The Ships Were in the Black Sea. Their Signals Said Peru.
AIS manipulation has gone industrial — 1,702 impossible position jumps in one week, and fake port calls now outnumbering real ones. Every system that trusts the maritime map is inheriting the lie.
September 28, 2026 | By The CyberSurv Team | CyberSurv
A receiving station in Varna, Bulgaria picked up something strange this month: four tankers operating in the Black Sea were broadcasting AIS positions from a single one-kilometer patch of Lima, Peru — 12,129 kilometers away. Twenty-seven separate reports, all placing ships on the wrong side of the planet. “When our Varna receiver showed four tankers sitting in Lima, we immediately knew the truth,” said Dr. Owen Taylor, CEO of Worldwide AIS Network, which caught the manipulation. “Everyone else is analysing interference after the fact.”
That detail matters more than the absurdity of the destination. The tracking data that underpins global shipping — routing, sanctions screening, insurance, cargo pricing, even collision avoidance — is being rewritten at scale. And almost nobody checks it before believing it.
A Week of Impossible Voyages
Between September 2 and 9, Worldwide AIS Network recorded 1,702 physically impossible position jumps involving 379 vessels in the Gulf of Oman. Not glitches. Not the occasional dropped packet. Seventeen hundred instances, in seven days, in one body of water, of ships teleporting in ways no hull can move. At midnight UTC on September 9, nearly a third of all AIS reports from the area arrived with the vessel’s own positioning system flagged as inoperative.
The Gulf of Oman isn’t a random location. It sits at the crossroads of sanctioned oil flows, shadow-fleet transshipment, and an active electronic-warfare environment. Earlier this year, Windward documented GPS jamming that disrupted more than 1,100 vessels in a single day across the Middle East Gulf, with ships appearing at airports and nuclear facilities. We covered the navigation-side risk in our earlier look at GNSS jamming and spoofing. What’s new is the sheer volume — and the shift from disrupting signals to fabricating them.
Fake Port Calls Now Outnumber Real Ones
Here’s the number that should stop every compliance officer cold. The International Union of Marine Insurance analyzed traffic at Khor al Zubair, the Iraqi port at the center of a sanctioned-crude blending scheme, and found more than 900 falsified voyages between January 2025 and July 2026. Before March, spoofed port calls ran 45 to 78 per month — roughly 45% of reported traffic. Since April, fake calls have exceeded real ones. Fifty-seven percent of what the data shows never happened.
IUMI’s chief analyst put it plainly: a port call in the data is no longer evidence of a port call. When legitimate traffic thins out, deceptive traffic doesn’t thin with it. It becomes the signal. Lloyd’s List Intelligence has tracked the same evolution in shadow-fleet identity manipulation: vessels borrowing the identities of legitimate ships, mimicking normal sailing patterns, appearing to load in port while operating somewhere else entirely.
AIS Was Never Built to Be Believed
None of this requires breaking encryption, because there isn’t any. AIS is an open VHF broadcast designed in the 1990s for collision avoidance between ships that had no reason to lie to each other. There’s no authentication, no signature, no verification. Any transmitter can claim to be any vessel, anywhere. For decades that was an acceptable trade-off. Then an entire commercial ecosystem — sanctions-screening platforms, underwriting models, charter-party decisions, cargo-pricing systems, port logistics — quietly built itself on top of a data feed that anyone with a few hundred dollars of radio equipment can poison.
The parallel to the rest of maritime OT is hard to miss. We’ve written about how a compromised ship is now a detained ship, and how a top-tier transshipment hub lost cargo operations to commodity ransomware. The pattern repeats: systems engineered for safety and efficiency in a trusted world, now operating in a hostile one. CYTUR’s latest marine-equipment analysis, highlighted in Cydome’s September 25 bulletin, found that 94% of assessed marine equipment warranted cyber risk mitigation — 60% of it urgently.
The Real Target Is Your Decision-Making
Think about who consumes AIS downstream. Your sanctions-screening vendor uses it to clear counterparties. Your insurer prices hull and cargo risk on it. Your chartering desk validates voyage histories with it. Your bridge team watches it for traffic. Manipulated AIS doesn’t attack any of those systems directly — it feeds them fiction and lets them do the damage themselves.
That’s what makes this different from a conventional intrusion. There’s no malware to find and no perimeter to harden. The attack lives in the gap between data and truth, and it succeeds every time an organization treats an unauthenticated broadcast as evidence. A false port call can launder sanctioned crude into a legitimate cargo. A spoofed position can manufacture an alibi, mask a rendezvous, or lure a warship into an incident. A third of a region’s fleet reporting dead navigation systems can hide almost anything.
What Operators Should Do Now
You can’t fix AIS. You can stop trusting it blindly. We’d start here:
- Reclassify AIS as unverified input. Anywhere it feeds a compliance, commercial, or safety decision, document that dependency and require corroboration — radar, satellite imagery, RF geolocation, port records — before the decision stands.
- Ask your vendors the hard question. Does your sanctions-screening or tracking provider verify positions at the point of reception, or filter anomalies after ingestion? The difference decides whether you act on fiction.
- Watch for the tells. Impossible speed-distance combinations, identical positions from multiple vessels, and sudden clusters of “positioning system inoperative” flags are detectable with basic analytics your team can run today.
- Put navigation-data integrity in scope. A maritime cybersecurity assessment should cover the bridge’s dependence on external data feeds — AIS, GNSS, ECDIS updates — not just the ship’s networks.
- Monitor continuously, not annually. Spoofing campaigns evolve week to week. Programs like RiskGuard 365℠ exist because the threat picture on September 9 looked nothing like the one on September 2.
Final Thoughts
The maritime industry spent the last two years learning that ships and ports can be hacked. The lesson of this month is quieter and, we’d argue, bigger: the shared picture of where every ship is can be hacked too. Once fake traffic outnumbers real traffic on a major sanctioned-trade route, the map has stopped being a map. It’s a claim — and claims need verification. The operators who internalize that first will make better compliance calls, buy insurance on honest terms, and keep their bridge teams out of manufactured incidents. The ones who don’t will keep making confident decisions on data someone else is writing.
Let’s Explore What’s Possible
At CyberSurv, we help maritime operators, ports, and critical-infrastructure organizations see their real risk picture — including the data feeds their decisions quietly depend on. From Maritime Cybersecurity Assessments to penetration testing and continuous monitoring with RiskGuard 365℠, we’ll help you find the assumptions an adversary would exploit — before they do.
