Cyber Threat Actor: Corsica Ferries Cyber Attack Group

The threat actor knownpublicly as the Corsica Ferries Cyber Attack Group operates under that alias and has been linked to a single reported incident targeting the French ferry operator Corsica Ferries. The group’s location is noted as France, based on the victim’s geographic context and the actor’s self‑referential name. The observed targeting falls within the maritime transportation sector, specifically affecting a company that provides passenger and vehicle ferry services between mainland France and the island of Corsica.

On 27 October 2023 the actor launched a cyberattack that rendered Corsica Ferries’ online reservation system inaccessible for more than twenty‑four hours, with the website displaying maintenance notices and preventing new ticket purchases through the digital channel. Maritime operations continued unaffected, allowing passengers to buy tickets at the dock and leaving existing reservations valid throughout the outage. The company confirmed the disruption via its official website and social media, explicitly attributing the service interruption to malicious activity. Restoration of the online booking platform occurred after approximately thirty hours, although the technical details of the remediation and any forensic findings were not released to the public.

No information regarding the malware families, initial access vectors, or specific tools employed by the Corsica Ferries Cyber Attack Group has been disclosed in the available reporting. Likewise, no public attribution to a state sponsor, criminal consortium, or other affiliation has been made, and the actor’s strategic objectives—whether financial, espionage‑related, or purely disruptive—remain unspecified in the source material. Consequently, the only verifiable characteristic of this threat actor is its single demonstrated action against a French ferry booking system, with all other aspects of its capabilities, motives, or affiliations currently unknown.