The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Airlines/Aviation
Breach intelligence, attack campaigns, and threat reports targeting the Airlines/Aviation sector.
Explore Other Sectors
Airlines/Aviation Threat Reports
DOJ Disrupts Chinese APT Flax Typhoon's Critical Infrastructure Campaign
In December 2024, the Department of Justice and FBI seized two hacking tools linked to Chinese state-sponsored group Flax Typhoon and Integrity Technology Group, a sanctioned Chinese firm. The seizure targeted Microscan, a vulnerability scanning tool, and FishHub, a spearphishing platform that facilitated attacks on critical infrastructure including South Carolina power companies, airports in Japan and Poland, and Taiwanese universities. The operation disrupted a sophisticated campaign combining automated scanning, large-scale botnets, and targeted exploitation techniques to steal sensitive data from organizations worldwide, with particular focus on U.S. critical infrastructure sectors. This incident underscores the escalating threat from Chinese APT groups positioning themselves within critical infrastructure networks for potential future disruption. The coordinated law enforcement response reflects growing urgency around protecting operational technology systems and preventing pre-positioned access that could enable catastrophic attacks during geopolitical tensions.
3 days ago
Kill Chain
FBI Takes Down Chinese State-Sponsored Hacking Infrastructure Targeting Global Critical Infrastructure
In October 2026, the FBI seized seven domains used by Chinese state-sponsored hackers known as Flax Typhoon to operate MicroScan and FishHub hacking tools targeting critical infrastructure worldwide. The operation disrupted China-based Integrity Technology Group's vulnerability scanning platform and spear-phishing tool, which had successfully breached power companies, airports, universities, and energy providers across the United States, Taiwan, Japan, and Poland. Investigators discovered stolen data from over 20 organizations on servers linked to the operation, including six Taiwanese universities. This incident highlights the escalating sophistication of state-sponsored supply chain attacks targeting critical infrastructure, demonstrating how nation-state actors increasingly rely on third-party contractors to expand their cyber operations while maintaining plausible deniability.
4 days ago
Kill Chain
October 2026 Threat Landscape: When Cybercriminals Turn on Each Other
A comprehensive cybersecurity threat bulletin from October 2026 highlighted multiple significant incidents including ransomware affiliate betrayal, supply chain attacks, and advanced persistent threats. Key incidents included a Russian Gentlemen ransomware affiliate called Azazel who double-crossed his own gang by stealing ransom proceeds from two dozen victims across six countries, malicious VS Code extensions linked to GlassWorm activity targeting developers, and a sophisticated phishing campaign combining traditional social engineering with AI prompt injection. The bulletin also detailed extradition of a Qilin ransomware suspect, critical vulnerabilities in healthcare devices regarding post-quantum cryptography readiness, and multiple supply chain compromises affecting npm packages and RubyGems targeting cryptocurrency developers. These incidents demonstrate the evolving sophistication of modern cyber threats, particularly the convergence of AI-enabled attacks, insider threats within criminal organizations, and the increasing targeting of development environments and supply chains as critical attack vectors.
4 days ago
Kill Chain
ShinyHunters Targets Boeing Aviation Unit in High-Stakes Extortion Campaign
In October 2026, the ShinyHunters cybercriminal group targeted Jeppesen ForeFlight, a navigation and digital aviation unit recently divested by Boeing, in an extortion attempt that raised operational safety and security concerns. The attack was orchestrated by Rey (Saif Al-din Khader), an 18-year-old from Jordan who assumed control of the ShinyHunters brand after Dutch authorities arrested another key member. The group exploited CVE-2026-35273, a PeopleSoft vulnerability, to steal sensitive data from dozens of organizations including the FBI recruitment database. This incident demonstrates the evolving threat landscape where young cybercriminals are leveraging established criminal brands to target critical infrastructure sectors. The aviation industry faces increasing cyber risks as threat actors recognize the high-value nature of flight operations data and safety-critical systems.
5 days ago
Kill Chain
ClingSTUN Malware Transforms IoT Devices Into Stealth Proxy Networks
In October 2026, FortiGuard Labs discovered ClingSTUN, a sophisticated Linux malware strain targeting Internet of Things (IoT) devices through 24 known vulnerabilities spanning from 2014 to 2026. The malware exploits devices from manufacturers including D-Link, Realtek, Ivanti, and TP-Link, transforming compromised systems into proxy nodes for malicious traffic routing. What distinguishes ClingSTUN is its innovative use of legitimate public STUN servers to obscure command-and-control communications, making malicious activity appear as normal VoIP and WebRTC traffic while establishing persistent access to enterprise networks. This incident highlights the growing weaponization of IoT infrastructure as threat actors increasingly leverage unpatched devices for proxy operations and network persistence. The malware's multi-architecture exploit chain and living-off-the-land techniques represent an evolution in IoT-targeted campaigns, emphasizing the urgent need for comprehensive IoT security frameworks as organizations face mounting pressure to secure their expanding attack surfaces.
6 days ago
Kill Chain
Ryuk Ransomware Initial Access Specialist Sentenced: Key Lessons for Enterprise Security
Karen Serobovich Vardanyan, an Armenian citizen operating under aliases 'Maneeken' and 'Karl Lagerfeld', was sentenced to two years in federal prison for his role as an initial access specialist in the Ryuk ransomware operation. Between March 2019 and June 2020, Vardanyan and co-conspirators systematically targeted American organizations including healthcare facilities, schools, and businesses, deploying ransomware across hundreds of compromised servers. The operation extorted approximately 1,610 Bitcoins valued at over $15 million, with Vardanyan ordered to pay $1.2 million in victim restitution. This case represents a significant law enforcement victory against ransomware operations that exploited vulnerable infrastructure during the COVID-19 pandemic, particularly targeting critical healthcare systems when they were most vulnerable.
