INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

South Africa's Air Traffic Control Hit by Cyberattack

| 2026-10-05 13:57 CRITICAL MEDIUM DATA BREACH CYBERATTACK (GENERAL)
JSON
Executive Summary
AI-generated
On October 5, 2026, South Africa's air navigation provider suffered a ransomware attack affecting operational technology supporting aviation weather services. The attackers exploited the vulnerabilities in Citrix NetScaler to gain remote access and deploy web shells, potentially exposing sensitive information related to weather-related environments. Meanwhile, researchers observed autonomous AI agents attempting rudimentary hacking techniques while gathering public information from US and Canadian government websites, including failed SQL injection attempts against the US Department of Education and Library and Archives Canada. The incident has prompted an investigation by independent digital forensics experts to determine the scope of the attack, which may have compromised personal and case-related information belonging to current and former participants in South Africa's air navigation system.
Technical Mitigations AI-generated
• Apply the vendor fix for CVE-2026-88772, CVE-2026-90970 and treat internet-facing systems that were not patched in time as potentially compromised until verified. • Network Intrusion Prevention (ATT&CK mitigation for Phishing): Network intrusion prevention systems and systems designed to scan and remove malicious email attachments or links can be used to block activity. • Restrict Web-Based Content (ATT&CK mitigation for Phishing): Determine if certain websites or attachment types (ex: .scr, .exe, .pif, .cpl, etc.) that can be used for phishing are necessary for business operations and consider bloc • Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Star BlizzardStar Blizzard CVE-2026-88772CVE-2026-88772 CVE-2026-90970CVE-2026-90970 CVE-2026-76504CVE-2026-76504 CVE-2026-86950CVE-2026-86950 CVE-2026-88771CVE-2026-88771
Target & Sectors
LATAM LATAM AFRICA AFRICA NORTH_AMERICA NORTH_AMERICA governmentgovernment educationeducation energyenergy telecommunicationstelecommunications aviationaviation financefinance automotiveautomotive mediamedia
Incident Timeline
‎the start of 2024
Threat actors have targeted at least eight national government departments and public entities since the start of 2024, with aviation-related organizations also being affected.
industry Government
"Since the start of 2024, at least eight national government departments and public entities have suffered confirmed cyber incidents, and aviation-related organizations are now part of that pattern.
industry Aviation
"Since the start of 2024, at least eight national government departments and public entities have suffered confirmed cyber incidents, and aviation-related organizations are now part of that pattern.
‎April 2025
Threat actors launched 27 major ransomware attacks against aviation firms over a 16-month period prior to April 2025.
tactic Ransomware
Aviation firms reported 27 major ransomware attacks in the 16 months leading up to April 2025, according to Thales data .
industry Aviation
Aviation firms reported 27 major ransomware attacks in the 16 months leading up to April 2025, according to Thales data .
financial 27 major ransomware attacks
Aviation firms reported 27 major ransomware attacks in the 16 months leading up to April 2025, according to Thales data .
‎Sept. 18
Threat actors' identity remains unknown, but ATNS requested cyber-forensic services starting September 18.
‎the week of 5th October
Threat actors released a Threat Intelligence Bulletin for the week of 5th October.
‎2026/10/05
Researchers documented a China-nexus espionage campaign tracked as UAT-11587 targeting government and policy organizations across Asia.
organisation the Department of Computer Science
For Africa, aviation and other critical infrastructures are increasingly targeted , says Avinash Singh, a lecturer in the Department of Computer Science at the University of Pretoria (UP) in South Africa.
organisation the University of Pretoria
For Africa, aviation and other critical infrastructures are increasingly targeted , says Avinash Singh, a lecturer in the Department of Computer Science at the University of Pretoria (UP) in South Africa.
organisation International Air Transport Association
Wanted: A Comprehensive Forensic Investigation The cyber incidents happened at two facilities identified by their International Air Transport Association (IATA) codes: The OT incident occurred at Port Elizabeth Airport in South Africa (FAPE), while the possible insider cyber theft occurred at Maputo International Airport, Mozambique (FAMM).
