Mustang Panda hackers targeted EU maritime sector

The European Union Agency for Cybersecurity (ENISA) reported that a China-linked hacking group, identified as Mustang Panda (also known as Twill Typhoon or RedDelta), conducted sustained cyber-espionage against maritime and shipping organizations in at least seven EU member states throughout 2025.

ENISA described the intrusions as having a “sustained tempo” aimed at intelligence collection and espionage. The agency noted that transport and logistics are among the bloc’s most targeted sectors, accounting for approximately 11% of recorded incidents, due to their economic and political significance regarding geopolitical developments.

Mustang Panda has a history of targeting European networks, including EU diplomatic missions in 2022. Unsealed U.S. Department of Justice filings from January 2025 previously alleged that the Chinese government funded the group to develop custom remote-access tools, such as a version of PlugX, to steal data from victim networks, including European shipping companies and governments.