Arab Civil Aviation Organization Hit By Cyberattack, Sensitive Data Stolen In Latest Aviation Sector Breach
The Arab Civil Aviation Organization (ACAO) has fallen victim to a sophisticated cyberattack, marking the latest in a series of breaches targeting global aviation entities. Cybersecurity firm Resecurity uncovered the breach, revealing that threat actors exploited a vulnerability in a web application through an SQL injection to infiltrate ACAO’s systems. The attackers successfully exfiltrated sensitive data, including records of staff, members, and aviation safety specialists, raising concerns about potential cyberespionage targeting the aviation sector.
The ACAO breach follows a similar incident involving the International Civil Aviation Organization (ICAO), a specialized agency of the United Nations. In early January 2024, ICAO confirmed that a data breach had compromised the personal information of nearly 12,000 individuals, including names, email addresses, dates of birth, and employment history. While the ICAO breach initially appeared to be an intelligence-gathering operation, the ACAO attack has been characterized as a direct system breach with potentially broader implications.
Resecurity’s cyber threat intelligence (CTI) team has identified the ACAO breach as part of a larger cyberattack pattern targeting worldwide aviation organizations. According to their analysis, the attackers were not motivated by financial gain but sought intelligence from aviation safety experts, investigators, and regulatory personnel. The nature of the stolen data suggests that it could be used for cyberespionage, particularly by state-sponsored actors aiming to gain strategic insights into aviation safety protocols and personnel.
The leaked ACAO data set surfaced on a Dark Web forum on February 4, 2024, including login credentials, hashed passwords, and email communications. Among the compromised entities were members of prominent aviation investigation agencies, such as the Qatar Aircraft Accident and Incident Investigation Unit (QAAI), the Aviation Investigation Bureau (AIB) of Saudi Arabia, and the Iran Civil Aviation Authority. The exposure of such sensitive information has raised alarms about the potential data misuse for targeted espionage or sabotage.
Resecurity has notified the affected organizations and provided detailed intelligence on the exposed data. Notably, the breach had not been previously disclosed, underscoring significant gaps in cybersecurity defenses within the aviation sector. The incident highlights the urgent need for enhanced security measures to protect critical infrastructure and sensitive information from increasingly sophisticated cyber threats.
The ICAO breach preceded the ACAO attack and involved a hacker claiming to have accessed 42,000 sensitive documents. While ICAO initially downplayed the incident, further analysis confirmed that nearly 12,000 individuals were affected. Unlike the ACAO breach, which involved a direct system compromise, the ICAO incident appears to have been an intelligence-gathering operation aimed at collecting personal and professional details of aviation personnel. Both breaches, however, point to a troubling trend of cyberattacks focusing on aviation safety experts, whose expertise is vital for investigating incidents and ensuring air travel safety.
