Greek shipowners and major businesses are carrying out system checks after a high-priority cybersecurity advisory was issued last week by the country’s National Cybersecurity Authority, Reuters reports. The move comes amid suspected Iran-linked cyber activity and rising interference affecting navigation in key Gulf shipping lanes.

The warning was sent to companies operating in sectors deemed critical to national and economic security, including shipping, banking, transport, telecommunications, health care and energy. It urged firms to examine their systems for signs of intrusion and strengthen their defenses as a precaution.

A source at the authority told Reuters the advisory was not triggered by a confirmed large-scale breach in Greece, but by concerns over emerging threats.

Focus on shipping as disruptions grow

Part of Greece’s shipping industry has already received the alert, with at least two companies notified, according to sources cited by Reuters.

The timing coincides with a spike in electronic interference affecting commercial vessels in the Strait of Hormuz and the wider Gulf, a critical artery for global trade. While no major cyberattack has been confirmed in Greece, one source said some suspicious activity has been detected, prompting increased vigilance.

Inside the cyber alert

Authorities described the advisory as “high-priority” and linked it to an ongoing investigation into a cyber incident involving a large international organization abroad, without naming the entity.

The guidance includes detailed indicators of potential compromise, such as specific IP addresses, malicious tools and malware including the VShell Remote Access Trojan. Companies are advised to block suspicious connections and conduct full system reviews if any signs of intrusion are found.

According to the advisory, the activity under investigation points to a sophisticated and still-unidentified threat actor. The methods outlined suggest attempts to scan networks, gain unauthorized access and deploy malware through layered infrastructure designed to evade detection.

One of the sources cited by Reuters said some of the IP addresses flagged in the advisory appear to originate from Iran.

Regional incidents heighten concern

The Greek alert comes against a backdrop of cyber incidents linked to regional tensions.

An Iran-linked hacking group earlier this month claimed responsibility for a cyberattack on U.S.-based medical technology company Stryker, according to messages posted on Telegram. Separately, Albania reported a cyberattack on its parliamentary systems, which local media attributed to the Iran-linked group “Homeland Justice.”

Greek authorities say the advisory is intended to reduce exposure to similar threats, as concerns grow that geopolitical tensions could increasingly play out in cyberspace.

All sources cited by Reuters spoke on condition of anonymity because they were not authorized to comment publicly.