South African air traffic control firm investigates ransomware-linked malware in OT network

Coverage from Dark Reading indicates that the South African state-owned company responsible for air traffic control and weather operations, Air Traffic and Navigation Services (ATNS), has discovered ransomware-linked malware within its operational technology (OT) network. The company believes its technical team contained the attack, but is seeking cyber-forensics firms to investigate the incident, which may also involve data theft.

The incident at ATNS, which manages approximately 10% of the world's airspace, involved suspicious activity detected in OT environments supporting weather services. Preliminary findings pointed to malware commonly associated with the early stages of ransomware attacks. The company also noted suggestions of data exfiltration to external IP addresses in China. The investigation is looking into two facilities, Port Elizabeth Airport (FAPE) and potentially East London Airport (FAEL) in South Africa, as well as Maputo International Airport in Mozambique (FAMM) for a possible insider data theft.

This event underscores the growing risks to aviation infrastructure, a sector that saw a sixfold increase in ransomware attacks in 2025. Experts note that critical infrastructure in Africa is increasingly targeted due to the high visibility of disruptions like grounded flights. The ongoing investigation aims to determine the root cause, extent of compromise, and remaining risks, highlighting potential gaps in security governance, skills, and system maintenance within the region.

Source: Dark Reading