With the launch of our new podcast series Rough Seas: The Northwave Cyber Podcast, we introduce a platform that dissects complex cyber incidents based on forensic evidence. Host Ruby Whitmore and a rotating line-up of cybersecurity experts analyse attackers' tactics, techniques and procedures (TTPs) to give organisations concrete strategic lessons. The first episode centres on a striking case from the logistics sector: the digital infiltration of a container terminal in the Port of Antwerp.

Many organisations focus their digital defences primarily on repelling external attacks, such as phishing or the exploitation of software vulnerabilities. This episode, however, shows that the human factor within the physical perimeter poses an equally significant risk, a blind spot many organisations aren't prepared for. Cybersecurity expert Pim Takkenberg discusses how physical crime and advanced digital threats increasingly intertwine within the logistics chain, offering a concrete starting point for assessing your own physical and digital resilience.

The insider threat

A criminal network gained access to the terminal through bribery. Criminals paid a gate employee €10,000 to insert a prepared USB stick into a local computer system during her shift. This activated the initial malware within 15 seconds.

This method underscores that criminals increasingly combine traditional tactics, such as blackmail and bribing staff in key positions, with advanced digital techniques to bypass security barriers. Organisations can therefore no longer treat physical access control and cybersecurity as separate disciplines.

The economic barriers of digital defence

A key technical insight from the debrief is the impact of strict network segmentation on an attacker's operational costs. After the employee planted the USB stick, an external cyber actor (operating online under the name 'Davy') attempted to move deeper into the central corporate network via lateral movement. The goal was to obtain databases containing PIN codes and logistics location data for specific containers.

When the attacker tried to obtain elevated privileges using the pass-the-hash technique, the terminal's active monitoring and network security blocked the attempt. As a result, the attacker had to switch to cracking complex passwords through brute-force attacks. This forced the criminal organisation to purchase large-scale computing power via a cloud service (likely Amazon Web Services), costing them an estimated €1,000 per day.

This demonstrates that sound password policy and effective network segmentation don't necessarily stop every breach outright, but they do drive up an attacker's operational costs to the point where the economic viability of the crime comes under pressure.

Strategic lessons for the logistics chain

The incident, which ultimately led to the arrest and a seven-year unconditional prison sentence for the hacker who carried it out, shows that critical infrastructure within the logistics supply chain is a permanent target. This applies to organised crime, but increasingly also to state actors focused on economic disruption or sabotage, a trend further supported by our own Global Threat Landscape Report.

Countering this threat requires organisations to arm themselves not only preventively, but also to be prepared for the moment an incident occurs. We advise organisations to consider the following strategic measures:

1. Recognise your position in the chain. Criminals rarely attack organisations as an end goal; more often, they use them as a means to a broader criminal objective.
2. Secure the physical workplace. As digital defences improve, attackers increasingly need physical access ("hands on devices"). Laptops and access points require strict controls.
3. Privilege management and monitoring. Strictly limiting administrator rights and continuously monitoring anomalous network traffic significantly reduces the impact of an initial breach.

Listen to the full debrief

The article above covers only the strategic highlights of this case. In the Rough Seas episode, you'll hear the exact chronology of the hack, the specific chat logs between the perpetrators, and the full forensic analysis of the recovery process.

The first episode of Rough Seas is now available on podcast platforms and on our website.

Want to know more about the technical details of this attack? We published an in-depth analysis of the full kill chain, based on court records and international investigations: Lessons Learned From The Cyberattack At The Port Of Antwerp.

Sources:

• OCCRP — Dutch Appeals Court Jails Hacker for 7 Years in Port Cocaine Case
• The Record — Dutch court sentences hacker who used port systems to smuggle cocaine to 7 years
• The Register — Court tosses appeal by hacker who opened port to coke smugglers with malware