Security Reports disagree 3 publishers 2 min read Published Sep 30, 2026, 12:21 AM PDT Updated Oct 1, 2026, 11:00 PM PDT

Ransomware tooling turns up in weather OT at South Africa's air traffic operator

South Africa's ATNS, which runs air traffic control for about 10% of the world's airspace, found early-stage ransomware tooling in a weather OT network. The state operator says its team stopped the attack yet is seeking outside forensics to learn how the attackers got in.

The Watch · Security desk

Send a correction

Illustration accompanying Ransomware tooling turns up in weather OT at South Africa's air traffic operator — Generated illustration

What happened

The OT intrusion was at Port Elizabeth Airport, and a possible insider theft of data at Maputo International Airport in Mozambique is part of the same investigation request.
The service request is unclear on whether East London Airport was also affected by the OT compromise.
ATNS technical teams found signs of data exfiltration to external IP addresses located in China, according to the request.
ATNS wants forensic services to begin Sept. 18, and the documents do not make clear when the intrusion itself took place.
Thales counted a sixfold rise in ransomware attacks on aviation in 2025 and 27 major attacks on aviation firms in the 16 months to April 2025.

Why it matters

Who's exposed exposure Air navigation providers now have a documented case of ransomware tooling in OT that serves controllers. Weather and support networks belong in the same threat model as business IT.
What doesn't add up contradiction ATNS says the attack was stopped, but its own tender lists the extent of compromise as undetermined. Until the forensic report, any public statement about scope stays provisional.
What it limits constraint Operators checking for the same intruder have only the tender documents to work from, because ATNS did not answer Dark Reading's questions.

Next story · Security · 8h ago

Semperis survey puts threats against ransomware victims' staff at 40% of attacks

Confirmed2 publishers

ATNS described the affected systems as operational technology "supporting weather-related services to Air Traffic Services" ^[3]. Controllers depend on that data. The request, as Dark Reading reported it, places the tooling in that weather environment ^[3]. Attackers reached operational systems at an air navigation provider, on the support side of air traffic control ^[1].

ATNS wrote: "Preliminary investigations identified malware commonly associated with the early stages of ransomware attacks." ^[4] I'd read that as a foothold staged for encryption. At that stage the responder's open question is dwell time: how long the attacker sat in the network and what else they touched. ATNS believes its technical team stopped the attack ^[2].

ATNS's own word for the China-located exfiltration evidence is "suggestions" ^[5].

"Internal technical teams have implemented containment measures and malware removal," ATNS wrote in the request ^[6]. "[H]owever, a comprehensive forensic investigation is required to determine the root cause, extent of compromise, and any remaining risks." ^[7]

Two outside voices speak to the wider pattern, though neither ties ATNS to a named group or campaign. "Since the start of 2024, at least eight national government departments and public entities have suffered confirmed cyber incidents, and aviation-related organizations are now part of that pattern," said Hendrik de Bruin, head of security consulting for Africa at Check Point ^[14]. Avinash Singh, a lecturer in computer science at the University of Pretoria, said aviation systems are popular targets because the impact is often impossible to hide, adding that "grounded flights and stranded passengers cannot be hidden." ^[16]

Check Point's weekly count puts South African organizations at an average of 2,086 attacks a week against a global average of 2,422 ^[17], about 14% lower ^[18]. That figure has little bearing on how tooling reached an ATC operator's weather network. De Bruin's more relevant point is that compliance checks prove controls exist on paper, while attackers test whether they work in practice ^[15].

What to watch

Whether the forensic investigation links the possible insider data theft at Maputo to the Port Elizabeth OT intrusion.
A ransomware group posting ATNS data on a leak site would confirm the exfiltration and put a name to the actor.
Whether the root-cause finding shows the attackers entered through ATNS business IT or directly into the weather OT.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence60
Adoption: Not scored
Hype gap+20
Incentives35
Confidence58