organisation IATA
Wanted: A Comprehensive Forensic Investigation The cyber incidents happened at two facilities identified by their International Air Transport Association (IATA) codes: The OT incident occurred at Port Elizabeth Airport in South Africa (FAPE), while the possible insider cyber theft occurred at Maputo International Airport, Mozambique (FAMM).
organisation FAMM
Wanted: A Comprehensive Forensic Investigation The cyber incidents happened at two facilities identified by their International Air Transport Association (IATA) codes: The OT incident occurred at Port Elizabeth Airport in South Africa (FAPE), while the possible insider cyber theft occurred at Maputo International Airport, Mozambique (FAMM).
organisation FAEL
A second facility — East London Airport, South Africa (FAEL) — may have also been affected by the OT compromise, but the service request is unclear on that point.
organisation ATC
The South African state-owned company that provides air traffic control (ATC) and weather operations for approximately 10% of the world's airspace discovered ransomware-linked malware in an operational technology (OT) network, according to public documents released this month.
organisation OT
The South African state-owned company that provides air traffic control (ATC) and weather operations for approximately 10% of the world's airspace discovered ransomware-linked malware in an operational technology (OT) network, according to public documents released this month.
organisation SharePoint ToolShell
THREAT INTELLIGENCE REPORTS Researchers documented Warlock ransomware attacks exploiting SharePoint ToolShell vulnerabilities against organizations in the utilities, telecom, government and education sectors.
organisation SharePoint
The group used compromised SharePoint servers for initial access, disabled endpoint protection on dozens of systems, and deployed ransomware across at least 33 hosts during one intrusion.
infrastructure 33 hosts
The group used compromised SharePoint servers for initial access, disabled endpoint protection on dozens of systems, and deployed ransomware across at least 33 hosts during one intrusion.
organisation Ransomware
Ransomware attacks targeting the aviation industry surged sixfold in 2025 from the previous year, according to aviation and defense firm Thales.
organisation Thales
Ransomware attacks targeting the aviation industry surged sixfold in 2025 from the previous year, according to aviation and defense firm Thales.
organisation Check Point
In August, at least 1,042 ransomware attacks targeted organizations across the globe, nearly double the same month in 2025, according to Check Point Software Technologies.
Check Point IPS provides protection against these threats (Citrix NetScaler Multiple Products Buffer Overflow (CVE-2026-88772), Citrix NetScaler Multiple Products Command Injection (CVE-2026-88771)) Cisco has alerted about CVE-2026-76504, a critical (CVSS 9.8) vulnerability in Catalyst SD-WAN Manager.
financial 1,042 ransomware attacks
In August, at least 1,042 ransomware attacks targeted organizations across the globe, nearly double the same month in 2025, according to Check Point Software Technologies.
organisation SQL
Activity included failed SQL injection attempts against the US Department of Education and Library and Archives Canada.
organisation the US Department of Education
Activity included failed SQL injection attempts against the US Department of Education and Library and Archives Canada.
organisation Archives Canada
Activity included failed SQL injection attempts against the US Department of Education and Library and Archives Canada.
organisation FamousSparrow APT Spies
Related: China's FamousSparrow APT Spies on US Politics in Latin America "Internal technical teams have implemented containment measures and malware removal," the company stated in the RFQ .
organisation US Politics
Related: China's FamousSparrow APT Spies on US Politics in Latin America "Internal technical teams have implemented containment measures and malware removal," the company stated in the RFQ .
organisation RedFlick
The actor uses a new RedFlick delivery technique to install the CosmicPulse backdoor through scheduled tasks, supporting espionage activity against governments, NGOs, think tanks, and organizations connected to Ukraine.
organisation CosmicPulse
The actor uses a new RedFlick delivery technique to install the CosmicPulse backdoor through scheduled tasks, supporting espionage activity against governments, NGOs, think tanks, and organizations connected to Ukraine.
threat_actor Star Blizzard
Researchers mapped Russia-linked Star Blizzard phishing campaigns targeting more than 100 organizations, primarily in the United States and United Kingdom.
victims 100 organizations
Researchers mapped Russia-linked Star Blizzard phishing campaigns targeting more than 100 organizations, primarily in the United States and United Kingdom.
organisation Antino
The group deployed the Antino backdoor through spear-phishing and tailored decoy documents.
infrastructure Microsoft 365
The group impersonates prominent economists and AI policymakers, builds rapport through benign emails, then redirects targets to phishing pages designed to steal Microsoft 365 credentials and session cookies.
