Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Airlines/Aviation

Breach intelligence, attack campaigns, and threat reports targeting the Airlines/Aviation sector.

61 threat reports
Page 1 of 6
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Airlines/Aviation Threat Reports

Showing 1–12 / 61 reports
DarkBlinders 2026: How an Iran-Nexus APT Compromised Israeli and Iraqi Kurdish Government Cloud Infrastructure
DarkBlinders 2026: How an Iran-Nexus APT Compromised Israeli and Iraqi Kurdish Government Cloud Infrastructure
Government Administration6 days ago

DarkBlinders 2026: How an Iran-Nexus APT Compromised Israeli and Iraqi Kurdish Government Cloud Infrastructure

Between August and October 2026, the Iran-nexus threat actor DarkBlinders conducted an active cyber espionage campaign targeting a high-profile individual in Israel and a government cloud environment in the Kurdistan Region of Iraq. The group combined spear-phishing, fake recruitment lures impersonating Dubai Airports, and trojanized Visual Studio coding challenges to deliver SHELBYLOADER V2 and SHELBYC2, a GitHub-based backdoor. Credential-harvesting lookalike domains, AppDomainManager injection, DLL sideloading, and a tunneling utility called Blackwood were used to establish persistent, covert access to sensitive government infrastructure. DarkBlinders is assessed with medium confidence to be a sub-cluster of APT34 (OilRig), Iran's most prolific state-sponsored group. Its expanding victimology, novel delivery chains, and growing overlap with clusters UNC5795 and UNC5187 signal a deliberate escalation in Iranian cyber operations against Middle Eastern government targets at a time of heightened geopolitical tensions.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
PHP2Shell Zero-Day Meets Agentic AI: How Lazarus-Linked Actors Breached a Government in Under Two Hours
PHP2Shell Zero-Day Meets Agentic AI: How Lazarus-Linked Actors Breached a Government in Under Two Hours
Government Administration2 weeks ago

PHP2Shell Zero-Day Meets Agentic AI: How Lazarus-Linked Actors Breached a Government in Under Two Hours

In October 2026, threat actors exploited critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 (collectively dubbed PHP2Shell) to compromise a European government entity. Within two hours of initial exploitation, attackers accessed password hashes, MFA secrets, and established an NTLM-relay tunnel into Active Directory, attempting Domain Admin privilege escalation. Behavioral markers—including structured shell output delimiters designed for machine parsing—strongly indicate the use of agentic AI tooling for post-exploitation automation. Concurrently, CYFIRMA attributed a parallel low-and-slow scanning campaign across 216 unpatched global hosts to a suspected Lazarus Group affiliate, coordinated via a covert I2P channel with Korean-language indicators consistent with North Korean operators. This incident represents a convergence of two accelerating threat trends: the mass exploitation of critical runtime vulnerabilities affecting tens of millions of internet-facing PHP systems, and the operational deployment of agentic AI by nation-state actors to accelerate post-breach reconnaissance and lateral movement. With nearly 37 million PHP-exposed systems globally and Cloudflare reporting millions of exploitation attempts post-disclosure, organizations across government, finance, and critical infrastructure face an elevated and time-sensitive attack surface.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
DOJ Disrupts Chinese APT Flax Typhoon's Critical Infrastructure Campaign
DOJ Disrupts Chinese APT Flax Typhoon's Critical Infrastructure Campaign
Utilities1 month ago

DOJ Disrupts Chinese APT Flax Typhoon's Critical Infrastructure Campaign

In December 2024, the Department of Justice and FBI seized two hacking tools linked to Chinese state-sponsored group Flax Typhoon and Integrity Technology Group, a sanctioned Chinese firm. The seizure targeted Microscan, a vulnerability scanning tool, and FishHub, a spearphishing platform that facilitated attacks on critical infrastructure including South Carolina power companies, airports in Japan and Poland, and Taiwanese universities. The operation disrupted a sophisticated campaign combining automated scanning, large-scale botnets, and targeted exploitation techniques to steal sensitive data from organizations worldwide, with particular focus on U.S. critical infrastructure sectors. This incident underscores the escalating threat from Chinese APT groups positioning themselves within critical infrastructure networks for potential future disruption. The coordinated law enforcement response reflects growing urgency around protecting operational technology systems and preventing pre-positioned access that could enable catastrophic attacks during geopolitical tensions.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
FBI Takes Down Chinese State-Sponsored Hacking Infrastructure Targeting Global Critical Infrastructure
FBI Takes Down Chinese State-Sponsored Hacking Infrastructure Targeting Global Critical Infrastructure
Utilities1 month ago

FBI Takes Down Chinese State-Sponsored Hacking Infrastructure Targeting Global Critical Infrastructure

