South Africa’s Air Traffic Services Provider Investigates Cyberattack on OT Network
Summary
South Africa’s ATNS found ransomware-associated malware in an operational technology network supporting air traffic weather services and is seeking forensic investigators. A separate possible data theft at a Mozambique airport is also under investigation.
Key points
- ATNS detected suspicious activity and malware commonly associated with early-stage ransomware in an OT environment supporting weather services.
- The OT incident occurred at Port Elizabeth Airport; East London Airport may also have been affected.
- Investigators found indications of data exfiltration to external IP addresses in China.
- A separate possible insider data theft at Maputo International Airport is included in the forensic investigation request.
- ATNS said internal teams contained the activity and removed malware, but requested a comprehensive investigation to establish the cause, scope, and remaining risks.
Article Details
- Victim Organization
- Air Traffic and Navigation Services (ATNS)
- Incident Type
- Ransomware-linked malware detected in an operational technology network; a separate possible insider data-theft incident is also under investigation.
- Operational Impact
- ATNS said its technical team believed it stopped the attack and implemented containment measures and malware removal. No service disruption was reported. The extent of compromise and any remaining risks are under investigation. Possible data exfiltration was identified as a preliminary finding, not confirmed.
- Ransom Or Extortion
- No ransom demand or extortion was reported. The malware was described as commonly associated with early stages of ransomware attacks.
- Claim Status
- confirmed
People
Vendors
Check Pointattacks targeted organizations across the globe, nearly double the same month in 2025, according to Check Point Software Technologies. South African organizations specifically recorded an average of 2,086Thalesaviation industry surged sixfold in 2025 from the previous year, according to aviation and defense firm Thales. Aviation firms reported 27 major ransomware attacks in the 16 months leading up to April 2025, according
Countries
MozambiqueSouth Africa (FAPE), while the possible insider cyber theft occurred at Maputo International Airport, Mozambique (FAMM). A second facility — East London Airport, South Africa (FAEL) — may have also been affected bySouth AfricaFor Africa, aviation and other critical infrastructures are increasingly targeted, says Avinash Singh, a lecturer in the Department of Computer Science at the University of Pretoria (UP) in South Africa.