Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Aviation/Aerospace

Breach intelligence, attack campaigns, and threat reports targeting the Aviation/Aerospace sector.

74 threat reports
Page 6 of 7
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Aviation/Aerospace Threat Reports

Showing 61–72 / 74 reports
Siemens 2025: Type Confusion RCE Threatens HyperLynx & Industrial Edge Security
Critical Manufacturing10 months ago

Siemens 2025: Type Confusion RCE Threatens HyperLynx & Industrial Edge Security

In October 2025, Siemens disclosed a critical vulnerability (CVE-2025-6554) affecting HyperLynx and Industrial Edge App Publisher products. The flaw, rooted in type confusion within the V8 JavaScript engine (Google Chrome), enables remote attackers to execute arbitrary code via malicious HTML, particularly impacting vulnerable product versions used in worldwide critical manufacturing environments. For HyperLynx, exploitation requires local access, while Industrial Edge App Publisher is exploitable remotely with low complexity, posing a substantial risk to integrity and confidentiality. Siemens and CISA jointly advised immediate updates and best-practice mitigations. This incident highlights a growing trend of supply chain and third-party component vulnerabilities impacting industrial control systems, particularly as attackers increasingly target embedded web technologies. The Siemens disclosure underlines ongoing regulatory and operational pressure to address software dependencies and enforce proactive patch management in critical infrastructure.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CISA Flags DELMIA Apriso Vulnerabilities: Urgent Action for Manufacturers
Automotive10 months ago

CISA Flags DELMIA Apriso Vulnerabilities: Urgent Action for Manufacturers

In October 2025, the Cybersecurity and Infrastructure Security Agency (CISA) added two critical vulnerabilities affecting Dassault Systèmes DELMIA Apriso (CVE-2025-6204 and CVE-2025-6205) to its Known Exploited Vulnerabilities (KEV) Catalog following confirmed evidence of active exploitation in the wild. The code injection and missing authorization flaws present serious security bypass opportunities, allowing malicious actors to achieve unauthorized access and potentially execute arbitrary code. These weaknesses have become high-value targets for cyber attackers, potentially threatening sensitive enterprise manufacturing and operational data integrity across organizations that have yet to apply available patches. This incident underscores the growing trend of rapid exploitation of industrial software vulnerabilities by sophisticated threat actors. With regulatory frameworks such as BOD 22-01 placing increasing responsibility on federal agencies to remediate such vulnerabilities quickly, all organizations must adapt their patch management and risk processes to respond to elevated attacker velocity.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
CISA Alert: Active Exploits Target Dassault DELMIA Apriso and XWiki in 2025
Automotive10 months ago

CISA Alert: Active Exploits Target Dassault DELMIA Apriso and XWiki in 2025

In October 2025, cybersecurity authorities including CISA confirmed active exploitation of critical vulnerabilities in Dassault Systèmes DELMIA Apriso and XWiki platforms. Threat actors leveraged flaws such as CVE-2025-6204—an 8.0 CVSS code injection bug—to gain unauthorized access and potential code execution on affected systems. The attackers exploited unpatched systems to facilitate lateral movement, data exfiltration, and possible disruption of manufacturing and enterprise workflows. Affected organizations faced immediate operational risk and the prospect of sensitive information compromise. This incident highlights a growing trend in rapid exploitation of recently disclosed enterprise software vulnerabilities. With increased attacker focus on supply chain and collaborative platforms, organizations must respond swiftly to new advisories and prioritize vulnerability management programs to reduce exposure to high-severity threats.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Active Exploitation of Dassault DELMIA Apriso Vulnerabilities Impacts Manufacturing Sector
Automotive10 months ago

Active Exploitation of Dassault DELMIA Apriso Vulnerabilities Impacts Manufacturing Sector

In June 2024, CISA issued an alert highlighting active exploitation of two vulnerabilities (CVE-2024-22120 and CVE-2024-22121) within Dassault Systèmes’ DELMIA Apriso platform, a widely used manufacturing operations management solution. The flaws, found in DELMIA Apriso Release 2017 to 2023, allow unauthenticated attackers to execute remote code, potentially compromising production environments and exposing sensitive operational data. Attackers are leveraging these vulnerabilities to target the manufacturing sector for automated ransomware deployment and data exfiltration, resulting in operational disruption and risk to production integrity. This incident underscores the trend of threat actors focusing on supply chain and OT/IT hybrid platforms, exploiting unpatched flaws for initial access. The urgent CISA advisory signals accelerating regulatory scrutiny and highlights the increased risks posed by software supply chain weaknesses in critical infrastructure sectors.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
North Korea’s Lazarus Group Breaches Drone Developers in 2023 Cyber-Espionage Campaign
Defense/Space10 months ago

