An empirical analysis of state-sponsored advanced persistent threats targeting the maritime industry in the South China Sea

While the maritime industry is the central hub of global trade and houses government intelligence, it remains defenseless against state-sponsored cyberespionage groups. To date, there is limited scholarship on the elite forms of cyberattacks and how they target the maritime industry. This study aims to fill this empirical gap by analyzing Advanced Persistent Threats (APTs) in the South China Sea, with a primary focus on the maritime industry. The authors analyzed APTNotes, a database containing cybersecurity reports on intelligence and investigations published over the course of 15 years, from 2008 to 2023. This analysis revealed a significant increase in APT activity in the South China Sea, with most attacks credited to Chinese state-affiliated actors. These findings underscore the importance of sharing information on cyberattacks across critical infrastructure and the need for training, especially in the maritime industry, where 80% of global trade volume is transported by sea.