French authorities are investigating after a Remote Access Trojan (RAT) was found on the GNV ferry Fantastic while it was docked in Sète. A Latvian crew member has been arrested and charged; a Bulgarian was released. The Paris prosecutor opened an inquiry into an alleged organised attack "serving the interests of a foreign power," and the DGSI is leading the probe. Searches were also conducted in Latvia with support from Eurojust.
France Probes Possible Foreign Interference After Remote‑Access Malware Found on GNV Ferry 'Fantastic'
France's internal security service is leading the investigation (STEPHANE DE SAKUTIN)(STEPHANE DE SAKUTIN/POOL/AFP)
French authorities have opened an inquiry after malware capable of remotely controlling a ship's systems was discovered on the GNV passenger ferry Fantastic while it was berthed in the Mediterranean port of Sète, Interior Minister Laurent Nunez said on Wednesday.
Paris prosecutors said the code was found on the vessel, which has a capacity of more than 2,000 passengers and is operated by Italian shipping company GNV. Italian authorities alerted their French counterparts after warning that the ship's operating system might have been infected by a Remote Access Trojan (RAT), a kind of malware that can allow a remote actor to take control of an infected system.
Two crew members — identified by Italian authorities as a Latvian and a Bulgarian — were detained last week. The Bulgarian crew member was released; the Latvian was charged and placed under formal arrest as part of the investigation.
Official Response and Investigation
The Paris prosecutor's office said it has opened an investigation into an alleged attempt "by an organised group to attack an automated data-processing system, with the aim of serving the interests of a foreign power." Reflecting the seriousness of the case, the probe is being led by France's domestic intelligence agency, the General Directorate for Internal Security (DGSI).
After the Fantastic was cordoned off in port, the DGSI conducted an emergency inspection and seized several items as part of the inquiry. Maritime authorities later cleared the vessel to resume sailing after technical checks concluded there was no ongoing danger to people on board.
International Links and Reactions
Emergency searches were also carried out in Latvia with assistance from Eurojust, the European Union's judicial cooperation agency, and Latvian authorities. Interior Minister Nunez told France Info radio: "This is a very serious matter... individuals tried to hack into a ship's data-processing system." He confirmed investigators are examining the possibility of foreign interference but did not explicitly name any country.
The Latvian national's lawyer, Thibault Bailly, dismissed suggestions of a Russian link in press reports, describing the "theory of Russian interference" as "superfluous" and saying the investigation will clarify unclear aspects of the case.
Authorities are continuing forensic analysis of the malware and seized material. Investigators will aim to determine how the code reached the vessel, whether the intrusion targeted navigation or other critical systems, and whether it was part of a broader campaign.