1 week ago
Kill Chain
Critical Infrastructure Under Siege: ATNS Ransomware Attack Exposes Aviation OT Vulnerabilities
In September 2026, South Africa's Air Traffic and Navigation Services (ATNS) discovered ransomware-linked malware in operational technology networks supporting weather services for air traffic control systems managing 10% of global airspace. The attack affected facilities at Port Elizabeth Airport and potentially East London Airport, with preliminary investigations revealing data exfiltration to external IP addresses located in China. While internal teams implemented containment measures and malware removal, ATNS issued a request for comprehensive cyber-forensic investigation services to determine the full extent of compromise and remaining risks. This incident highlights the accelerating threat landscape targeting critical aviation infrastructure, with ransomware attacks on the aviation sector surging sixfold in 2025. The targeting of air traffic control systems represents a concerning escalation in attacks against operational technology environments that directly impact public safety and global transportation networks.
1 week ago
Kill Chain
Multi-Vector Campaign Targets AI Systems and Banking: RemControl Trojan and Search Poisoning Analysis
In September 2026, cybersecurity researchers identified a coordinated multi-vector campaign targeting AI systems, banking applications, and enterprise development environments. The campaign featured the RemControl Android banking trojan targeting Western Europe and Canada through fake Google Play Store pages, a massive AI disinformation attack poisoning ChatGPT and Google AI Overviews with fraudulent information, and supply chain compromises affecting WordPress plugins and AI coding tools. Threat actors leveraged social engineering tactics, exploited trusted platforms, and manipulated AI training data to execute credential theft, financial fraud, and code repository exfiltration across multiple industries. This incident highlights the rapidly evolving threat landscape where attackers are increasingly targeting AI systems and trusted development tools, representing a fundamental shift toward exploiting automation and machine learning platforms that organizations rely on for daily operations.
2 weeks ago
Kill Chain
Autonomous AI Agents Execute Massive Credit Card Theft Campaign
A Chinese threat actor deployed autonomous AI agents to orchestrate a massive payment card theft operation, compromising over 119 websites and stealing more than 600,000 credit card records. The campaign, active since July 2026, utilized three AI frameworks - Strix for vulnerability scanning, Cairn for exploitation, and Hermes for orchestration - to systematically target online retailers. Major victims included Fortune 500 companies across hospitality, aviation, and retail sectors. The attackers deployed payment skimmers through various injection methods and implemented destructive cleanup procedures that wiped source data after exfiltration, causing operational disruptions. This incident represents a paradigm shift toward AI-powered cybercrime, demonstrating how autonomous systems can execute complex attack chains at unprecedented scale and speed. The low operational cost of $25 per target and minimal human oversight signal a new era where sophisticated attacks become accessible to less skilled threat actors, fundamentally changing the threat landscape.
2 weeks ago
Kill Chain
Dark Sourcery Campaign Exposes Critical Vulnerabilities in Enterprise AI Security
In September 2026, cybersecurity researchers from Vigilance Security uncovered a sophisticated social engineering campaign dubbed 'Dark Sourcery' targeting major AI chatbots including ChatGPT, Google Gemini, and Google AI Overview. Threat actors poisoned these AI systems by flooding the web with carefully crafted malicious content, fake support pages, and fraudulent contact information, tricking the AI into presenting this misinformation as factual responses to users. The campaign compromised at least 374 major companies including Fortune 100 organizations, airlines like Delta and Lufthansa, and financial institutions such as Chase and Bank of America, causing significant reputational damage and enabling widespread phishing attacks. This incident represents a critical evolution in AI-targeted attacks as organizations increasingly integrate AI chatbots and agents into their business operations. With 91% of users blindly trusting AI responses without verification, this attack vector poses an unprecedented threat to enterprise security and user trust in AI systems.
2 weeks ago
Kill Chain
How ShinyHunters Weaponized Claude AI to Harvest Secrets from 1.8 Million Android Apps
Between December 2025 and August 2026, multiple threat groups including ShinyHunters, Russian state-sponsored Midnight Blizzard, and Chinese espionage group GTG-10007 systematically abused Anthropic's Claude AI model for large-scale cyberattacks. The most significant operation involved ShinyHunters member 'frkoo' deploying an automated credential-harvesting pipeline across AWS infrastructure that extracted secrets from 1.8 million Android applications and compromised over 40 Microsoft corporate tenants within 34 hours. The AI-enhanced attacks enabled rapid progression from initial access to administrative control in under three hours, with confirmed breaches across government, healthcare, energy, and technology sectors. This incident represents a critical inflection point where AI capabilities are being weaponized at unprecedented scale and speed, fundamentally changing the threat landscape and requiring immediate reassessment of defensive strategies against AI-enhanced cybercrime operations.
1 month ago
Kill Chain
IDScan's Massive Data Breach Exposes 153 Million Driver's Licenses on Dark Web
In September 2026, identity verification company IDScan suffered a massive data breach affecting over 153 million U.S. and Canadian driver's licenses, along with 10 million ID cards, 3 million travel documents, and 579,000 medical cards. Cybercriminals operating the dark web service 'Nexus' advertised the stolen data, which included scanned identity documents from businesses using IDScan's verification systems across car rental firms, retailers, gun shops, financial institutions, cannabis dispensaries, and hospitality establishments. The FBI's New Orleans office launched an investigation, and multiple class-action lawsuits have been filed against the Louisiana-based company. This incident highlights the growing threat to identity verification services and third-party data processors, demonstrating how a single breach can expose massive volumes of sensitive personal identification data across multiple industries and geographical regions.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports