surface.
The OT dimension raises the stakes further. Even when attackers only encrypt IT systems, operators frequently shut down OT as a precaution because the boundary between the two is porous. The practical lesson for infrastructure operators of every kind — ports, data centers, utilities — is that segmentation between business networks and control networks is not a compliance checkbox; it is the difference between an expensive IT incident and a physical-operations outage.
Anubis and the Economics of Destructive Ransomware
Anubis is a relatively young ransomware-as-a-service brand — a model in which core developers lease their malware and infrastructure to affiliates who conduct the actual intrusions in exchange for a revenue share. What set Anubis apart in earlier security-industry reporting was a so-called wipe mode: the ability to destroy file contents outright rather than merely encrypt them. That capability changes the victim’s calculus. Classic ransomware is, in a grim sense, a negotiation with a counterparty that wants its decryptor to work; a wiper-equipped operator can credibly threaten permanent destruction, which increases pressure to pay quickly and raises the ceiling of potential damage if talks collapse.
For a critical-infrastructure victim, that threat profile pushes the incident out of the purely financial category and toward something closer to sabotage risk. It also strengthens the case for offline, regularly tested backups — the one control that removes most of a wiper’s leverage — and for incident-response planning that assumes data may be unrecoverable from the attacker regardless of payment.
What Vendor Research Does — and Doesn’t — Establish
This disclosure comes from Resecurity, a commercial threat-intelligence firm, relayed through trade press. Vendor research is a legitimate and often essential channel — private firms frequently see intrusion details that victims and governments do not publish — but it also serves a marketing function, and readers should hold it to the same evidentiary standard as any other claim. The fair questions cut in every direction: Has the affected port authority confirmed the incident? Do the technical indicators trace to Anubis with high confidence, or by resemblance to known tooling? Was operational technology actually touched, or is OT exposure an inference from network architecture? The public reporting available at the time of writing — an aggregated headline and summary — does not settle any of these, and it would be a mistake to treat the incident’s most dramatic possible reading as established fact.
The Regulatory Tide Meets the Waterline
If the affected authority sits in an EU member state — as most Adriatic port authorities do — the incident lands squarely inside the NIS2 directive’s remit, the EU regime that designates ports as essential entities and imposes incident-reporting deadlines and management-level accountability for cyber risk. The International Maritime Organization has likewise required cyber risk to be addressed in ship and port safety-management systems since 2021. An incident like this one becomes a live test of whether those frameworks produce faster disclosure and better resilience in practice, or whether public understanding of critical-infrastructure attacks continues to depend on third-party security researchers publishing what victims will not.
Background
Anubis appeared in cybercrime markets around late 2024 as a ransomware-as-a-service brand and was flagged by multiple security researchers in 2025 for combining data-theft extortion with an optional file-destruction mode — an escalation from the encrypt-and-negotiate model that has dominated ransomware for a decade. Maritime targets have figured in ransomware history since NotPetya crippled Maersk in 2017, and attacks on the ports of Lisbon (2022) and Nagoya (2023) demonstrated that both port authorities and terminal operators are viable victims.
The Adriatic coastline hosts significant EU trade gateways in Italy, Slovenia, and Croatia, making its port authorities essential entities under the EU’s NIS2 cybersecurity directive. Resecurity, the firm behind this disclosure, is a commercial threat-intelligence company that regularly publishes intrusion research on ransomware groups and critical-infrastructure targeting.
Source: Resecurity details Anubis ransomware attack on Adriatic Port Authority, exposing maritime infrastructure risks — Industrial Cyber, reporting on Resecurity threat research into a ransomware intrusion at an Adriatic port authority, published June 16, 2026.
