South Africa’s air navigation provider is seeking outside cybersecurity assistance after detecting malware associated with ransomware activity inside an operational technology network supporting aviation services.
Air Traffic and Navigation Services (ATNS), the state-owned company responsible for air traffic control and weather operations across roughly 10% of the world’s airspace, detected suspicious activity in systems supporting weather services used by Air Traffic Services. Internal teams contained the incident and removed the malware, but the organization is now seeking forensic specialists to determine how far the attackers reached and whether they remain inside its infrastructure.
The incident highlights a growing cybersecurity concern for aviation: attacks are moving beyond corporate IT networks and increasingly reaching systems connected to operational environments.
Ransomware Indicators Found in an OT Network
ATNS said monitoring systems detected suspicious activity inside its operational technology environment. Preliminary analysis identified malware commonly associated with the early stages of ransomware attacks, although there is no indication that ransomware successfully encrypted the affected operational systems.
Investigators also found indications that information may have been exfiltrated to external IP addresses located in China. That does not establish who was behind the attack, and ATNS has not publicly attributed the incident to a particular threat group.
The affected environment was associated with Port Elizabeth Airport, while documentation suggests East London Airport may also require investigation. ATNS says its own technical teams implemented containment and malware-removal measures, but a complete forensic investigation is needed to establish the root cause and full extent of the compromise.
A Separate Incident May Involve an Insider
The investigation is also expected to examine another security incident at Maputo International Airport in Mozambique.
That case appears different from the ransomware-related compromise and may involve an insider stealing information. ATNS has included both incidents in its request for external forensic expertise, indicating that investigators will need to determine whether any relationship exists between them.
The distinction matters because insider activity and external ransomware operations require very different investigative approaches. One focuses heavily on malware, infrastructure and initial access, while the other may require examining identities, privileged access and legitimate user activity.
Aviation Is Becoming a More Attractive Cyber Target
The incident comes as ransomware groups increasingly target aviation organizations. Data cited by Dark Reading from Thales indicates that ransomware attacks against the aviation industry increased sixfold in 2025 compared with the previous year, with 27 major incidents reported during the 16 months leading to April 2025.
Aviation is attractive because disruption can quickly become visible and expensive. Airlines, airports, navigation services and supporting infrastructure operate within tightly connected environments where prolonged outages can affect passengers, logistics and national infrastructure.
The presence of ransomware-related malware inside an OT network is therefore particularly significant. Operational systems traditionally relied heavily on isolation, but increasing connectivity between IT, OT and external services has made those boundaries more difficult to maintain.
Containment Is Only the Beginning
ATNS believes its teams stopped the attack, but removing malware does not answer the most important forensic questions. Investigators still need to establish how the attackers entered, what credentials they obtained, how long they remained inside the environment and whether data was successfully exfiltrated.
They will also need to determine whether persistence mechanisms remain and whether attackers moved between IT and operational networks.
That distinction is critical for infrastructure operators.Stopping the visible attack is not the same as understanding the compromise. In environments responsible for critical services such as aviation, forensic readiness and network visibility can be just as important as preventing the initial intrusion.
The South African incident demonstrates why OT security is increasingly becoming part of mainstream cybersecurity. Attackers no longer need to compromise aircraft or manipulate air traffic directly to create serious risk. Reaching the digital infrastructure supporting aviation operations is already enough to demand an urgent response.