root@ransomvault:~$ tail -f threat_intel.log

RANSOMVAULT

Topics

Patch10Threat Intelligence8Vulnerability7Ransomware3Zero-Day3Malware1Knowledge1
Subscribe to the newsletter →

Ransomware

Maersk Confirms Security Incident Following Whitearmor’s Claimed Breach of LF Logistics Platform

Darkintel Team1 min read

A.P. Moller - Maersk has confirmed an IT security incident. The confirmation came shortly after we reported that the Whitearmor threat group claimed to have breached Maersk’s LF Logistics platform.

What Maersk confirmed
In a statement published on November 11, 2026, Maersk said it had found unauthorized access to, and data extraction from, one of its local legacy systems that came from a previous acquisition. Maersk did not name the system or the threat actor. However, the description matches LF Logistics, the contract logistics company Maersk acquired in 2022 and the platform Whitearmor claimed to have breached.

Maersk said that once its Cyber Security team found the issue, it launched a full investigation, which is still ongoing, and took quick action to secure the affected system.

Maersk’s assessment so far

  • Data: Maersk says its findings so far strongly suggest that no sensitive data has been disclosed.
  • Scope: The incident is limited to a local system. Maersk has found no sign of impact on its other systems, or on customer and partner systems that connect to Maersk through integrations such as APIs and EDI.
  • Operations: Maersk does not expect disruption to operations. Customers can keep booking and managing shipments on Maersk platforms as usual.

Claim vs. confirmation
Maersk’s statement confirms that data was taken from the system. Its preliminary view that no sensitive data was disclosed differs from what Whitearmor claims. The full extent of the stolen data is still unclear and may only become known if the group publishes samples or Maersk’s investigation finds more. Maersk said it will inform affected parties if further findings require it.

Recommendations

  • Maersk and LF Logistics customers and partners: Be careful with unexpected emails, calls, or messages that claim to relate to this incident, especially requests for payment changes, credentials, or shipment details. As Maersk advises, verify them through your usual Maersk contact.
  • Organizations integrated with Maersk: Although Maersk reports no impact on API and EDI integrations, review those connections and their credentials as a precaution.
ShareXLinkedInReddit

Newsletter

Get the latest cyber news in your inbox

Ransomware, breaches and exploited vulnerabilities, delivered by RansomVault.

Free. No spam. Unsubscribe in one click.

Latest news

How PHP2Shell Works, and Why It Gives Attackers Access Before Your Code Even Runs

Knowledge

PHP2Shell, the pair of critical PHP vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, has become one of the most heavily exploited bugs of the year. It was exploited four days before PHP released patches on October 21, added to CISA’s Known Exploited Vulnerabilities catalog, and most recently used to break into Check Point Security Gateways and wipe VMware ESXi hosts. But how does it actually work? This post explains the vulnerability in plain terms, using technical research on th

FAA Grounds All U.S. Flights Over Nationwide Air Traffic Control Communications Failure

Threat Intelligence

On Friday afternoon, the Federal Aviation Administration (FAA) ordered a nationwide ground stop at every U.S. airport, citing "extraordinary circumstances" and safety concerns. U.S. Transportation Secretary Sean Duffy said a communications problem was affecting all Air Route Traffic Control Centers across the country. "FAA technicians are investigating the issue. We will provide immediate updates as we have them," Duffy wrote on X. Departing flights must stay on the ground until further noti

PHP2Shell Attacks on Check Point Gateways Deploy Data Wiper on VMware ESXi Hosts

Zero-Day / Threat Intelligence

Threat actors are exploiting vulnerable Check Point Security Gateways in a campaign that ends with data-wiping malware on VMware ESXi hosts. According to Check Point Research, the attacks began on October 30, 2026, first against Israeli organizations. A single actor ran the whole operation, from initial access to lateral movement and destruction. Background: PHP2Shell PHP2Shell is the name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remo