France probes foreign interference after remote-control malware found on passenger ferry

PARIS — France's counterespionage agency is investigating a suspected cyberattack plot targeting an international passenger ferry, authorities said Wednesday. A Latvian crew member is in custody facing charges of having acted for an unidentified foreign power, French officials said. Interior Minister Laurent Nunez suggested that Russia is suspected, saying, "At the moment, foreign interference very often comes from the same country."

Investigators from the Paris prosecutor's office said the ferry, which was docked in the French Mediterranean port of Sète, is at the center of the inquiry after intelligence from Italian authorities indicated that software sometimes used by cybercriminals could infect a ship's computer systems. The so-called RAT software — remote access trojan — could have allowed an attacker to take control of the vessel's data-processing systems, prosecutors said. Police on Friday arrested two of the ferry's crew members — one Latvian, the other Bulgarian — who Italian authorities had identified as suspects; the Bulgarian was released after questioning. The Latvian national is held on a preliminary criminal conspiracy charge and two preliminary charges of hacking-related offenses with the aim of serving the interests of an unnamed foreign power; searches also were conducted in Latvia.

The ferry has since returned to service following security checks of its computer systems, the Paris prosecutor's office said. Officials described the case as serious and said investigators are pursuing a trail of foreign interference rather than a definitive plan to seize or hijack the vessel. The Latvian suspect remains in custody on earlier charges, and Latvia's state police said they had no comment at this time.

France and other European security partners have long warned that Moscow's campaign against the West includes cyberattacks, disinformation and other acts that can be difficult to trace. Interior Minister Nunez's remarks reflected ongoing concern about foreign interference in critical infrastructure, a characteristic feature of suspected hybrid warfare against European states.

The investigation is continuing as authorities seek to determine whether the malware or remote-control software was ever used to manipulate the ferry's operations or data systems, and if so, for what aim. The case illustrates the fragile line between cybercrime and state-backed interference and underscores the vigilance of European security agencies as ships, ports and other transport links increasingly rely on interconnected computer networks.