[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fcSOqPCveoZHrXRyErd_vE6Ps_z6lEisRq8X_O0BiOu0":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":134},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"2fea6c82-6cd4-4d31-a76e-28d4055cf9da","South Africa Seeks Help After Cyberattack Targets Air Traffic Control","south-africa-seeks-help-after-cyberattack-targets-air-traffic-control-22d143","As aviation infrastructure suffers more cyberattacks, air traffic systems are the latest target, with a ransomware toolkit installed on at least one operational network.","South Africa's air traffic control systems have been targeted by a ransomware attack, with the toolkit found on at least one operational network. The incident has prompted the country to seek international assistance to address the growing threat to aviation infrastructure.","South Africa's air traffic control system hit by ransomware attack.","https:\u002F\u002Fwww.darkreading.com\u002Fcyberattacks-data-breaches\u002Fsouth-africa-help-cyberattack-air-traffic-control","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblt4eff7c6bb4fca152\u002F6abc296fa6381769c5d9ff08\u002Fjohannesburg-airport-south-africa-EQRoy-shutterstock.jpg?width=720&quality=80&disable=upscale","2026-09-30T07:00:00+00:00","2026-09-30T08:00:18.896146+00:00",7,[17],{"name":18,"type":19},"air traffic control","technology","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":20,"icon":22,"name":23,"slug":24},null,"Ransomware","ransomware",[26,31,33,38],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":32},{"id":20,"icon":22,"name":23,"slug":24},{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",[],[],{"controls":46,"vendors":133},[47,76,105],{"slug":48,"name":49,"problem":50,"products":51},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":77,"name":78,"problem":79,"products":80},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",{"slug":106,"name":107,"problem":108,"products":109},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[110,117,125],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":42,"product_name":114,"url":115,"description":116},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","CrowdStrike Incident Response","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fservices\u002Fincident-response\u002F","Incident response services, available on retainer.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"truesec","Truesec","\u002Fvendor-logos\u002Ftruesec.png","truesec-incident-response","Truesec Incident Response","https:\u002F\u002Fwww.truesec.com\u002Fservice\u002Fincident-response","Incident response team with a retainer option.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","mandiant-incident-response","Mandiant Incident Response","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fconsulting\u002Fmandiant-incident-response-services","Incident response services from Mandiant, available on retainer.",[],{"slug":135,"title":136,"body":137,"framework_refs":138,"framework_notes":149},"ransomware-hits-south-africas-air-traffic-control-systems","Ransomware Hits South Africa's Air Traffic Control Systems","South Africa's air traffic control agency suffered a ransomware attack that penetrated at least one operational network, highlighting the critical vulnerability of aviation infrastructure to cyber threats. The presence of ransomware toolkit on operational systems suggests insufficient network segmentation between IT and operational technology (OT) environments, allowing attackers to move laterally into sensitive systems. Aviation infrastructure represents life-safety critical systems where disruptions can have immediate physical consequences beyond data loss or financial impact. The need to seek international assistance further underscores how under-resourced critical infrastructure operators often lack the internal incident response capabilities needed to handle sophisticated ransomware attacks independently.",[139,140,141,142,143,144,145,146,147,148],"CIS Control 12 – Network Infrastructure Management","CIS Control 11 – Data Recovery","CIS Control 17 – Incident Response Management","NIST SP 800-82 – Guide to ICS Security","NIST IR (Incident Response) – SP 800-61","NIST CP-9 – Information System Backup","IEC 62443 – Industrial Cybersecurity Standard","ICAO Cybersecurity Strategy for Aviation","ITIL – Major Incident Management Process","NIST CSF – Respond and Recover Functions",{}]