France probes ‘foreign interference’ after remote control malware found on passenger ferry

French authorities are investigating a suspected cyberattack plot aimed at an international passenger ferry in what officials suggest could be part of Russia’s “hybrid warfare” against Ukraine’s European allies.

The investigation, led by France’s General Directorate of Internal Security (DGSI), began after Italian intelligence shared information about malicious software potentially infecting computer systems aboard a ferry docked in the Mediterranean port of Sète, according to the Paris prosecutor’s office.

Investigators discovered Remote Access Trojan (RAT) software on the vessel’s systems, a tool commonly used by cybercriminals that allows remote control of computer networks. This software could have been deployed to seize control of the ferry’s critical systems, though authorities have not specified the exact intended outcome of the alleged plot.

“Individuals tried to gain access to a ship’s data-processing system,” Interior Minister Laurent Nunez told France Info, describing it as “a very serious affair.” When asked if the suspected intention was to hijack the vessel, Nunez acknowledged, “We don’t know.”

French police arrested two crew members last Friday – one Latvian and one Bulgarian – who had been identified as suspects by Italian authorities. Following questioning, the Bulgarian crew member was released without charge, while the Latvian national remains in custody.

The Latvian faces preliminary charges of criminal conspiracy and hacking-related offenses allegedly committed to serve the interests of a foreign power. While the prosecutor’s office has not officially named the foreign entity involved, Nunez appeared to implicate Russia, stating, “At the moment, foreign interference very often comes from the same country.”

As part of the investigation, search raids were also conducted in Latvia, though Latvian state police declined to comment on the matter when contacted by the Associated Press.

The ferry has since been released following comprehensive security checks of its computer systems and has resumed normal operations, according to French prosecutors.

This incident occurs against a backdrop of escalating concerns about Russian “hybrid warfare” tactics across Europe. France and other European supporters of Ukraine have repeatedly accused Moscow of conducting a coordinated campaign of sabotage, assassinations, cyberattacks, and disinformation designed to destabilize Western nations while maintaining plausible deniability.

Maritime cybersecurity has become an increasing concern for intelligence agencies worldwide. Commercial vessels rely heavily on computerized systems for navigation, cargo management, and communications, making them potential targets for state-sponsored actors seeking to cause disruption or demonstrate capabilities.

The maritime sector has proven particularly vulnerable to such attacks due to legacy systems, limited cybersecurity resources, and the international nature of shipping operations, which can create jurisdictional challenges for investigators.

Cyberattacks against critical infrastructure, including transportation systems, have grown more sophisticated and frequent in recent years. Security experts warn that compromising a vessel’s navigation or control systems could potentially lead to collisions, environmental disasters, or even facilitate human trafficking or smuggling operations.

This investigation highlights the evolving nature of security threats facing the shipping industry, which moves approximately 90% of world trade. European authorities have been strengthening maritime cybersecurity protocols in response, particularly for vessels operating near strategically sensitive regions.

The case also underscores the importance of international intelligence cooperation, as the plot was reportedly uncovered thanks to information sharing between Italian and French security services, demonstrating the cross-border collaboration increasingly necessary to counter sophisticated threats.

French authorities have not released the name of the ferry company involved or details about the vessel’s regular route, likely to avoid disruption to commercial operations while the investigation continues.