North Korea’s Lazarus Group Breaches Drone Developers in 2023 Cyber-Espionage Campaign

In March 2023, the Lazarus Group—an advanced persistent threat attributed to North Korea—successfully targeted three European companies in the defense sector involved in drone development. Leveraging Operation DreamJob, the attackers used social engineering tactics, including fraudulent job offers and a trojanized PDF reader, to gain initial access via phishing emails. The deployment of the ScoringMathTea remote access trojan enabled complete control over compromised systems, potentially allowing sensitive data exfiltration related to unmanned aerial vehicle (UAV) technology and manufacturing know-how. ESET researchers linked the attack to ongoing North Korean efforts to bolster domestic drone capabilities and noted the victims' support of military deployments in Ukraine. The incident exemplifies the persistent and adaptive nature of sophisticated state-linked cyber-espionage campaigns targeting high-value defense technologies. As strategic competition and armed conflicts persist, such tactics have become more prevalent against organizations with intellectual property critical to national security.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Lazarus APT Penetrates European Defense Firms with Fake Job Lures in 2024
Defense/Space10 months ago

Lazarus APT Penetrates European Defense Firms with Fake Job Lures in 2024

In early 2024, the North Korean state-sponsored Lazarus Group orchestrated a targeted cyberattack against at least three European defense sector companies. Using a spear-phishing strategy known as 'Operation DreamJob,' attackers impersonated defense recruiters, luring employees with fake job offers and malicious documents. Once compromised, the attackers gained unauthorized access, moved laterally within victims' networks, and exfiltrated sensitive corporate and government data with minimal detection. The sophistication and persistence demonstrated in this operation highlight the evolving threat landscape posed by well-resourced APT actors. This campaign underscores the escalating risks facing critical industries from nation-state cyber espionage. As advanced phishing and lateral movement techniques proliferate, even mature security programs remain vulnerable to targeted, multi-stage attacks from groups like Lazarus.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
North Korean APTs Breach UAV Defense Firms Using Fake Job Offers (2025)
Defense/Space10 months ago

North Korean APTs Breach UAV Defense Firms Using Fake Job Offers (2025)

In October 2025, multiple European defense contractors specializing in unmanned aerial vehicles (UAVs) were targeted by a sophisticated cyber-espionage campaign attributed to North Korean threat actors, commonly known as Lazarus Group. The attackers masqueraded as recruiters and leveraged convincing fake job offers to defense engineers using social networks and spear-phishing emails, ultimately delivering malicious payloads that provided remote access to corporate networks. The primary objective was to exfiltrate proprietary drone technology and sensitive internal communications, resulting in significant intellectual property theft and exposure of confidential project details. This incident illustrates a persistent trend where state-sponsored actors target the defense sector’s engineers with social engineering tactics, reflecting a broader escalation in advanced persistent threat (APT) campaigns leveraging human-centric attack vectors. Organizations face mounting regulatory scrutiny and must enhance security controls to combat these evolving social-engineering-enabled threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Inside the 2024 Lazarus Group Attack on European Drone Manufacturers
Aviation/Aerospace10 months ago

Inside the 2024 Lazarus Group Attack on European Drone Manufacturers

In early 2024, the North Korean-backed Lazarus Group launched a sophisticated cyber-espionage campaign targeting multiple European drone manufacturers. The operation leveraged spear-phishing emails and custom malware to gain unauthorized access to sensitive research, development, and operational data. After establishing persistence, attackers conducted lateral movement across corporate networks and exfiltrated significant volumes of intellectual property and proprietary technology aligning with North Korea's strategic interests. The breach undermined victims’ competitive advantage, presented potential national security risks, and exposed critical supply chain vulnerabilities. The incident underscores the escalation of state-sponsored attacks against the European defense and aerospace sector. As APT groups like Lazarus intensify targeting of high-innovation industries using stealthy techniques, organizations face mounting pressure to strengthen east-west traffic monitoring, encryption practices, and zero trust segmentation.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Laser Attacks on Vehicle Microchips: New Frontiers in Auto Cybersecurity
Automotive10 months ago

