For years now, Red Sky Alliance has been reporting on vessel name spoofing, using fake email addresses to lure companies in the maritime arena to click on infected emails. Now Georgia Tech has revealed vessel GPS spoofing, which produced a study showing 367,000 ships affected by global GPS spoofing. This research included the Red Sea activity detected months before the MSC Antonia grounding in May 2025. Researchers analyzing global ship-tracking data have identified 31 persistent areas of abnormal GPS activity, with at least 22 showing strong evidence of large-area spoofing that can make vessels report false positions and physically impossible movements.
The study (StoreBig Data) which was published 29 September by researchers at the Georgia Institute of Technology, examined Automatic Identification System (AIS) data from more than 367,000 vessels. The authors describe it as the first global measurement study of large-area maritime GPS spoofing based on real-world vessel traffic, and the paper is due to appear at the 2027 IEEE Symposium on Security and Privacy.[1]
Researchers Tracked Impossible Ship Movements - Ships use AIS to broadcast information including their identity, position, speed and course, with location information derived from satellite navigation. Civilian GPS signals are generally unauthenticated and unencrypted, leaving receivers open to counterfeit signals that can cause them to calculate an incorrect position.
Rather than looking for isolated GPS errors, the researchers searched for groups of independent vessels reporting physically implausible movements in the same place and at similar times. Their system checked for signs including ships apparently travelling faster than 60 knots, positions appearing on land and locations deviating by more than five kilometers from their expected course.
Those checks identified 17,936 abnormal episodes involving 2,663 vessels during data collected from late November 2024 to early February 2025. The events amounted to more than 31,000 hours of implausible navigation and were grouped into 31 persistent geographic zones.
StoreBig Data - After checking the zones against known incidents and the characteristics of the vessel movements, the researchers classified 13 as corroborated spoofing and another nine as newly identified spoofing supported by strong internal evidence. The remaining nine were considered suggestive but not individually conclusive.
Ships Appeared to Move in Circles, Straight Lines and Onto Land - The false movements did not all look alike. Some vessels appeared to travel in near-perfect circles while their reported speed and course remained stable. Others suddenly jumped onto straight tracks extending for tens of kilometers before returning to their actual positions.
One particularly unusual pattern involved several vessels appearing at the same small inland location near Queen Alia International Airport in Jordan. Because independent ships were reporting the same impossible inland position, the researchers assessed the activity as consistent with regional interference affecting multiple GPS receivers.
Similar activity appeared in the Black Sea, Eastern Mediterranean, Red Sea, East Asian waters, Baltic region and Strait of Hormuz. The researchers also identified previously unreported zones near the Canary Islands, Gulf of Mexico and Panama Canal.
In the Gulf of Mexico, nearly 200 vessels displayed synchronized positional jumps on December 31, 2024. The researchers reproduced the event using separate public AIS data from the US National Oceanic and Atmospheric Administration, providing an independent check on the pattern detected in the commercial dataset.
Red Sea Spoofing Appeared Months Before MSC Antonia Grounding - One finding connects the historical data to a later maritime accident. In May 2025, the 75,000-ton container ship MSC Antonia grounded in the Red Sea after an incident attributed to GPS spoofing. The vessel remained immobilized for more than five weeks.
StoreBig Data - When the researchers examined their earlier records, they found the same type of linear displacement near Port Sudan in January 2025, five months before the grounding. A bulk carrier named Charmous and at least 11 other vessels recorded overlapping false movements in the area. The false tracks shared the same latitude, to the fifth decimal place, as the pattern later recorded from MSC Antonia.
Strait of Hormuz Activity Was Visible More Than a Year Earlier - Another persistent zone appeared in the Strait of Hormuz during early 2025. According to the paper, this was more than a year before widespread GPS interference affected commercial shipping in the Persian Gulf during the 2026 Iran war.
The researchers found different patterns elsewhere. Spoofing near the Black Sea was sustained for days in some cases, while activity around Gaza appeared in repeated bursts. Other locations, including the Gulf of Mexico and Panama Canal, showed shorter events.
The researchers separately examined vessels suspected of falsifying their own positions. By comparing vessel identifiers with US, EU and UK sanctions lists, the team identified between 16 and 215 sanctioned vessels suspected of this activity.
The paper cites the sanctioned Russian tanker Hyperion as one example, with false inland positions appearing near Vladivostok while the ship was transporting Russian oil to China. Reported positions associated with the sanctioned Russian tanker Hyperion show false inland locations near Vladivostok and implausible movements through East Asian waters.
The Data Cannot Identify Who Is Behind the Spoofing - AIS data cannot show what generated the false position. The system sees the position calculated by a ship’s navigation equipment and subsequently broadcast through AIS, not the radio signal that caused the incorrect position.
StoreBig Data - That means the findings cannot locate the transmitting equipment, identify whoever operated it or determine the exact technology used to generate the counterfeit GPS signals. Explanations connecting some activity with military operations, air defense or regional conflicts are therefore hypotheses based on timing, location and previously documented events.
The detection method also has limits. It was designed to find regional interference affecting multiple vessels, so smaller displacements, incidents lasting less than 30 minutes and spoofing affecting only one vessel can fall outside its detection criteria. The authors therefore describe their measurements as a lower bound on maritime spoofing activity.
Still, the results show that recurring GPS interference can be identified from ship movements before a serious navigation incident occurs. The researchers propose continuous monitoring that could eventually feed risk maps, safety advisories or navigation overlays warning crews when they are approaching areas with a history of unreliable GPS.
This article is shared at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We provide indicators of compromise information (CTI) via a notification service (RedXray) or an analysis service (CTAC). For questions, comments or assistance, please contact the office directly at 1-844-492-7225, or feedback@redskyalliance.com
Weekly Cyber Intelligence Briefings:
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://register.gotowebinar.com/register/5207428251321676122
[1] https://hackread.com/ship-study-global-gps-spoofing-red-sea-activity/
Comments