[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHWRq-xtjhGN-BQDIv19T458F6sQ97oJus3nwBpItI1c":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"a99d8622-0c28-41d6-9501-4976f57f2677","ransomware-hits-south-africas-air-traffic-control-systems","2fea6c82-6cd4-4d31-a76e-28d4055cf9da","Ransomware Hits South Africa's Air Traffic Control Systems","South Africa's air traffic control agency suffered a ransomware attack that penetrated at least one operational network, highlighting the critical vulnerability of aviation infrastructure to cyber threats. The presence of ransomware toolkit on operational systems suggests insufficient network segmentation between IT and operational technology (OT) environments, allowing attackers to move laterally into sensitive systems. Aviation infrastructure represents life-safety critical systems where disruptions can have immediate physical consequences beyond data loss or financial impact. The need to seek international assistance further underscores how under-resourced critical infrastructure operators often lack the internal incident response capabilities needed to handle sophisticated ransomware attacks independently.","**Immediate actions:**\n- Isolate compromised operational networks from IT systems and the internet to prevent further lateral movement.\n- Deploy offline, tested backups of all critical air traffic management system configurations and data to enable rapid recovery.\n- Engage national and international cybersecurity authorities (e.g., CISA, INTERPOL) and activate pre-established incident response retainers immediately.\n\n**Long-term improvements:**\n- Implement strict IT\u002FOT network segmentation using air gaps or unidirectional security gateways around all air traffic control systems.\n- Establish and regularly exercise a documented incident response plan specifically tailored to aviation OT environments.\n- Conduct regular third-party penetration testing and vulnerability assessments on all critical aviation infrastructure networks.\n\n**Detection measures:**\n- Deploy continuous monitoring and anomaly detection tools tuned for OT\u002FICS protocols on all operational networks.\n- Implement centralized logging with a SIEM solution to provide real-time alerting on suspicious lateral movement or ransomware indicators.\n- Establish baseline behavioral profiles for all operational network assets to detect deviations that may indicate compromise.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 12 – Network Infrastructure Management","CIS Control 11 – Data Recovery","CIS Control 17 – Incident Response Management","NIST SP 800-82 – Guide to ICS Security","NIST IR (Incident Response) – SP 800-61","NIST CP-9 – Information System Backup","IEC 62443 – Industrial Cybersecurity Standard","ICAO Cybersecurity Strategy for Aviation","ITIL – Major Incident Management Process","NIST CSF – Respond and Recover Functions",{},"published","2026-09-30T08:20:50.433126+00:00","2026-09-30T08:20:50.35+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.darkreading.com\u002Fcyberattacks-data-breaches\u002Fsouth-africa-help-cyberattack-air-traffic-control","south-africa-seeks-help-after-cyberattack-targets-air-traffic-control-22d143","South Africa Seeks Help After Cyberattack Targets Air Traffic Control",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"182e11d5-57c4-444e-8ec8-4682ad60261b","Incident Response","incident-response","Slow detection, poor containment, missing playbooks","#14b8a6",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c8ff5d73-dec9-4911-88ee-ed016a89f3f4","Backup & Recovery","backup-recovery","No backups, untested recovery, ransomware impact","#f43f5e",{"id":44,"name":45,"slug":46,"description":47,"color":48},"f43a7f30-5046-4b10-9dba-1a704139821e","Network Segmentation","network-segmentation","Lateral movement, flat networks, missing firewalls","#06b6d4",[],[51,55,59],{"slug":52,"name":53,"problem":54},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",{"slug":56,"name":57,"problem":58},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",{"slug":60,"name":61,"problem":62},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it."]