FBI and Coast Guard Boarded Two Hacked Energy Tankers

FBI and Coast Guard cyber teams boarded a loaded crude tanker in the Gulf of Mexico on Aug. 21 after finding signs that foreign hackers had gotten into its network. Iranian state media had already described a 30-hour assault on the engine room. The agencies said they found malicious activity, then reported no operational harm.

The named ship is VL Prosperity, a Liberian-flagged very large crude carrier bound for Galveston, Texas, with room for roughly 2.3 million barrels. A second foreign-flagged energy ship was boarded on Aug. 24. Whatever happened off Gibraltar, the VLCC still crossed the Atlantic.

Iranian State Media Described an Engine-Room Takeover

On Aug. 20, a dispatch from Tehran named VL Prosperity and put the incident on Aug. 7 in the Strait of Gibraltar, on a voyage from Egypt’s Sidi Kerir terminal toward a US port. It claimed a 30-hour loss of all communications and quoted an unnamed crew member on what the attackers did inside the plant.

WHAT THE AUG. 20 DISPATCH CLAIMED

• The place: A major cyberattack on the Liberian-flagged VLCC in the Strait of Gibraltar.
• The blackout: All of the ship’s communications cut for 30 hours.
• The engine room: Attackers reduced cooling flow, raised engine speed, and disabled the fuel and engine-oil tank.
• The credit: No group had claimed the job; the dispatch framed it as a warning that US-bound cargo in open water is not beyond reach.

That last line was the political payload. The same account told Gulf oil exporters that shifting crude onto longer routes would not put those cargoes out of view. US officials later said the ship slowed near Gibraltar around the time of the alleged attack, then kept going.

Rob Lee, chief executive of the industrial security firm Dragos, said the published mechanical details were technically plausible. “Everything they’re saying is very realistic,” Lee said. He also warned that no public brief had shown who was behind it.

Four days after that dispatch, Iranian state media asked whether cannons would give way to codes, and whether any American vessel was still safe. The US has not pinned the Gibraltar incident on Tehran. Officials have been examining whether Iran or an aligned actor was involved, a question that was still open in mid-September.

The Boarding Party Climbed Aboard on Aug. 21

The public US account is colder, and later. A joint FBI and Coast Guard statement said teams boarded two foreign-flagged commercial ships in the Gulf of Mexico on Aug. 21 and Aug. 24 to protect the integrity of onboard operational and information technology systems “following indications that the networks of both vessels were compromised.”

The FBI said both ships were boarded after those indications. The Coast Guard described the Aug. 21 job in detail and did not match that account ship for ship. Rear Adm. Amy Grable, commander of Coast Guard Cyber Command, said her people had been tipped by other agencies and went offshore with the FBI.

THE GULF BOARDING CALENDAR

1. Aug. 1, 2026: VL Prosperity leaves Sidi Kerir, Egypt, for Galveston, Texas.
2. Aug. 7, 2026: Iranian state media later dates a Gibraltar cyberattack and a 30-hour communications cut to this day.
3. Aug. 20, 2026: The Tehran dispatch names the ship and describes engine-room interference.
4. Aug. 21, 2026: Coast Guard law enforcement, Cyber Protection Team members, a vessel inspector, and FBI Cyber Action Team operators board for four days.
5. Aug. 24, 2026: A second energy ship is boarded; VL Prosperity’s listed arrival at Galveston is 9:30 that morning.

The Aug. 21 party spent four days on the VLCC. Investigators checked information technology and other onboard systems, hunted for malware, and worked with the captain, the crew, and shore staff from the owner’s office. The Coast Guard said those people cooperated. HMM Ocean Service Co., Ltd., the South Korea-based manager, confirmed the boarding and said it “has rigorous cyber protocols in place to ensure the safety and security of vessels under our care.”

The joint statement’s bottom line was the sentence the agencies wanted on the record: there were no reports of operational disruptions, vessel instability, physical danger to crews, or environmental impacts. Corey Ranslem, chief executive of the maritime security firm Dryad Global, said his company had confirmed the boarded crude ship was the Liberian-flagged VL Prosperity.

Coast Guard Cyber Teams Already Board 40 to 50 Ships a Year

Grable told interviewers the team did find a malicious cyber actor. That is the fact that keeps this from being a rumor. It is also the fact that sits beside a much quieter number: this boarding was one of roughly 40 to 50 missions the Coast Guard Cyber Protection Team has undergone in the past year.

They started out by doing an assessment of the information technology and the other systems on board the vessel, and they did find malicious cyber activity.

Rear Adm. Amy Grable, commander, Coast Guard Cyber Command

She said the worry is not a stolen file. It is an IT network that touches gear that moves the ship. “The real thing we’re concerned about is those IT systems being connected to other systems on the ship that control propulsion, navigation and other systems that are critical to the safety of that vessel,” Grable said.

Asked whether cyber access could amount to remote hijacking, she called that a fair way to put the broader risk. “That’s a good way to characterize it, and yes, it is a concern,” she said. She added that moving from a network break-in to messing with machinery is “not necessarily that sophisticated,” because malicious source code is already in circulation, and that basic hygiene, network splits, and phishing defenses would stop most of these cases.

She also said response teams found no evidence the ship had become unsafe to navigate when they climbed aboard. They collect data for later analysis and plan to send the owner a list of patches. The Coast Guard said it was talking with port operators, vessel owners, and local maritime stakeholders so port work could continue.