In October 2026, the FBI seized seven domains used by Chinese state-sponsored hackers known as Flax Typhoon to operate MicroScan and FishHub hacking tools targeting critical infrastructure worldwide. The operation disrupted China-based Integrity Technology Group's vulnerability scanning platform and spear-phishing tool, which had successfully breached power companies, airports, universities, and energy providers across the United States, Taiwan, Japan, and Poland. Investigators discovered stolen data from over 20 organizations on servers linked to the operation, including six Taiwanese universities. This incident highlights the escalating sophistication of state-sponsored supply chain attacks targeting critical infrastructure, demonstrating how nation-state actors increasingly rely on third-party contractors to expand their cyber operations while maintaining plausible deniability.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
October 2026 Threat Landscape: When Cybercriminals Turn on Each Other
October 2026 Threat Landscape: When Cybercriminals Turn on Each Other
Computer Software/Engineering1 month ago

October 2026 Threat Landscape: When Cybercriminals Turn on Each Other

A comprehensive cybersecurity threat bulletin from October 2026 highlighted multiple significant incidents including ransomware affiliate betrayal, supply chain attacks, and advanced persistent threats. Key incidents included a Russian Gentlemen ransomware affiliate called Azazel who double-crossed his own gang by stealing ransom proceeds from two dozen victims across six countries, malicious VS Code extensions linked to GlassWorm activity targeting developers, and a sophisticated phishing campaign combining traditional social engineering with AI prompt injection. The bulletin also detailed extradition of a Qilin ransomware suspect, critical vulnerabilities in healthcare devices regarding post-quantum cryptography readiness, and multiple supply chain compromises affecting npm packages and RubyGems targeting cryptocurrency developers. These incidents demonstrate the evolving sophistication of modern cyber threats, particularly the convergence of AI-enabled attacks, insider threats within criminal organizations, and the increasing targeting of development environments and supply chains as critical attack vectors.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
ShinyHunters Targets Boeing Aviation Unit in High-Stakes Extortion Campaign
ShinyHunters Targets Boeing Aviation Unit in High-Stakes Extortion Campaign
Aviation/Aerospace1 month ago

ShinyHunters Targets Boeing Aviation Unit in High-Stakes Extortion Campaign

In October 2026, the ShinyHunters cybercriminal group targeted Jeppesen ForeFlight, a navigation and digital aviation unit recently divested by Boeing, in an extortion attempt that raised operational safety and security concerns. The attack was orchestrated by Rey (Saif Al-din Khader), an 18-year-old from Jordan who assumed control of the ShinyHunters brand after Dutch authorities arrested another key member. The group exploited CVE-2026-35273, a PeopleSoft vulnerability, to steal sensitive data from dozens of organizations including the FBI recruitment database. This incident demonstrates the evolving threat landscape where young cybercriminals are leveraging established criminal brands to target critical infrastructure sectors. The aviation industry faces increasing cyber risks as threat actors recognize the high-value nature of flight operations data and safety-critical systems.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
ClingSTUN Malware Transforms IoT Devices Into Stealth Proxy Networks
ClingSTUN Malware Transforms IoT Devices Into Stealth Proxy Networks
Utilities1 month ago

ClingSTUN Malware Transforms IoT Devices Into Stealth Proxy Networks

In October 2026, FortiGuard Labs discovered ClingSTUN, a sophisticated Linux malware strain targeting Internet of Things (IoT) devices through 24 known vulnerabilities spanning from 2014 to 2026. The malware exploits devices from manufacturers including D-Link, Realtek, Ivanti, and TP-Link, transforming compromised systems into proxy nodes for malicious traffic routing. What distinguishes ClingSTUN is its innovative use of legitimate public STUN servers to obscure command-and-control communications, making malicious activity appear as normal VoIP and WebRTC traffic while establishing persistent access to enterprise networks. This incident highlights the growing weaponization of IoT infrastructure as threat actors increasingly leverage unpatched devices for proxy operations and network persistence. The malware's multi-architecture exploit chain and living-off-the-land techniques represent an evolution in IoT-targeted campaigns, emphasizing the urgent need for comprehensive IoT security frameworks as organizations face mounting pressure to secure their expanding attack surfaces.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Ryuk Ransomware Initial Access Specialist Sentenced: Key Lessons for Enterprise Security
Ryuk Ransomware Initial Access Specialist Sentenced: Key Lessons for Enterprise Security
Financial Services1 month ago

Ryuk Ransomware Initial Access Specialist Sentenced: Key Lessons for Enterprise Security

