Cyber Threat Landscape: Aviation Industry 2022

Cyber Threat Landscape: Aviation Industry 2022

Product Serial: B-2022-10-14b

TLP:CLEAR

ZeroFox Intelligence is excited to announce the release of our Aviation Industry Cyber Threat Landscape for 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 5:00 PM (EDT) on October 12, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

The aviation industry is an attractive target for malicious actors due to its crucial role in international movement of goods and people and the vast amounts of sensitive information aviation companies hold. Cyberattacks in 2022 have highlighted the fragility of aviation supply chain and business operations, as well as the potential impact that successful attacks can have. The aviation supply chain is varied and complex, with multiple global third parties, and relies on interconnected systems with numerous time-sensitive moving parts. Growing interconnectivity and heightened geopolitical tensions in the global supply chain are driving an increased risk to aviation organizations from cyberattacks.

Threats to the industry come from groups ranging from activists to cyber criminals to nation-state actors. Organizations face a host of potential business impacts, including data exfiltration, equipment damage, and operational disruption, as well as a persistent threat from nations conducting cyber espionage to steal proprietary data and intellectual property. Personally Identifiable Information (PII)—including Social Security numbers, passports, financial records, phone numbers, and addresses—is often the main target for cybercriminals targeting aviation, who leverage such data to commit fraudulent activity or sell to third parties on deep and dark web (DDW) forums.

Airlines and airports are attractive targets themselves, but the cyber threat landscape facing the aviation industry as a whole must be considered in the implementation of solutions. Operators are primarily concerned with finding efficient and cost-effective solutions to the movement of goods and people, but good cybersecurity hygiene may not compliment—and could even run contrary to—these practices. To adopt digital solutions safely, a thorough understanding of the threat landscape and of good cybersecurity practices must be obtained and considered as a key pillar in the design and maintenance processes.

Key Findings

• Ransomware and digital extortion remain some of the greatest threats to the aviation sector and its supply chains. Threat actors may resort to more extreme pressure tactics to elicit payment from victims.
• Social engineering campaigns targeting the industry remain highly effective, with attacks in 2022 compromising both customers and employees of aviation companies and adjacent industries.
• The fall in the number of aviation industry-related advertisements from initial access brokers (IAB) on DDW forums throughout 2022 does not necessarily correspond to a reduction in threat. Illicit access to large or high-profile aviation industry entities will likely increasingly be sold via private or direct communication methods.
• Information technology infrastructure faces the greatest threat from malware, with saturated loader, infostealer, and trojan marketplaces filled with malware designed to target Windows or Linux-based systems. Aviation organizations may face an increased threat from wipers leveraged by Russia-backed entities.
• Botnets pose a significant threat to aviation organizations on two key fronts–stealing credentials and remotely controlling infected devices. Distributed Denial of Service (DDoS) attacks against the aviation industry likely have disproportionate impact, given the downstream effects of a short disruption to operations, but rarely last long or cause long-term damage.
• Aviation organizations increasingly rely on third-party vendors to provide network edge, cloud computing, and remote management technologies to enable business operations, greatly expanding the cyber attack surface.