Transport fever: Putting security in the front seat

Buses, trains, ships, and trucks are the unsung heroes of everyday life, carrying people and goods across vast distances, keeping our bellies full and our economies alive.

This isn’t without its dangers. Digital ones, even. Indeed, the highwaymen of old would probably balk at the idea that guns could be replaced by keyboards, but here we are, with criminals exploiting legitimate network tools to infiltrate transport networks for financial gain…and maybe something more.

Key points of this article: The digitalization of the transport industry inherently exposes critical logistics to the chaotic cyber threat landscape. Increased efficiencies come at a cost, which in transport is exacerbated by overlapping technologies (IT and OT) and the human variable, as well as reliance on long supply chains in the physical and digital space. You can’t stay secure 100% of the time in this situation, especially when you’re facing multiple external factors, some of which relate to the industry’s key role in supply chains. It has come to a point where cyber-enabled physical crime (such as shipment theft) has become more commonplace through a combination of cyber threat actors and organized crime. Thus, regulators step in to introduce preventive measures to raise the overall resilience of this complex sector.

Key points of this article:

• The digitalization of the transport industry inherently exposes critical logistics to the chaotic cyber threat landscape.
• Increased efficiencies come at a cost, which in transport is exacerbated by overlapping technologies (IT and OT) and the human variable, as well as reliance on long supply chains in the physical and digital space.
• You can’t stay secure 100% of the time in this situation, especially when you’re facing multiple external factors, some of which relate to the industry’s key role in supply chains. It has come to a point where cyber-enabled physical crime (such as shipment theft) has become more commonplace through a combination of cyber threat actors and organized crime.
• Thus, regulators step in to introduce preventive measures to raise the overall resilience of this complex sector.

A devolving evolution?

The line between physical and digital is blurring ever so slightly every single day. The beauty of analog technology was in its simplicity; it didn’t require the existence of invisible lines in the air to function (radio is an exception). Things just worked.

Sure, in logistics, those invisible lines did have their use. Radio, for example, has had multiple applications, including driver check-ins and tracking (with tech like LORAN for ships and aircraft).

However, things have floated a bit off course. While tracking can be done more easily using GPS satellites, they don’t provide an internet connection. You also cannot monitor a ship’s underlying systems, including security, without additional IoT integrations (sensors) and various hybrid systems that connect the ship to observers on land to ensure safe passage and ship integrity.

A similar story is true for railway security, where analog meets digital on the daily, and trucks, which are IoT devices themselves, not unlike modern cars, with additional integrations to dispatching systems for live tracking, road tax collection, fleet management, and more.

A similar story is true for railway security, where analog meets digital on the daily, and trucks, which are IoT devices themselves, not unlike modern cars, with additional integrations to dispatching systems for live tracking, road tax collection, fleet management, and more.

These things don’t just work. Usually. IoT and IT require special maintenance for things a wrench can’t fix, like software vulnerabilities. If an update is automatic, sure, you’re good to go. But what if it breaks something? What if the update itself takes your systems down for hours or days?

There’s a lot about cyber that profoundly adds to the safety and productivity of logistics, but as much as it gives, it also takes away. If analog was too dumb to fail, with mostly mechanical kinks, then cyber is too smart to succeed.

Normalization of deviance

Running a tight ship calls for exhaustive measures all around; you can’t let a single thing fail lest it cause a catastrophe, like a bridge collapse. But how can you ensure that IT stays in top shape at all times?

In engineering, but also in cybersecurity, it’s accepted that things will not work 100% of the time; there’s a degree to which engineering is allowed to deviate from the expected, for better or worse. In some cases, you might be surprised by what you find, like when Percy Spencer’s melted chocolate led to the invention of the microwave, or when the Morris Worm’s spread prompted the creation of intrusion detection systems (IDS) and CERT/CC, formalizing incident response as a practice.

In other cases, you might get porch pirates and organized criminals stealing your shipments. Or have your local buses possibly remotely deactivated by nation-aligned entities, as demonstrated by the discovery of remote shutdown capabilities of some buses in Norway, which ESET France’s Benoit Grunemwald, cyber security evangelist, highlighted as a great concern—not just for the companies running them, but also for citizens:

“This goes far beyond the usual notion of ‘digital dependency.’ Public transport is part of a nation’s critical infrastructure, and if a ‘kill-switch,’ a remote control with shutdown capabilities, exists without the knowledge of municipal and national authorities, this represents a potential national security risk and possible risk to life, not just an operational one.”

