Cyber Attackers Are Targeting the Aviation Sector. How Should Air Traffic Controllers Respond? - WebWire
Cyberattacks on the aviation sector increased by 600% between January 2024 and April 2025, with 27 major incidents recorded by 22 ransomware groups.
Aviation's traditionally robust safety ecosystem is facing unprecedented cyber threats. According to Thales research, there were 27 major cyberattacks by 22 ransomware groups on the aviation sector between January 2024 and April 2025, representing a 600% increase in just one year. These attacks target critical systems that ensure the safety of over 100,000 aircraft carrying up to 14 million passengers daily worldwide.
The aviation ecosystem involves numerous stakeholders including aircraft manufacturers, airlines, airport authorities, air navigation service providers (ANSPs), and international bodies like EUROCONTROL, which manages 35,000 flights per day in Europe alone. Despite this complexity, the sector maintained an impressive safety record in 2025 with only eight fatal accidents from 38.7 million flights.
Diverse Threat Actors
Cyber threats to aviation come from multiple sources. Criminal organizations primarily seek financial gain through data theft, while hacktivists and state-sponsored actors focus on disruption for political purposes, often employing Distributed Denial of Service (DDoS) and ransomware attacks. High-profile incidents include a 2023 DDoS attack on EUROCONTROL by pro-Russian hacktivist group KillNet, and a 2024 targeting of Germany's DFS.
In a sector where safety is the number one priority for everyone involved, this is a major concern. Each of these attacks could impact the critical systems that keep planes in the sky.
System Vulnerabilities
The aviation sector's increasing interconnectedness creates significant vulnerabilities. Legacy infrastructure often lacks modern protections like encryption and robust password policies. Centralized systems present single points of failure, while routers with simple segregation rules instead of real firewalls offer inadequate defense. Authentication challenges persist, with some systems lacking mechanisms to verify server component integrity.
The interfaces between different suppliers represent particularly dangerous vulnerabilities. For example, unauthenticated controller-pilot data link communications (CPDLC) messages or spoofed global navigation satellite system (GNSS) data could create false position information that affects both pilots and air traffic controllers. Even manipulated USB devices can contaminate multiple systems in this interconnected environment.
Defense Strategies
Traditional defense measures include strong segmentation between IT and operational technology (OT) systems, fallback capabilities for maintaining operations during attacks, manual override procedures for controllers, and continuous monitoring by security operations centers (SOCs). However, these measures require continuous reassessment as threats evolve.
ANSPs must translate regulatory requirements into continuous risk management, distinguishing between cyber risks with operational consequences and those with safety impacts. Regular reassessment of threat scenarios, incident detection and response, and adaptation of security measures are essential as systems, regulations, and geopolitical contexts change.
While airlines currently face five times more attacks than ANSPs according to 2025 EUROCONTROL data, the interconnected nature of aviation systems means an attack on one target will likely impact all others. Organizations across the aviation ecosystem must conduct regular risk assessments and maintain effective response plans to keep risks under control and meet regulatory expectations.
Related