Grable put a price on a messy arrival. She said $5.4 trillion in commerce moves through US ports each year, and that even a shift to manual operations after a cyber break can stall tankers and cargo ships at the dock. A collision, an explosion, a blocked channel, or a spill is the list she ran through, not a lost email server.

How Much of a Supertanker Can a Hacker Move?

The gap between the Tehran dispatch and the Gulf boarding is not only political. It is technical. Iranian state media described control of propulsion, navigation, and cargo. US investigators described malware on IT and other systems, a ship that was still safe to handle, and a crew that was never reported in danger.

WHERE EXPERTS DISAGREE

• Rob Lee, Dragos: The engine-room effects in the Aug. 20 account match how these ships are built, and a foothold on a maritime asset could, in a bad case, be used to run it aground.
• Quinton DuBose, former Coast Guard cyber official: Treat “full control of the ship” with caution, because ships are complicated, and the likelier play is knocking out enough subsystems to make safe handling harder.
• Andrew Tierney, Pen Test Partners: On large commercial ships a person remains in the loop, the helm can be taken by hand, and propulsion control is rarely networked, while a hit on the power-management system is the more believable path to a blackout.

DuBose put it plainly. “I’d be kind of cautious about saying that somebody can just take control of the ship,” he said. “Ships are incredibly complicated systems.” The better question, in his view, is which systems an attacker can degrade until the vessel is less safe to operate. He also noted that Iranian-linked actors often oversell what they can do, and that naming a culprit can take weeks or months.

That reading matches older cases better than a Hollywood steering wheel. In February 2017, attackers held a container ship’s navigation for 10 hours on a German-owned vessel, and the captain could not maneuver until specialists restored control. Maersk’s 2017 NotPetya hit smashed shoreside IT, not a wheelhouse joystick. GPS spoofing in the Black Sea made ships look as if they were sitting on an airport.

The waterfront instinct, once this boarding became public, was analog. Paper charts. A sextant joke. A reminder that the first job on a dark bridge is to look out the window. That is not panic about a remote-controlled bomb. It is a crew problem: time, workload, and whether the digital layer fails while the ship is in open water or in a tight channel.

On many modern ships, Lee said, a single firewall can sit between a satellite link and a shared network that holds navigation, propulsion, ballast, steering, and command. Grable’s own warning was that internet-facing systems are the door. The International Maritime Organization’s guidelines on maritime cyber risk management already tell companies to treat cyber risk as a safety issue inside existing safety-management systems, not as an IT side chore.

VL Prosperity Still Sits Off Galveston

Public tracking still treats the VLCC as a Galveston ship. VesselFinder lists it as a 2015 crude tanker, IMO 9683697, 333 meters long and 60 meters wide, 319,547 tonnes deadweight, sailing under Liberia, with an AIS track still points to Galveston and an expected arrival of Aug. 24 at 9:30. Mid-September positions put it in the Gulf of Mexico. Draught was listed at 21.0 meters, a deep load line for a ship this size.

THE VL PROSPERITY FILE

Coast Guard crews released photographs of staffers and FBI agents climbing onto one of the vessels. Those pictures are what a Gulf boarding looks like: ladders, helmets, a hull the size of a city block. They are not pictures of a ship in distress. The agencies have not named the second vessel in their own statements. Tracking later pointed to a Marshall Islands-flagged LPG carrier on a Texas run to load cargo, boarded three days after the VLCC.

HMM’s public line was protocol and cooperation, not a casualty report. Grable’s public line was malware found and a ship that was still fit to handle. The Tehran dispatch’s public line was a silenced radio and an engine room that had been messed with. Those three sentences can all be on the page at once if they are kept in their lanes: a claim from Aug. 7, a forensic boarding 14 days later, and a VLCC that did not stop being a Galveston ship.

The Cargo Took the Long Way Around Hormuz

Sidi Kerir is not a random Egyptian pier. It is the Mediterranean end of a pipeline that lets Gulf crude skip the long way around when the Strait of Hormuz is a bad bet. VL Prosperity left that terminal on Aug. 1, passed Gibraltar, and pointed at Texas. Iranian state media’s own write-up treated that routing as the point: cargo that leaves the Gulf on a longer path is still, in that telling, in range.

Some later posts moved the scene to the Suez Canal, which is the wrong strait. Gibraltar sits between Spain and Morocco. The ship’s own track and the Aug. 20 dispatch both put the alleged break there. Getting the waterway wrong is how a forensic boarding gets sold as a first hit on a canal.

WHAT WE KNOW

• Two boardings: FBI and Coast Guard teams went aboard two foreign-flagged energy ships in the Gulf of Mexico on Aug. 21 and Aug. 24.
• Malware on the VLCC: Grable said investigators found malicious cyber activity on VL Prosperity and no sign it was unsafe to navigate at boarding.
• No casualty report: The agencies said they had no reports of operational disruptions, instability, crew harm, or environmental damage.

WHAT IS UNCONFIRMED

• Who did it: No group claimed the Gibraltar incident, and the US has not publicly named Iran or anyone else.
• How far the break went: Engine-speed, cooling, fuel, navigation, and cargo control remain claims from an unnamed crew member, not findings in the US statement.
• The second ship: Agencies have not officially named it; tracking identifies an LPG carrier on a Texas load run.

Fourteen days after the alleged Gibraltar break, the United States answered with ladders, a cyber protection team, and a four-day inspection, then left a 333-meter crude carrier on a Galveston heading. That is a smaller ending than the Aug. 20 dispatch advertised, and a larger one than a routine port-state paperwork stop. The cargo was still in the Gulf. The owner’s manager was still talking about protocols. The name on the hull had not changed.