It's clear that something needs to be done to prevent unauthorized use of legally obtained vehicular machinery such as buses, trains, planes, or ships. Thankfully, some countries do see this as an issue area, which is why the bus story is even more relevant:

“In Europe, including the EU, the UK, and Norway, vehicles must comply with international cybersecurity regulations,” Grunemwald adds. “These frameworks are designed to ensure transparency, risk management, and accountability across manufacturers, helping prevent such vulnerabilities from being introduced into critical systems. The lack of transparency from the manufacturers is an alert not only for the transport sector but also for the broader automotive industry, where increasingly digital and connected systems could be manipulated by malicious or state-aligned actors to endanger safety, disrupt mobility, and undermine public trust.”

And manipulate they will.

The cyber-enabled physical logistics threat landscape

It’s becoming common knowledge that when you’re connected, you’re exposed. It’s a flaw in our IoT-heavy world, which now overlaps with, or enables, critical sectors as well.

Particularly in the transportation sector, ENISA reports that maritime, logistics, and freight operators have emerged as high-value sectors to bad actors, facing 7.5% of all recorded incidents.

Particularly in the transportation sector, ENISA reports that maritime, logistics, and freight operators have emerged as high-value sectors to bad actors, facing 7.5% of all recorded incidents.

But what happens when digital exposure crosses the material threshold?

As reported in November 2025, threat actors are heavily leveraging cyberattacks in concert with organized crime groups to infect freight & logistics companies, gaining access and insight to ultimately steal physical goods. Reportedly, retail products like food and beverages seem to be the most sought -after.

This is all because of the crafty use of multiple access methods, mostly compromised email accounts, and a bit of fraud on load board listings where criminals target curious carriers with malicious emails.

This is nothing new, really. ESET Research often points out that spearphishing is among the most insidious of threat vectors, with many APTs like the Iran-aligned MuddyWater using it to target companies in transport-related industrial verticals such as manufacturing.

This is nothing new, really. ESET Research often points out that spearphishing is among the most insidious of threat vectors, with many APTs like the Iran-aligned using it to target companies in transport-related industrial verticals such as manufacturing.

Sign of the times

The emails in question lead to the download of trojanized installers of legitimate remote management tools (often used by MSPs) like SimpleHelp. Sound familiar? Yes, in fact, we recently described this exact scenario at length in our blog post on internal spearphishing, discussing the MuddyWater APT group, which is also known for targeting logistics and transportation firms.

Now, back to the overall logistics story. What would a cyber actor get out of this combined criminal enterprise? Mainly access—to sensitive data, industrial choke points (supply and demand rely on transport), and strategic allies in organized crime to extend their network for greater impact.

As for the street criminals, access is their main goal as well. Computer hacking can easily facilitate drug trafficking, as exemplified by a story from the Netherlands.

As for the street criminals, access is their main goal as well. Computer hacking can easily facilitate drug trafficking, as exemplified by a story from the Netherlands.

Such access can also be sold. So even if it were acquired by a smaller actor, who’s to say they couldn’t sell it to a nation-aligned group? In that case, we’d be discussing even worse implications, as you don’t want such people to have insight into a country’s major ports, freight train facilities, or airports, especially when there are military concerns involved.

There exist specific cybercrime actors called initial access brokers that sell access to organizational networks to others. This enables criminals with lower skill levels to still carry out advanced attacks.

There exist specific cybercrime actors called initial access brokers that sell access to organizational networks to others. This enables criminals with lower skill levels to still carry out advanced attacks.

How to stop attacks against the transport sector?

We’ve discussed multiple angles in this blog post. That shouldn’t be surprising: the transport sector includes a terrifying number of interwoven supply chains from private truckers to public sector operators like city-owned bus and tram companies. Due to this complexity, as well as its criticality to various operations, cybersecurity measures need to be stringent enough so as not to result in large disruptions in logistics and other related sectors (like the previously mentioned manufacturing).

Thus, baseline resilience objectives, one of the most notable of which has been instilled by the Network and Information Security Directive 2 (NIS2) of the European Union (where transport is an essential sector), are what bring a bit more order to the transport cybersecurity landscape.

NIS2’s requirements include incident handling, supply chain security, encryption, vulnerability disclosure, and staged incident reporting. Also, covered organizations must submit an early warning within 24 hours of becoming aware of a significant incident, followed by a more detailed notification within 72 hours and a final report within one month.

NIS2’s requirements include incident handling, supply chain security, encryption, vulnerability disclosure, and staged incident reporting. Also, covered organizations must submit an early warning within 24 hours of becoming aware of a significant incident, followed by a more detailed notification within 72 hours and a final report within one month.