Karen Serobovich Vardanyan, an Armenian citizen operating under aliases 'Maneeken' and 'Karl Lagerfeld', was sentenced to two years in federal prison for his role as an initial access specialist in the Ryuk ransomware operation. Between March 2019 and June 2020, Vardanyan and co-conspirators systematically targeted American organizations including healthcare facilities, schools, and businesses, deploying ransomware across hundreds of compromised servers. The operation extorted approximately 1,610 Bitcoins valued at over $15 million, with Vardanyan ordered to pay $1.2 million in victim restitution. This case represents a significant law enforcement victory against ransomware operations that exploited vulnerable infrastructure during the COVID-19 pandemic, particularly targeting critical healthcare systems when they were most vulnerable.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical Infrastructure Under Siege: ATNS Ransomware Attack Exposes Aviation OT Vulnerabilities
Critical Infrastructure Under Siege: ATNS Ransomware Attack Exposes Aviation OT Vulnerabilities
Airlines/Aviation1 month ago

Critical Infrastructure Under Siege: ATNS Ransomware Attack Exposes Aviation OT Vulnerabilities

In September 2026, South Africa's Air Traffic and Navigation Services (ATNS) discovered ransomware-linked malware in operational technology networks supporting weather services for air traffic control systems managing 10% of global airspace. The attack affected facilities at Port Elizabeth Airport and potentially East London Airport, with preliminary investigations revealing data exfiltration to external IP addresses located in China. While internal teams implemented containment measures and malware removal, ATNS issued a request for comprehensive cyber-forensic investigation services to determine the full extent of compromise and remaining risks. This incident highlights the accelerating threat landscape targeting critical aviation infrastructure, with ransomware attacks on the aviation sector surging sixfold in 2025. The targeting of air traffic control systems represents a concerning escalation in attacks against operational technology environments that directly impact public safety and global transportation networks.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Multi-Vector Campaign Targets AI Systems and Banking: RemControl Trojan and Search Poisoning Analysis
Multi-Vector Campaign Targets AI Systems and Banking: RemControl Trojan and Search Poisoning Analysis
Banking/Mortgage1 month ago

Multi-Vector Campaign Targets AI Systems and Banking: RemControl Trojan and Search Poisoning Analysis

In September 2026, cybersecurity researchers identified a coordinated multi-vector campaign targeting AI systems, banking applications, and enterprise development environments. The campaign featured the RemControl Android banking trojan targeting Western Europe and Canada through fake Google Play Store pages, a massive AI disinformation attack poisoning ChatGPT and Google AI Overviews with fraudulent information, and supply chain compromises affecting WordPress plugins and AI coding tools. Threat actors leveraged social engineering tactics, exploited trusted platforms, and manipulated AI training data to execute credential theft, financial fraud, and code repository exfiltration across multiple industries. This incident highlights the rapidly evolving threat landscape where attackers are increasingly targeting AI systems and trusted development tools, representing a fundamental shift toward exploiting automation and machine learning platforms that organizations rely on for daily operations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Autonomous AI Agents Execute Massive Credit Card Theft Campaign
Autonomous AI Agents Execute Massive Credit Card Theft Campaign
Retail Industry1 month ago

Autonomous AI Agents Execute Massive Credit Card Theft Campaign

A Chinese threat actor deployed autonomous AI agents to orchestrate a massive payment card theft operation, compromising over 119 websites and stealing more than 600,000 credit card records. The campaign, active since July 2026, utilized three AI frameworks - Strix for vulnerability scanning, Cairn for exploitation, and Hermes for orchestration - to systematically target online retailers. Major victims included Fortune 500 companies across hospitality, aviation, and retail sectors. The attackers deployed payment skimmers through various injection methods and implemented destructive cleanup procedures that wiped source data after exfiltration, causing operational disruptions. This incident represents a paradigm shift toward AI-powered cybercrime, demonstrating how autonomous systems can execute complex attack chains at unprecedented scale and speed. The low operational cost of $25 per target and minimal human oversight signal a new era where sophisticated attacks become accessible to less skilled threat actors, fundamentally changing the threat landscape.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Dark Sourcery Campaign Exposes Critical Vulnerabilities in Enterprise AI Security
Dark Sourcery Campaign Exposes Critical Vulnerabilities in Enterprise AI Security
Airlines/Aviation1 month ago

Dark Sourcery Campaign Exposes Critical Vulnerabilities in Enterprise AI Security

In September 2026, cybersecurity researchers from Vigilance Security uncovered a sophisticated social engineering campaign dubbed 'Dark Sourcery' targeting major AI chatbots including ChatGPT, Google Gemini, and Google AI Overview. Threat actors poisoned these AI systems by flooding the web with carefully crafted malicious content, fake support pages, and fraudulent contact information, tricking the AI into presenting this misinformation as factual responses to users. The campaign compromised at least 374 major companies including Fortune 100 organizations, airlines like Delta and Lufthansa, and financial institutions such as Chase and Bank of America, causing significant reputational damage and enabling widespread phishing attacks. This incident represents a critical evolution in AI-targeted attacks as organizations increasingly integrate AI chatbots and agents into their business operations. With 91% of users blindly trusting AI responses without verification, this attack vector poses an unprecedented threat to enterprise security and user trust in AI systems.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports