In early 2024, Mustang Panda, a state-sponsored threat actor, executed a targeted cyber campaign against European cargo shipping firms in Norway, Greece, and the Netherlands using Korplug malware loaders. The attack vector involved malicious USB drives with deceptive filenames, exploiting human error to infiltrate systems. While some malware samples were detected and blocked by security measures, others evaded detection through altered signatures and DLL hijacking techniques, allowing persistent access.The compromise disrupted operational integrity, with potential risks including unauthorized data access, supply chain interference, and financial fraud—though the article does not confirm large-scale data exfiltration or ransom demands. The attack also revealed tactical overlaps with CeranaKeeper, another APT group using distinct tools like TONESHELL, suggesting shared infrastructure but independent operations. The incident underscores vulnerabilities in maritime logistics, where third-party USB devices and legacy system dependencies create exploitable gaps. No public reports confirm customer data breaches, ransomware deployment, or critical infrastructure damage, but the intrusion poses reputational harm, regulatory scrutiny, and potential financial losses from remediation and downtime.