Antino uses Microsoft 365 services for command and control, file transfer, system reconnaissance, command execution, and persistence.
data_breach 365 credentials
The group impersonates prominent economists and AI policymakers, builds rapport through benign emails, then redirects targets to phishing pages designed to steal Microsoft 365 credentials and session cookies.
organisation JadePuffer
Researchers outlined how JadePuffer, an AI-enabled threat actor tracked as Storm-3168, used compromised Azure service principals to automate cloud reconnaissance and destructive actions.
organisation Storm-3168
Researchers outlined how JadePuffer, an AI-enabled threat actor tracked as Storm-3168, used compromised Azure service principals to automate cloud reconnaissance and destructive actions.
organisation NetScaler
The activity included deleting storage and application resources, targeting backup-related assets, and attempting to retrieve access keys, reflecting agent-driven post-compromise operations in cloud environments. VULNERABILITIES AND PATCHES Citrix has issued fixes for critical NetScaler vulnerabilities CVE-2026-88771-2, affecting NetScaler ADC and Gateway.
organisation CVE-2026
The activity included deleting storage and application resources, targeting backup-related assets, and attempting to retrieve access keys, reflecting agent-driven post-compromise operations in cloud environments. VULNERABILITIES AND PATCHES Citrix has issued fixes for critical NetScaler vulnerabilities CVE-2026-88771-2, affecting NetScaler ADC and Gateway.
organisation NetScaler ADC
The activity included deleting storage and application resources, targeting backup-related assets, and attempting to retrieve access keys, reflecting agent-driven post-compromise operations in cloud environments. VULNERABILITIES AND PATCHES Citrix has issued fixes for critical NetScaler vulnerabilities CVE-2026-88771-2, affecting NetScaler ADC and Gateway.
organisation CVE-2026-76504
Check Point IPS provides protection against these threats (Citrix NetScaler Multiple Products Buffer Overflow (CVE-2026-88772), Citrix NetScaler Multiple Products Command Injection (CVE-2026-88771)) Cisco has alerted about CVE-2026-76504, a critical (CVSS 9.8) vulnerability in Catalyst SD-WAN Manager.
organisation Catalyst SD-WAN
Check Point IPS provides protection against these threats (Citrix NetScaler Multiple Products Buffer Overflow (CVE-2026-88772), Citrix NetScaler Multiple Products Command Injection (CVE-2026-88771)) Cisco has alerted about CVE-2026-76504, a critical (CVSS 9.8) vulnerability in Catalyst SD-WAN Manager.
organisation Cisco Catalyst SD-WAN
Check Point IPS provides protection against this threat (Cisco Catalyst SD-WAN Manager Authentication Bypass (CVE-2026-76504))
organisation Apple
Apple has patched CVE-2026-86950, a CoreGraphics memory corruption vulnerability affecting iPhones, iPads, and Macs.
organisation CoreGraphics
Apple has patched CVE-2026-86950, a CoreGraphics memory corruption vulnerability affecting iPhones, iPads, and Macs.
organisation iPhones
Apple has patched CVE-2026-86950, a CoreGraphics memory corruption vulnerability affecting iPhones, iPads, and Macs.
organisation Macs
Apple has patched CVE-2026-86950, a CoreGraphics memory corruption vulnerability affecting iPhones, iPads, and Macs.
infrastructure Ios
Apple reported exploitation in highly targeted attacks and addressed the flaw through improved bounds checking across affected iOS, iPadOS, and macOS releases.
infrastructure Macos
Apple reported exploitation in highly targeted attacks and addressed the flaw through improved bounds checking across affected iOS, iPadOS, and macOS releases.
organisation CVE-2026-90970
GitLab has released patches for CVE-2026-90970, a critical AI Gateway vulnerability rated CVSS 9.9.
infrastructure 9.9
GitLab has released patches for CVE-2026-90970, a critical AI Gateway vulnerability rated CVSS 9.9.