Perspective Coverage

3 publishers

Builder: Builder 22%
Operator: Operator 60%
Investor: Investor 18%

Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
ATNS discovered ransomware-linked malware in an operational technology (OT) network, according to public documents released this month.
Reported Supported Source: Dark Reading, citing ATNS public documentsView cited source
[2]
ATNS believes its technical team stopped the attack, but it issued a request for quotes seeking cyber-forensics firms to investigate the incident.
Reported Supported Source: Dark ReadingView cited source
[3]
"Monitoring systems detected suspicious activity within operational technology (OT) environments supporting weather-related services to Air Traffic Services,"
Reported Supported Source: ATNS service request, quoted by Dark ReadingView cited source
[4]
"Preliminary investigations identified malware commonly associated with the early stages of ransomware attacks."
Reported Supported Source: ATNS service request, quoted by Dark ReadingView cited source
[5]
ATNS technical teams found suggestions of "data exfiltration to external IP addresses located in China," the document stated.
Reported Supported Source: ATNS service request, quoted by Dark ReadingView cited source
[6]
"Internal technical teams have implemented containment measures and malware removal,"
Reported Supported Source: ATNS request for quotes, quoted by Dark ReadingView cited source
[7]
"[H]owever, a comprehensive forensic investigation is required to determine the root cause, extent of compromise, and any remaining risks."
Reported Supported Source: ATNS request for quotes, quoted by Dark ReadingView cited source
[8]
A second attack, possibly an insider's theft of data, is also part of the ATNS investigation request.
Reported Supported Source: Dark ReadingView cited source
[9]
It is unclear when the incident occurred, but ATNS requested cyber-forensic services starting Sept. 18, according to the documents.
Reported Supported Source: Dark Reading, citing ATNS documentsView cited source
[10]
The OT incident occurred at Port Elizabeth Airport, South Africa (FAPE), while the possible insider cyber theft occurred at Maputo International Airport, Mozambique (FAMM).
Reported Supported Source: Dark Reading, citing the ATNS requestView cited source
[11]
East London Airport, South Africa (FAEL) may also have been affected by the OT compromise, but the service request is unclear on that point.
Reported Supported Source: Dark ReadingView cited source
[12]
Dark Reading reached out to ATNS, but the company did not respond by publication time.
Reported Supported Source: Dark ReadingView cited source
[13]
Ransomware attacks targeting the aviation industry surged sixfold in 2025 from the previous year, and aviation firms reported 27 major ransomware attacks in the 16 months leading up to April 2025, according to Thales.
Reported Supported Source: Thales data, cited by Dark ReadingView cited source
[14]
"Since the start of 2024, at least eight national government departments and public entities have suffered confirmed cyber incidents, and aviation-related organizations are now part of that pattern."
Reported Supported Source: Hendrik de Bruin, head of security consulting for Africa, Check PointView cited source
[15]
Compliance checks prove that controls exist on paper, but attackers test whether they work in practice, says Check Point's de Bruin.
Reported Supported Source: Hendrik de Bruin, Check PointView cited source
[16]
Avinash Singh, a lecturer in the Department of Computer Science at the University of Pretoria, said aviation systems and other critical infrastructure are popular targets because the impact is often impossible to hide, adding, "grounded flights and stranded passengers cannot be hidden."
Reported Supported Source: Avinash Singh, University of PretoriaView cited source
[17]
South African organizations recorded an average of 2,086 cyberattacks per week, slightly below the global average of 2,422, according to Hendrik de Bruin of Check Point.
Reported Supported Source: Hendrik de Bruin, Check PointView cited source
[18]
South Africa's weekly average of 2,086 attacks is about 14% below the global average of 2,422.
Derived Supported
[19]
Air Traffic and Navigation Services (ATNS), a South African state-owned company, provides air traffic control and weather operations for approximately 10% of the world's airspace.
Reported Contested Source: Dark ReadingView cited source

Sources

3 independent publishers whose own reporting we read for this story.

businessday.co.za
1 article · October 1, 2026
Business Day
darkreading.com
1 article · September 30, 2026
South Africa Seeks Help After Cyberattack Targets Air Traffic Control
scworld.com
1 article · September 30, 2026
South African air traffic control firm investigates ransomware-linked malware in OT network

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Builder22%

For people who build detection and OT tooling, the technical detail is thin. ATNS's own procurement document says monitoring caught malware typical of the early stages of ransomware in a network that feeds weather data to air traffic services, and that staff removed it. No publisher names the malware family or the entry point, and the only indicator is traffic to IP addresses in China. Avinash Singh gave Dark Reading the one argument aimed at builders: defensive models built on global threat intelligence "heavily biases Northern Hemisphere data" and may miss the tactics used against African targets.

Operator60%

This is mainly a story for people who run systems. The intrusion was in operational technology at Port Elizabeth, with East London possibly affected, and a separate insider data-theft allegation sits at Maputo. ATNS says it contained the malware but needs outside forensics to find the root cause and how far the compromise went. Business Day adds that internal checks could not substantiate the insider claims, and that spokesperson Khulu Phasiwe would date the attack only to the current financial year. Check Point's Hendrik de Bruin told Dark Reading about a neighbouring-country case where "[T]here was a firewall, but nobody had asked whether it was switched on and doing its job."

Investor18%

ATNS is state-owned, so the incident has no direct listed exposure. Business Day's account is the only one with a financial angle. Airports Company South Africa used its annual report to flag inadequate security governance, thin staffing and outdated, fragmented ICT. Its new chief executive, Siphamandla Mthethwa, takes on the modernisation work. The threat-trend figures in the story come from Thales and Check Point, both of which sell security.