Port of Houston Authority

In August 2021, the Port of Houston (USA) faced a sophisticated cyber attack targeting its computer network. The threat actor, suspected to be a nation-state group, exploited an unknown zero-day vulnerability meaning the flaw was undiscovered by the software vendor at the time. The primary objectives were to exfiltrate sensitive government intelligence and disrupt or halt port operations entirely. Despite the severity of the attempt, the port’s pre-established security protocols successfully mitigated the attack, preventing any compromise of operational systems or data. While no direct financial, reputational, or data breaches occurred, the attack’s intent posed a critical threat to national infrastructure and supply chain stability. The incident underscored vulnerabilities in maritime cybersecurity, particularly against advanced persistent threats (APTs) with geopolitical motivations. Had the attack succeeded, it could have crippled one of the U.S.’s busiest ports, triggering cascading economic and logistical consequences across global trade networks.

Source: https://www.microsoft.com/security/blog/2021/11/08/threat-actor-dev-0322-exploiting-zoho-manageengine-adselfservice-plus/

TPRM report: https://www.rankiteo.com/company/port-houston

"id": "por414092125",
"linkid": "port-houston",
"type": "Cyber Attack",
"date": "8/2021",
"severity": "100",
"impact": "6",
"explanation": "Attack threatening the economy of geographical region"

{'affected_entities': [{'industry': 'transportation/logistics',
                        'location': 'Houston, Texas, USA',
                        'name': 'Port of Houston',
                        'type': 'government/maritime port authority'}],
 'attack_vector': 'zero-day vulnerability exploitation',
 'date_detected': '2021-08',
 'description': 'In August 2021, the Port of Houston (USA) experienced an '
                'attack on its computer network. The attacker attempted to '
                'exploit a zero-day flaw, meaning the flaw was not yet known '
                'to the software creator. The hacker, who appears to be a '
                'nation-state actor, aimed to gain sensitive government '
                'information and disrupt/end operations. Following the '
                "facility's security plan, no operational data or systems were "
                'impacted.',
 'impact': {'operational_impact': 'none (no operational data or systems '
                                  'impacted)'},
 'initial_access_broker': {'high_value_targets': ['sensitive government '
                                                  'information']},
 'motivation': ['espionage (sensitive government information)',
                'operational disruption'],
 'post_incident_analysis': {'root_causes': ['zero-day vulnerability '
                                            'exploitation by nation-state '
                                            'actor']},
 'response': {'containment_measures': ["followed facility's security plan"],
              'incident_response_plan_activated': True},
 'threat_actor': 'nation-state actor',
 'title': 'Cyberattack on the Port of Houston (August 2021)',
 'type': ['cyberattack', 'zero-day exploit', 'nation-state attack'],
 'vulnerability_exploited': 'unknown (zero-day)'}