Monumental Supply-Chain Attack on Airlines Traced to State Actor

[silversurfer]

A monster cyberattack on SITA, a global IT provider for 90 percent of the world’s airline industry, is slowly unfurling to reveal the largest supply-chain attack on the airline industry in history.

The enormous data breach, estimated to have already impacted 4.5 million passengers, has potentially been traced back to the Chinese state-sponsored threat actor APT41, and analysts are warning airlines to hunt down any traces of the campaign concealed within their networks.

SITA announced the attack in March, and soon after Singapore and Malaysia Airlines were the first airlines to disclose that their customers’ personal data had been exposed. Most recently, SITA’s customer Air India reported an attack on its systems.
 
“After Air India revealed the details of its security breach, it became clear that the carriers were most likely dealing with one of the biggest supply-chain attacks in the airline industry’s history,” Group-IB analyst Nikita Rostovcev said in a recent report about the discovery.

The campaign’s code name is ColunmTK, the Group-IB report said, which researchers came up with by combining the first two domains used for DNS tunneling in the attack: ns2[.]colunm[.]tk and ns1[.]colunm[.]tk.

Read more: Monumental Supply-Chain Attack on Airlines Traced to State Actor | Threatpost