South Africa Requests Cyber Forensics After Ransomware Attack on Air Traffic Systems
Air Traffic and Navigation Services (ATNS), the South African state-owned company providing air traffic control and weather operations for roughly ten percent of the world’s airspace, disclosed that its technical team successfully halted a ransomware-linked intrusion on an operational technology network.
The company issued a request for quotes beginning September 18 to engage specialized cyber‑forensics firms for a thorough investigation, noting that a second incident—possibly an insider theft of data—is also being examined.
Security analysts observed suspicious activity within operational technology environments that support weather‑related services to Air Traffic Services, with preliminary findings indicating malware typically seen in the early phases of ransomware campaigns.
Technical teams uncovered evidence suggesting data exfiltration to external IP addresses located in China, raising concerns about cross‑border threat vectors targeting critical infrastructure.
The breach involved two primary facilities identified by IATA codes: Port Elizabeth Airport (FAPE) experienced the operational technology compromise, while Maputo International Airport (FAMM) may have been impacted by an internal cyber‑theft scenario. A third location, East London Airport (FAEL), could also have been affected, though confirmation remains pending.
On a broader scale, ransomware attacks against the aviation sector surged sixfold in 2025 compared to the previous year, according to Thales. In the twelve months leading up to April 2025, aviation firms reported twenty‑seven major ransomware incidents, highlighting the growing vulnerability of this sector.
Regional experts warn that aviation and other critical infrastructures are increasingly targeted due to their strategic importance. Avinash Singh, a lecturer at the University of Pretoria, noted that the threat landscape in Africa is shifting aggressively toward critical infrastructure, making grounded flights and stranded passengers difficult to conceal.
Global statistics from Check Point Software Technologies show that South African organizations average 2,086 cyberattacks per week, slightly below the worldwide average of 2,422, underscoring the persistent pressure faced by local enterprises.
“Internal technical teams have implemented containment measures and removed malware,” ATNS stated in its request for assistance. “However, a comprehensive forensic investigation is essential to determine the root cause, the extent of compromise, and any residual risks.”
“Ransomware gangs are exploiting weaknesses in aviation infrastructure, and the surge in attacks reflects both technological advances by adversaries and the increasing value placed on critical systems.”
With regional governments already experiencing multiple confirmed cyber incidents since the start of 2024, the case underscores the urgent need for enhanced cybersecurity frameworks across South Africa’s aviation sector.
Com informações de: Dark Reading