The group, which announced the attack on its Telegram channel, stated that it had targeted vessels belonging to the National Iranian Tanker Company (NITC) and the Islamic Republic of Iran Shipping Lines (IRISL). The attack reportedly severed affected ships’ connections to each other, their ports, and external communication networks.
Lab Dookhtegan claimed the operation was intended to coincide with U.S. military actions against the Iran-backed Houthi movement in Yemen. The group accused the targeted companies of involvement in supplying munitions to the Houthis. It also warned that further cyber operations were planned.
Cybersecurity firm Cydome, which specializes in maritime security, described the attack as significant, highlighting the vulnerability of ship communication systems. “Communication devices are the bottleneck of maritime vessels,” Cydome noted. “If a malicious actor hacks the communication device, it can take complete control over all communications of the vessel and even spread out to IT and OT systems.”
The firm pointed out that the ability to simultaneously disrupt communications on 116 vessels suggests a high level of coordination and automation in the attack.
Separately, the United Kingdom Maritime Trade Operations (UKMTO) center reported multiple incidents of GPS interference in the Strait of Hormuz last week. These disruptions, which lasted several hours, affected vessel navigation and forced ships to rely on backup methods.
The attack comes as Washington increases economic pressure on Tehran. This week, the U.S. government announced a new round of sanctions aimed at limiting Iranian oil exports. Since the start of the year, Iran’s oil exports have reportedly declined to an estimated 1.35 million barrels per day, down from an average of 1.70 million barrels per day in 2024. Reports suggest that some shipments are facing delays in Southeast Asia as the number of available buyers and vessels shrinks.
The full extent of the cyberattack’s impact on Iranian shipping operations remains unclear, but Lab Dookhtegan has claimed that full restoration of affected systems could take weeks.