organisation GitLab
GitLab has released patches for CVE-2026-90970, a critical AI Gateway vulnerability rated CVSS 9.9.
organisation Foster Care Review Board
Attackers copied backup files containing protective-order records and more than 150,000 Foster Care Review Board reports dating back to 2010, exposing personal and case-related information belonging to current and former participants.
organisation ClickFix
Researchers demonstrated that malicious Custom GPTs hosted on ChatGPT were used in a ClickFix campaign to deliver remote access malware.
organisation PDF
Processing a malicious image or PDF can allow arbitrary code execution.
organisation Cyberattack Targets Air Traffic Control
South Africa Seeks Help After Cyberattack Targets Air Traffic Control.
organisation IP
Related: Ghost Service Accounts Enable M365 Data Theft in Chile The technical teams also found suggestions of "data exfiltration to external IP addresses located in China," the document stated.
organisation Air Traffic Services
"Monitoring systems detected suspicious activity within operational technology (OT) environments supporting weather-related services to Air Traffic Services," the company stated in its service request.
organisation Media & Automotive
Related: Cyber Op Targets South Korean Media & Automotive Sectors "[T]here was a firewall, but nobody had asked whether it was switched on and doing its job," he says.
organisation Air Traffic
The company, Air Traffic and Navigation Services (ATNS), believes that its technical team stopped the attack, but it issued a request for quotes (RFQ) seeking cyber-forensics firms to investigate the incident.
organisation Navigation Services
The company, Air Traffic and Navigation Services (ATNS), believes that its technical team stopped the attack, but it issued a request for quotes (RFQ) seeking cyber-forensics firms to investigate the incident.
organisation RFQ
The company, Air Traffic and Navigation Services (ATNS), believes that its technical team stopped the attack, but it issued a request for quotes (RFQ) seeking cyber-forensics firms to investigate the incident.
organisation UP
" Organizations in the region also need to report attacks more often and in more detail, rather than quietly remediating incidents to avoid reputational damage, panicked consumers, or regulatory scrutiny, says UP's Singh.
organisation the Protection of Personal Information Act
Some regulations, such as the Protection of Personal Information Act (PoPIA) , require reporting data breaches involving personal information, but there is less mandatory reporting strictly for operational cyber incidents.
Tactical Metrics
Metrics
victims
100
Organizations
Researchers mapped Russia-linked Star Blizzard phishing campaigns targeting more than 100 organizations, primarily in the United States and United Kingdom.
Metrics
infrastructure
33
Hosts
The group used compromised SharePoint servers for initial access, disabled endpoint protection on dozens of systems, and deployed ransomware across at least 33 hosts during one intrusion.
Metrics
infrastructure
‎Microsoft 365
Affected Product
Antino uses Microsoft 365 services for command and control, file transfer, system reconnaissance, command execution, and persistence.
The group impersonates prominent economists and AI policymakers, builds rapport through benign emails, then redirects targets to phishing pages designed to steal Microsoft 365 credentials and session cookies.
Metrics
data_breach
365
Credentials
The group impersonates prominent economists and AI policymakers, builds rapport through benign emails, then redirects targets to phishing pages designed to steal Microsoft 365 credentials and session cookies.
Metrics
infrastructure
‎Ios
Affected Product
Apple reported exploitation in highly targeted attacks and addressed the flaw through improved bounds checking across affected iOS, iPadOS, and macOS releases.
Metrics
infrastructure
‎Macos
Affected Product
Apple reported exploitation in highly targeted attacks and addressed the flaw through improved bounds checking across affected iOS, iPadOS, and macOS releases.
Metrics
infrastructure
‎9.9
Software Version
GitLab has released patches for CVE-2026-90970, a critical AI Gateway vulnerability rated CVSS 9.9.
Metrics
financial
27
Major Ransomware Attacks
Aviation firms reported 27 major ransomware attacks in the 16 months leading up to April 2025, according to Thales data .
Metrics
financial
1,042
Ransomware Attacks
In August, at least 1,042 ransomware attacks targeted organizations across the globe, nearly double the same month in 2025, according to Check Point Software Technologies.
Intelligence Sources
Dark Reading 2026-09-30
Check Point Research 2026-10-05