The Cranes Stopped at Midnight: Ransomware Just Hit One of the World’s Biggest Transhipment Hubs
A 14-million-TEU port went down at 23:34 and was moving boxes again within a day. The recovery is a masterclass. The two days that followed are the warning.
September 23, 2026 | By The CyberSurv Team | CyberSurv
At 23:34 local time on September 9, the terminal operating systems at Malaysia’s Port of Tanjung Pelepas stopped answering. PTP isn’t a small regional facility. It moved 14,028,375 TEU in 2025 — the first time it cracked the 14 million mark — and it anchors the Gemini Cooperation network that Maersk and Hapag-Lloyd run across Asia-Europe and intra-Asia trades. When a hub like that goes quiet, the ripple reaches three continents before breakfast.
The operator isolated the affected systems and suspended cargo handling as a precaution. By the next day, a controlled, phased restart was underway, with staff processing export container gate-ins manually. By the morning of September 11, Lloyd’s List Intelligence data showed no container ships waiting at anchor. Then, that same day, the story changed shape: the Direwolf ransomware group listed PTP on its leak site.
We’ve spent the past month writing about tankers boarded by federal agents and nation-state actors camped inside maritime firewalls. This one is different. It’s the most ordinary kind of attack there is — criminal ransomware — landing on one of the most consequential facilities afloat. And that’s exactly why it deserves your attention.
Anatomy of a Midnight Attack
The timeline matters, so here it is in plain terms. Late on September 9, the attack hit the container terminal’s operating systems. PTP — a joint venture between Malaysia’s MMC Group and APM Terminals — shut down cargo operations rather than gamble on containment. Malaysia’s National Cyber Security Agency and the Communications and Multimedia Commission coordinated the response. Maersk confirmed it was working closely with the port, warning that “some vessels may experience delays, but the recovery is progressing well.”
The visible damage stayed remarkably contained. One vessel, the Maersk Hanoi, deviated for roughly ten hours in the Strait of Malacca. Gates ran on manual procedures. Within 48 hours, container operations had resumed and the anchorage was clear.
PTP stated there was “no evidence of unauthorised access to PTP’s customers’ data.” Note the phrasing. That’s an honest statement of what forensics had shown at that moment — not a guarantee of what forensics will show next month.
When the TOS Goes Down, the Port Goes Dark
A terminal operating system is the brain of a container port. It decides where every box sits, which crane lifts it, which truck receives it, and in what order ten thousand moves happen. Nothing else in the facility can answer those questions. So when the TOS is compromised, a port doesn’t degrade gracefully — it stops.
The industry has learned this lesson expensively before. NotPetya froze Maersk’s terminals worldwide in 2017. The Port of Nagoya lost two days to ransomware in 2023. North Carolina’s ports went to manual gate operations just last month. For a transhipment hub, the stakes compound: most of PTP’s volume is boxes passing between ships, which means a stalled yard doesn’t just delay cargo — it breaks connection windows across an entire alliance network.
Here’s the uncomfortable part. Your TOS almost certainly touches your corporate IT network, your billing systems, your customs interfaces, and a dozen vendor connections. Attackers don’t need to target operational technology directly. They need one foothold in the flat, interconnected middle — and the operational side falls over on its own.
The Recovery Was Not Luck
Let’s give credit where it’s due, because the maritime industry needs working examples. PTP detected the intrusion, made the hard call to halt operations within hours, cut the infection off from the rest of the estate, and switched to rehearsed manual procedures at the gates. That sequence doesn’t happen by accident at midnight. It happens because somebody planned it, wrote it down, and practiced it.
Compare the alternative: an operator that hesitates to shut down because nobody’s authorized to make that call, discovers its backups were encrypted along with production, and improvises paper processes for the first time with trucks stacking up at the gate. Same attack. Completely different month.
This is precisely why U.S. regulators now require cybersecurity drills — two every twelve months under the Coast Guard’s maritime security rule. Drills are where you find out that the manual gate-in form doesn’t exist, or that the one person who can rebuild the TOS is on leave. Finding that out in an exercise costs you an afternoon. Finding it out on a Tuesday night costs you the anchorage.
The Attack Didn’t End When the Cranes Restarted
Two days after the attack — and after operations had substantially recovered — Direwolf published its claim. That sequencing is the modern ransomware playbook in miniature. Encryption is the loud part. Exfiltration is the quiet part, and it’s where the leverage lives.
PTP hasn’t confirmed ransomware or data theft, and the leak-site listing offered no proof. But every operator should absorb the structural lesson: restoring operations closes the availability problem, not the incident. If data left the building, the second extortion clock starts ticking just as your team is celebrating the restart. And think about what a terminal’s data is worth — cargo manifests, vessel schedules, customer records, network credentials, gate access patterns. In the wrong hands, that’s not just leverage for a payout. It’s targeting intelligence for whoever buys it next.
Meet Dire Wolf — and Notice What It Isn’t
According to research from Trustwave SpiderLabs, Dire Wolf surfaced in May 2025 and has since claimed roughly a hundred victims across more than thirty countries, with ransom demands reaching $500,000. Its Golang-based encryptor disables Windows event logging, destroys backups and shadow copies, kills recovery processes, encrypts, reboots, and deletes itself. Its favorite sectors? Manufacturing and technology — heavily in Asia.
Notice what’s missing from that profile: any maritime specialty whatsoever. Dire Wolf isn’t a nation-state studying your OT protocols. It’s a mid-tier criminal operation working through targets of opportunity. If the group behind this incident really is Direwolf, then one of the world’s premier container hubs was taken offline by commodity tradecraft. You don’t need to be interesting to be a victim. You just need to be reachable.
What Port and Terminal Operators Should Do Now
PTP’s 48 hours give you the checklist. Ask your team these questions this week:
- Can we lose the TOS and still move a truck? Manual fallback procedures must exist on paper, and staff need to have actually run them.
- Who has authority to shut down operations at 23:34? If the answer requires a morning meeting, you’ve already lost the containment window.
- Would our backups survive this? Dire Wolf hunts backups and shadow copies first. Offline, immutable, restore-tested — all three words matter.
- Is our TOS segmented from corporate IT? A penetration test will tell you the truth faster than a network diagram will.
- Do we assume data theft from hour one? Legal notification, customer communication, and credential rotation should launch alongside recovery, not after it.
These are exactly the gaps a Maritime Cybersecurity Assessment is built to expose before an adversary does it for you. And because attackers don’t schedule around your fiscal year, our RiskGuard 365℠ program keeps that vigilance continuous — monitoring, assessment, and response readiness as a standing capability instead of an annual event.
Final Thoughts
September has been a relentless month for maritime cyber news: tankers boarded at sea, firewalls under nation-state pressure, and now a top-tier transhipment hub knocked offline by criminal ransomware. The pattern isn’t that attacks are coming — they’re here, weekly. The pattern is that outcomes now depend almost entirely on preparation. PTP rehearsed, decided fast, and recovered in days. The operators who haven’t rehearsed will get the other version of this story.
Let’s Explore What’s Possible
Whether you operate a terminal, a fleet, or the systems that connect them, we’ll help you find your single points of failure before someone else does — and build the response muscle that turns a potential catastrophe into a bad day. Talk with our team about where your operation stands.
