Latest / The Digital Warfare Podcast / EP. 170: Ransomware-Linked Malware Hits South Africa’s Air Traffic OT Network
Transcript
- Digital Warfare: You're listening to the Digital Warfare Podcast. Today we're looking at a cyber incident involving infrastructure where availability is not simply an IT concern, it can become an aviation concern. South Africa's Air Traffic and Navigation Services, or ATNS, is investigating malware discovered inside an operational technology environment supporting weather-related air traffic services. And the malware has been associated with the early stages of ransomware activity. Here's what happened. The affected environment is linked to FAPE, Chief Dawid Steurman International Airport, with the investigation also examining systems associated with FAEL. ATNS detected suspicious activity inside operational technology supporting weather services used by air traffic operations. Its internal technical team reportedly contained and removed the malware, but containment does not answer the most important questions. How did the attackers get in? How long were they present? What systems did they access? Did they establish persistence? And did data leave the environment? Those questions are now part of a formal forensic investigation. One particularly important element is possible data exfiltration to external IP addresses located in China. That does not establish who carried out the attack. An IP address is infrastructure, not attribution. Attackers routinely use compromise servers. Proxies and rented infrastructure located in countries with no direct relationship to the threat actor. But unexplained outbound traffic from an operational technology environment remains a significant forensic indicator. The ransomware element also requires precision. The available information describes malware associated with the early stages of ransomware deployment. That is different from confirming that files were encrypted, operations were shut down, or a ransom was demanded. There is currently no evidence supporting those conclusions. What makes the incident important is where the malware was found. Weather information is critical to aviation. Pilots and air traffic personnel depend on meteorological information for visibility, wind, storms, flight planning, and safe movement through controlled airspace. A compromise affecting those supporting systems can therefore create consequences far beyond a conventional corporate network. For defenders, there are several immediate lessons. First, Segment operational technology from enterprise IT. Compromise of a workstation or business application should not provide a direct path into systems supporting operational services. Second, monitor outbound traffic from OT environments. Unexpected connections to unfamiliar external infrastructure should be treated as high-priority events. Third, preserve evidence before rebuilding systems. Disk images, memory, logs, network telemetry, user activity. And authentication records can determine whether containment actually removed the attacker. Fourth, hunt for lateral movement and persistence. Removing known malware is not enough if the attacker still controls another account, host, or remote access mechanism. And finally, protect operational resilience. Critical services need tested fallback procedures, so an intrusion into supporting technology does not automatically become a safety or availability crisis. The broader lesson is straightforward. Ransomware is no longer only an office network problem. Attackers continue to reach systems that support transportation, manufacturing, energy, and other physical operations. And when malware crosses from IT into operational technology, the question changes. It is no longer simply, what data could we lose? It becomes, what real-world service could stop working? This has been your digital warfare daily brief. Stay secure. We'll see you tomorrow.