# Resecurity Is Accelerating Cybersecurity in Aviation Sector

- Link: https://www.military.africa/2025/02/resecurity-is-accelerating-cybersecurity-in-aviation-sector/
- Published: 2025-02-06T18:57:48+01:00
- Author: Military Africa

[Resecurity](https://www.resecurity.com/), a California-based cybersecurity and 
intelligence provider protecting Fortune 100 companies and government agencies, 
is offering a specialized service for the aviation sector, which is facing increasing
malicious activity.

The corporation, headquartered in Los Angeles, has released a cutting-edge [Cyber Fusion Center](https://www.resecurity.com/cyber-fusion)
that features industry-specific threat intelligence feeds, enabling aviation organizations
to protect themselves from targeted cyber attacks and fraudulent activity.

ADVERTISEMENT

The product release comes at a timely moment due to the increasing number of hacking
attacks and data breaches reported in Q4 2024 – Q1 2025, which are targeting international
aviation organizations.

[The International Civil Aviation Organization (ICAO)](https://www.icao.int/Pages/default.aspx),
a specialized agency of the United Nations is investigating a significant data breach
that has raised concerns about the security of its systems and employees’ data. 
In the updated [statement ](https://www.icao.int/Newsroom/Pages/ICAO-statement-on-reported-security-incident.aspx)
published by ICAO, the agency said it is “actively investigating reports of a potential
information security incident allegedly linked to a threat actor known for targeting
international organizations.”

This comes after an individual claimed in a January 5 post on a popular hacking 
forum to have accessed 42,000 documents from ICAO, including personal information(
PII). From this perspective, the actors were interested not in disrupting specific
IT/OT processes, but in acquiring targeted intelligence about specific individuals
and their digital identity information.

ADVERTISEMENT

Such tactics are pertinent to traditional espionage and human intelligence (HUMINT),
where cyberspace is a key channel for obtaining interest data. After completing 
a careful review of the data, ICAO confirmed that 11,929 individuals were affected.
The compromised data includes recruitment-related information that applicants entered
into the compromised system, such as names, email addresses, dates of birth, and
employment history.

Shortly after the ICAO incident, Resecurity [identified ](https://www.resecurity.com/blog/article/icao-and-acao-breached-cyberespionage-groups-targeting-aviation-safety-specialists)
threat actors targeting the [ACAO (Arab Civil Aviation Organization)](https://acao.org.ma/).
As a result of a successful SQL injection exploitation in a vulnerable web application,
records of staff/members and their credentials were exfiltrated.

Multiple victims identified in the stolen data set included Safety Aviation Specialists
and Incident Investigators. Such experts have first-hand knowledge from the field
and may be involved in sensitive communications.

Traditional cybercriminal actors would not be interested in it due to the relatively
low probability of monetization for profit via Dark Web markets, besides the opportunity
to sell it to state-sponsored actors looking for specific targets of interest.

Considering the tight timing of the recently disclosed ICAO incident, such a trend
of targeting (international aviation organizations) is concerning.

Resecurity has notified the affected agency and shared the acquired data dump, which
resulted from threat actors’ investigation. The data breach has not been previously
disclosed.

ADVERTISEMENT

While specific details about the nature of the leaked data and the extent of the
breach remain unclear, the incident highlights ongoing vulnerabilities within aviation
organizations. The observed data set includes logins (usernames), hashes of passwords,
emails, titles, and communications.

Similar to the ICAO incident, the data has been leaked via one of the popular Dark
Web communities on February 4, 2024. The leaked data set identified representatives
of the Qatar Aircraft Accident and Incident Investigation Unit (QAAI), the Aviation
Investigation Bureau (AIB) of the Kingdom of Saudi Arabia, the Iran Civil Aviation
Authority, the Jordan Civil Aviation Regulatory Commission (CARC), and various members
of the Aviation Accident Investigation Division (AAID).

Notably, last year was extremely challenging due to the number of significant aviation
incidents, some of which triggered a complicated geopolitical narrative based on
the circumstances and the root cause investigation. The correlation with the newly
disclosed malicious cyber activity targeting aviation safety experts at the beginning
of Q1 2025 creates a precedent. It requires increased attention to protecting critical
infrastructure and relevant organizations.

### _Related_