Aerospace & Aviation — Cyber Threat Activity

Aerospace and aviation holds one recorded incident in our log, which measures our collection rather than the sector's exposure: airlines, airports, manufacturers and maintenance providers rarely appear on extortion sites, and aviation security incidents are reported into regulators rather than published. The actor graph carries 34 groups associated with the sector, including APT28, APT40, APT1, Dragonfly and AeroBlade, with 149 malware families linked through those actors. Two threats sit here. The first is espionage against the manufacturing and research end, where airframe, propulsion, avionics and satellite programmes represent decades of development that a state can shortcut by stealing it, and where the supply chain of subcontractors and machine shops is far softer than the primes they serve. Iranian-linked operators have used aviation-themed job lures against aerospace and energy firms for exactly this. The second is more mundane and more persistent. Cisco Talos documented a campaign against aviation that ran for years using only off-the-shelf malware and aviation-themed lures such as flight itineraries and manufacturer documents, succeeding not through technical sophistication but through relevance to the recipient, and assessed that credentials taken by small operators of this kind are frequently sold onward to larger extortion crews. Airline operations also depend on scheduling, crew rostering, baggage and ground-handling systems where a few hours of downtime cascades across a network for days. Read the single recorded incident as a disclosure artefact, and the actor associations as published research on each group rather than measured attributions in our corpus.

All sectors

Threat actors targeting Aerospace & Aviation

Malware used against Aerospace & Aviation

Families used by the threat actors that target this sector, derived from actor tooling rather than observed in these incidents directly.

Where these victims are

Recent incidents

Coverage. 94.8% of incidents in our log carry a sector classification; the remainder name a victim we have not placed in an industry. Counts here are a floor, not a total, and are not comparable between sectors of different sizes.

Read the full analysis on IntelFusions