The transportation sector cyber threat overview

## Executive summary This Sekoia.io report analyses cyber activity targeting the transportation sector in 2022–2023, documenting a rise in financially-motivated ransomware (RaaS and double‑extortion/exfiltration), credential-stealing phishing (including mobile-focused FluHorse), widespread exploitation of the MOVEit zero-day attributed to TA505-related intrusion sets, opportunistic hacktivist DDoS/RDDoS campaigns tied to the Russia–Ukraine conflict, and state-aligned operations (destructive and espionage) against logistics, rail, maritime and aerospace entities, with impacts on operations, data confidentiality and supply chains.