Dutch court sentences hacker who used port systems to smuggle cocaine to 7 years

A Dutch appeals court sentenced a 44-year-old man to seven years in prison for hacking a major port company in Belgium to help smuggle cocaine into the Netherlands.

The Amsterdam Court of Appeal ruled Friday that the man played a central technical role in a criminal network that exploited port computer systems in 2020 and 2021, allowing traffickers to move drugs through Europe’s logistics hubs without detection.

Prosecutors said the operation enabled the import of 210 kilograms of cocaine via the Port of Rotterdam, one of Europe’s largest ports and a key gateway for global trade.

According to court documents, the defendant persuaded a port employee at a container terminal in Antwerp to plug a USB stick loaded with malware into a work computer. The malicious software created a digital backdoor, giving the hacker remote access to internal port systems used to manage containers, gates and personnel access.

Investigators relied heavily on intercepted messages from Sky ECC, an encrypted communications platform widely used by criminal groups before authorities dismantled it in early 2021. In those chats, the defendant provided step-by-step instructions on how to deploy the malware.

“Simply activate the program on the stick. Double-click it, wait 15 seconds, and then you can remove it,” he wrote in one message cited by the court.

Forensic analysis showed the malware remained active inside port systems for months, with repeated attempts to gain administrator privileges. In the intercepted chats, the defendant boasted that he had “total control,” including the ability to issue access passes and interfere with gate operations.

Authorities said the group also stole and circulated sensitive port information such as camera locations, staff photographs and terminal layouts. Judges concluded that the hack was explicitly designed to facilitate drug trafficking and posed a serious threat to the integrity and security of port operations.

The court also found the man guilty of helping organize the shipment of 210 kilograms of cocaine hidden in a container of wine bottles aboard the Callao Express, which Dutch authorities intercepted in Rotterdam in September 2020. He assisted in creating fake emails and transport orders and instructed accomplices on how to register the container in Portbase, the digital system used to manage container movements in Dutch ports.

In a separate charge, judges convicted the man of attempted extortion. He threatened relatives of a person involved in a dispute over missing cocaine, demanding €1.2 million and warning that violence would follow if the money was not paid.

The defendant was originally given a 10-year prison sentence by a lower court, but the appeals court cut it to seven years, pointing, among other things, to the unusually lengthy appeal process, which dragged on for more than 21 months.

The man, whose identity was not disclosed, is currently being held in a prison in western Netherlands and has appealed the latest ruling.

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Daryna Antoniuk

Daryna Antoniuk

is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.

 

Total
0
Shares
Previous Post

⚡ Weekly Recap: AI Automation Exploits, Telecom Espionage, Prompt Poaching & More

Next Post

n8n Supply Chain Attack Abuses Community Nodes to Steal OAuth Tokens

Related Posts

EdgeStepper Implant Reroutes DNS Queries to Deploy Malware via Hijacked Software Updates

The threat actor known as PlushDaemon has been observed using a previously undocumented Go-based network backdoor codenamed EdgeStepper to facilitate adversary-in-the-middle (AitM) attacks. EdgeStepper "redirects all DNS queries to an external, malicious hijacking node, effectively rerouting the traffic from legitimate infrastructure used for software updates to attacker-controlled infrastructure
Read More

Malicious VSX Extension “SleepyDuck” Uses Ethereum to Keep Its Command Server Alive

Cybersecurity researchers have flagged a new malicious extension in the Open VSX registry that harbors a remote access trojan called SleepyDuck. According to Secure Annex's John Tuckner, the extension in question, juan-bianco.solidity-vlang (version 0.0.7), was first published on October 31, 2025, as a completely benign library that was subsequently updated to version 0.0.8 on November 1 to
Read More

Microsoft Flags Multi-Stage AitM Phishing and BEC Attacks Targeting Energy Firms

Microsoft has warned of a multi‑stage adversary‑in‑the‑middle (AitM) phishing and business email compromise (BEC) campaign targeting multiple organizations in the energy sector. "The campaign abused SharePoint file‑sharing services to deliver phishing payloads and relied on inbox rule creation to maintain persistence and evade user awareness," the Microsoft Defender Security Research Team said.
Read More