Latest News

Cyber experts: Airport chaos shows rise in ransomware attacks with high-profile victims

Cybercriminals take greater risks when they target high-profile targets in order to reap larger rewards and increase their online reputational power, according to cybersecurity experts, following a weekend hack that crippled check-in systems at airports across Europe, leaving thousands of passengers stranded. ENISA, the European Union's cybersecurity agency, confirmed Monday that the attack on Collins Aerospace (owned by RTX) was a ransomware. However, it did not specify where the attack came from. The outage has affected dozens flights since Friday.

Rafe Pilling is the Director of Threat Intelligence for Sophos.

He added that "the subset of deliberate attacks engineered to maximize disruption, often by Western based groups, is the outlier. But they are becoming more visibly and more ambitious."

The hacker's identity was unclear. On dark-web "leak sites," ransomware gangs regularly publicise their attacks and leak stolen information. However, websites that monitor these portals have not detected any group claiming Collins Aerospace or RTX as a targeted company as of Monday.

Cybercriminals use ransomware, a malicious program that encrypts data of a company and demands payment to unlock it. Most of them operate in shadows and avoid targets that might attract unwanted attention from law-enforcement agencies.

Cyber experts say that other groups are more daring in their choice of targets.

Scattered Spider, a group dubbed by many as hackers, was reported to have been behind the attack on British retailer Marks & Spencer in April. This attack crippled one of Britain's most recognizable names, preventing it from accepting online orders for several weeks.

Two teenagers were charged by the National Crime Agency of Britain last Thursday for a cyberattack in 2024 on London's Transport for London. The agency said that this attack caused "significant disruptions and millions of losses".

Investigators at the NCA believed that Scattered Spider members were responsible for the TfL attack. Scattered Spider has been linked to approximately 120 network intrusions and received around $115,000,000 in ransom payments, according to the FBI.

The number of cyberattacks is increasing, and the impact of these attacks will continue to grow until both software developers and IT staff become better at evaluating software that their companies choose to buy or use remotely. This problem could even accelerate if neither party improves their skills.

Thomas stated that "we have been fortunate so far as cyber criminals' motivation has been disruption and financial gain." If they decide to cause serious injuries or deaths, the same strategy could be used against critical systems such as healthcare or major infrastructure.

Ransomware that is more dangerous and high-profile can be attributed to cybercriminals' desire for reputation in criminal circles. The larger the target, they have more influence with other hackers.

Pilling, a Sophos analyst, said that "a small but determined group of mostly Western cybercriminals is honing its skills and becoming more confident by their previous success and other's success."

Their motivation is not only financial, and committing a high impact breach will also give them social standing and credibility in their peer network.

(source: Reuters)