[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fODq0o0ZOl8EySPJ_fap3y5xFuFK5QRaWY1PBUpQGEuY":3},{"article":4,"iocs":45,"watch_terms":49,"solutions":50,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":22,"category":23,"article_tags":27},"2d159c7a-841b-4f79-9025-9ecc46484cb3","Shipping giant Maersk says recent cyber incident affected legacy system","shipping-giant-maersk-says-recent-cyber-incident-affected-legacy-system-82b94a","The incident is the latest in a string of attacks on ports and other shipping organizations worldwide, with Brazil’s largest port hit with ransomware last week.","Shipping giant Maersk has reported a cyber incident affecting a legacy system acquired from LF Logistics, a company it purchased in 2022. While Maersk states the incident is isolated and does not impact other systems or customer data, the WhiteArmor ransomware gang has claimed responsibility for attacking LF Logistics, alleging the theft of 100GB of data. This incident follows a pattern of attacks on the shipping and logistics sector, including a recent ransomware attack on Brazil's Santos Port Authority.","Maersk confirms cyber incident impacting a legacy system from a previous acquisition.","https:\u002F\u002Ftherecord.media\u002Fshipping-giant-maersk-says-recent-incident-affected-legacy-system","http:\u002F\u002Fcms.therecord.media\u002Fuploads\u002Fship_03c3b365ad.jpg","2026-11-12T18:28:00+00:00","2026-11-12T19:00:08.540088+00:00",7,[17,20],{"name":18,"type":19},"Maersk","vendor",{"name":21,"type":19},"LF Logistics","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":22,"icon":24,"name":25,"slug":26},null,"Threat Intelligence","threat-intelligence",[28,33,38,43],{"category":29},{"id":30,"icon":24,"name":31,"slug":32},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":34},{"id":35,"icon":24,"name":36,"slug":37},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":39},{"id":40,"icon":24,"name":41,"slug":42},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":44},{"id":22,"icon":24,"name":25,"slug":26},[46],{"type":42,"value":47,"context":48},"WhiteArmor","Ransomware gang that claimed responsibility for attacking LF Logistics.",[18,21],{"controls":51,"vendors":138},[52,80,109],{"slug":53,"name":54,"problem":55,"products":56},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[57,64,72],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":59,"url":62,"description":63},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"slug":81,"name":82,"problem":83,"products":84},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[85,93,101],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"slug":110,"name":111,"problem":112,"products":113},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[114,122,130],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",[],{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":149},"maersk-ransomware-hit-stems-from-unretired-legacy-system-inherited-in-acquisition","Maersk Ransomware Hit Stems from Unretired Legacy System Inherited in Acquisition","When Maersk acquired LF Logistics in 2022, it also inherited its legacy IT infrastructure — and the security debt that came with it. The WhiteArmor ransomware gang exploited this legacy system, allegedly exfiltrating 100GB of data, illustrating how M&A activity can silently expand an organization's attack surface. Legacy systems acquired through mergers are frequently under-patched, poorly documented, and inadequately integrated into the acquiring company's security controls. This incident underscores that security due diligence cannot end at the deal closing — inherited systems must be rapidly assessed, hardened, or decommissioned to prevent them from becoming a weak link in an otherwise mature security posture.",[144,145,146,147,148],"NIS2 Article 21(2)(d)","CIS Control 1: Inventory and Control of Enterprise Assets (v8)","NIST SP 800-53 SA-9: External System Services","NIST CSF 2.0 ID.AM-1: Asset Management","ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships",{"NIS2 Article 21(2)(d)":150,"NIST CSF 2.0 ID.AM-1: Asset Management":151,"NIST SP 800-53 SA-9: External System Services":152,"CIS Control 1: Inventory and Control of Enterprise Assets (v8)":153,"ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships":154},"This point requires organizations to manage cybersecurity risks arising from their supply chain and third-party relationships, which directly applies to the security risks Maersk inherited by acquiring LF Logistics and its legacy infrastructure.","This category calls for maintaining an inventory of physical and software assets, ensuring that legacy systems brought in through an acquisition are identified, categorized by risk, and subject to appropriate controls before they can be exploited.","SA-9 requires organizations to assess and manage the security of systems and services acquired externally, which would have flagged the unmitigated risk of the inherited LF Logistics legacy environment.","CIS Control 1 requires organizations to actively discover and maintain an inventory of all assets, including those inherited through acquisitions — a gap that left the LF Logistics legacy system inadequately tracked and protected.","This control requires that security risks associated with supplier and acquisition relationships be identified and managed, directly applicable to the inherited security weaknesses from the LF Logistics purchase."]