In the U.S., at the federal level, the U.S. Transportation Security Administration (TSA) is working to impose cyber risk management requirements (such as incident reporting to CISA) on certain pipeline and rail owner/operators and certain over-the-road bus owner/operators. This is a continuation of efforts such as the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) of 2022, directing CISA to implement regulations that require covered entities to report covered cyber incidents (within 72 hours) and ransomware payments (within 24 hours).

Within and without regulations

We could go on about various other regulations around the world, such as Japan’s Active Cyber Defense Law, with its specific rules for pivotal industries, including transportation.

However, beyond regulations, there’s a lot that transportation companies can do themselves to boost their resilience:

• Make security priority No. 1: And we mean both physical and digital. There are many ways in which threat actors can abuse physical interfaces to embed themselves in company systems. In turn, this proves to be an issue not only for material, but also less tangible (physically) integrity of a company’s perimeter. When your endpoint is a connected ship, truck, train, or other vehicle, you cannot keep it secure within a single location. Therefore, the goal should be securing these “endpoints” in all locations, at all times.
• Comply. Honestly, regulatory acts targeting critical industries should be the baseline. They’re meant to raise the collective resilience of key stakeholders, which is why we recommend reading up on cyber laws pertaining to a particular logistics area. Moreover, think of the requirements of adjacent industries; freight transports more than just one good.
• Focus on IT: IT is where threat actors get in. If devices that support daily business, such as computers, phones, and IoT devices in general, are proactively taken care of, there’s a lower likelihood of a larger incident taking place.
• Smart procurement: Connecting back to the bus hacking story, whenever new procurement decisions are being made, think of them as strategic moves. If a company is seeking to upgrade its fleet of vehicles, secure-by-design principles dictate that the less exposure there is to negative eventualities, then…well, the less likely there is to be an issue down the line. Sure, businesses have budgets to consider, and perhaps a foreign company could offer comparable vehicles at a much lower cost. But at the same time, from a practical perspective, any potential eventuality could be much more easily resolved with a local company cognizant of the benefits of digital sovereignty, for which respect for local laws is paramount.
• Report. If a major incident occurs, report it to the respective data protection authority. Law enforcement may also become involved, especially when the incident includes physical threats or crosses borders (which transport also does). In such cases, agencies like Europol can support coordinated international responses.

Secure load

We hope this bird’s-eye view of the transportation threat landscape will help companies avoid blindsided decision-making and understand why cyber security isn’t just an intangible topic, but a real threat also enabling material damage.

FAQ: Transport sector cybersecurity

Why is the transport sector vulnerable to cyberattacks?

The transport sector relies on connected systems, long supply chains, and a mix of IT, OT, IoT, and physical infrastructure. This creates many possible entry points for attackers, from phishing emails and compromised accounts to exposed fleet management or tracking systems.

How can cyberattacks cause physical disruption in logistics?

Cyberattacks can give criminals access to shipment data, route information, port systems, or remote management tools. Once inside, attackers may help organize cargo theft, disrupt operations, or sell access to more capable threat actors.

What role do IT and OT systems play in transport cybersecurity?

IT systems often provide the first point of access, while OT and connected vehicle systems can affect real-world operations. Securing both domains is essential because a weakness in everyday business technology can eventually translate into operational or physical risk.

Which cybersecurity regulations affect transport companies?

In the EU, NIS2 treats transport as an essential sector and sets requirements around incident response, supply chain security, reporting, encryption, and vulnerability handling. Other regions are also tightening rules for critical infrastructure, including rail, pipeline, bus, maritime, and logistics operators.

How can transport organizations improve cyber resilience?

Transport organizations can start by treating cyber and physical security as connected priorities. Key steps include protecting endpoints, improving procurement decisions, complying with sector regulations, monitoring IT environments, preparing incident response processes, and reporting serious incidents quickly.

Additional references:[1] Orman, Hillary (1988). The Morris Worm: A Fifteen-Year Perspective (p. 40). Retrieved from https://www.cs.umd.edu/class/fall2023/cmsc614/papers/morris-worm.pdf. Accessed: 20.11.2025. This paper describes the Morris Worm, one of the earliest internet worms, and its impact on network security.[2] ENISA. ENISA Threat Landscape 2025, version 1.2. January 2026, p. 16. https://www.enisa.europa.eu/publications/enisa-threat-landscape-2025. Accessed January 22, 2026. Note: An updated version (1.3) was published on September 22, 2026.