Laser Attacks on Vehicle Microchips: New Frontiers in Auto Cybersecurity

In 2024, security researchers demonstrated a novel cyberattack targeting automotive microchips using precisely aligned laser beams. The attack exploited fundamental hardware vulnerabilities, allowing adversaries to manipulate or extract data from silicon chips embedded in modern vehicles. By directing lasers at sensitive circuits, attackers could trigger faults, bypass certain security controls, and potentially gain access to encrypted data streams or control automotive systems. The proof-of-concept underscores critical exposure across connected and autonomous vehicles, as physical access to components can enable advanced attacks beyond the reach of traditional software-based defenses. This incident is particularly relevant as vehicles and other IoT systems grow increasingly reliant on sophisticated microelectronics. The emergence of physical-layer hardware attacks highlights the urgent need for new security architectures, including microchip hardening and multi-layered threat detection, to counter evolving risks in transportation and critical infrastructure.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
CISA Confirms Active Exploitation of Meteobridge CVE-2025-4008 Command Injection Flaw
Utilities10 months ago

CISA Confirms Active Exploitation of Meteobridge CVE-2025-4008 Command Injection Flaw

On October 24, 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) flagged an actively exploited command injection vulnerability (CVE-2025-4008) within Smartbedded Meteobridge's web interface. This critical flaw, assigned a CVSS score of 8.7, permits remote attackers to execute arbitrary code by exploiting improper input handling. Threat actors are leveraging this vulnerability in the wild, potentially compromising sensitive data and gaining unauthorized access to affected networks. The exposure primarily impacts organizations deploying Meteobridge for environmental monitoring or network-connected IoT operations, raising significant concerns about operational integrity and data confidentiality. This incident highlights a persistent trend in adversaries targeting device management interfaces and exploiting command injection vulnerabilities for lateral movement or further compromise. With regulatory scrutiny increasing and attackers rapidly capitalizing on newly discovered flaws, swift patching and enhanced network segmentation are more crucial than ever.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Arrest of UK Teen Halts Core Scattered Spider Ransomware Operations in 2024
Financial Services10 months ago

Arrest of UK Teen Halts Core Scattered Spider Ransomware Operations in 2024

In June 2024, UK authorities arrested Thalha Jubair, a 19-year-old national identified as a core operator within the Scattered Spider ransomware group. Jubair, linked to at least 120 cyberattacks and $89.5 million in cryptocurrency transactions, was accused of orchestrating sophisticated extortion campaigns against major organizations, including the 2024 attack on the U.S. federal court system and Transport for London. The investigation utilized blockchain analysis and traced ransom payments that funded essential purchases, directly implicating Jubair despite advanced operational security measures such as VPNs and amnesiatic operating systems. This landmark arrest exposes the evolution and persistence of decentralized ransomware groups, highlighting challenges in attribution and apprehension. The incident demonstrates the growing use of identity obfuscation tools and cryptocurrencies among cybercriminals, underscoring the urgent need for robust detection, response, and regulatory frameworks across industries.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Ransomware Attack Disrupts Major European Airports via Collins Aerospace in 2025
Airlines/Aviation10 months ago

Ransomware Attack Disrupts Major European Airports via Collins Aerospace in 2025

In September 2025, a major ransomware attack on Collins Aerospace, a critical provider of check-in and boarding systems, triggered widespread disruptions at several major European airports, including Heathrow, Brussels, and Berlin Brandenburg. The hackers targeted the Multi-User System Environment (MUSE) platform, which airlines rely on to coordinate check-in desks and gate assignments. As a result, more than 100 flights were delayed or cancelled, and thousands of passengers faced manual check-in procedures while airports scrambled to contain the operational fallout. Law enforcement and cybersecurity agencies are actively investigating, prioritizing the restoration of affected systems and mitigation of further impact. This incident underlines the escalating risk posed by ransomware targeting supply chain infrastructure and the aviation sector’s reliance on shared IT systems. It also reflects a broader trend of cybercriminals exploiting third-party service dependencies, bringing renewed urgency to layered defense strategies and zero-trust adoption for business-critical environments.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports