France probes foreign interference after remote-control malware found on passenger ferry

PARIS — France's counterespionage agency is investigating a suspected cyberattack plot targeting an international passenger ferry, authorities said Wednesday. A Latvian crew member is in custody on charges of acting for an unnamed foreign power, French officials said. Interior Minister Laurent Nunez suggested the investigation is probing foreign interference, saying, 'At the moment, foreign interference very often comes from the same country.'

France and other European allies of Ukraine have accused Russia of waging a form of 'hybrid warfare' that includes sabotage, disinformation and cyberattacks, aimed at complicating Western responses to the war in Ukraine. Intelligence shared by Italian authorities tipped off the General Directorate of Internal Security — France's top counterespionage and counterterrorism service — that software sometimes used by cybercriminals may have infected computer systems aboard a ferry docked in the French Mediterranean port of Sète, the Paris prosecutor’s office said. The so-called RAT software — which allows users to control computer systems remotely — could have been used to take control of the ferry's computers. Its statement did not name the ferry.

Nunez told public broadcaster France Info that individuals tried to gain access to a ship's data-processing system. He described it as a very serious affair. Asked if the suspected intention was to hijack the vessel, he said: 'We don't know.' He added: 'The investigators appear to be following a trail of interference … foreign interference.'

Police on Friday arrested two of the ferry's crew members — one Latvian, the other Bulgarian — who Italian authorities had identified as suspects, the prosecutor's office said. The Bulgarian was subsequently released without charge after questioning. The Latvian national is being held on a preliminary criminal conspiracy charge and two preliminary charges of hacking-related offenses with the goal of serving the interests of an unnamed foreign power, the prosecutor's office said. Search raids were also carried out in Latvia. Latvian state police said they had no comment. The ferry is now back in operation after being held in port for security checks to its computer system.

The case comes amid long-running concerns in Europe about foreign powers using cyber tools as part of broader coercive campaigns. French officials have linked such activity to Russia, and the investigation underscores the potential for disruption to critical transportation links in the region. Prosecutors said the inquiry remains active, with investigators continuing to trace digital footprints and any overseas connections tied to the alleged foreign power.