South Africa Air Traffic Body Finds Ransomware Malware

South Africa’s state air traffic operator has found ransomware-linked malware in systems that feed weather data to controllers. The case lands as a new survey shows how slowly South African victims recover.

The latest South Africa ransomware scare has reached aviation. Air Traffic and Navigation Services (ATNS), the state air traffic controller, is investigating malware found in its operational systems.

South Africa is the continent’s most industrialised economy and a hub for flights across southern Africa. ATNS manages roughly a tenth of the world’s airspace, according to the cybersecurity news site Dark Reading.

What ATNS disclosed

The details come from a request for quotes that ATNS issued on 18 September, seeking an outside digital forensics firm. Bids closed on 25 September.

“Monitoring systems detected suspicious activity within Operational Technology (OT) environments supporting weather-related services to Air Traffic Services,” the document said. Operational technology means the computers that run physical equipment rather than office work.

“Preliminary investigations identified malware commonly associated with the early stages of ransomware attacks,” ATNS added. Network monitoring also indicated “possible data exfiltration to external IP addresses located in China”.

The affected site is listed under the code FAPE, Chief Dawid Stuurman International Airport in Gqeberha, formerly Port Elizabeth. A separate allegation of insider data theft concerns FAMM, the code for Mahikeng (Mmabatho) airport in North West province.

What is known and what is not

ATNS said its internal teams had contained the threat and removed the malware. It still wants independent experts to establish the root cause, the extent of the compromise and any remaining risk.

The Sunday Times in Johannesburg first reported the probe on 26 September. Dark Reading and other specialist outlets followed on 30 September.

ATNS spokesperson Khulu Phasiwe told the Sunday Times only that the attack took place this financial year. “ATNS is currently unable to comment on the nature or extent of any potentially compromised data until the forensic investigation has been concluded,” he said.

No flight disruption has been reported, and no criminal group has been named. Traffic to IP addresses in China does not, on its own, show who was responsible.

Why weather systems matter for flights

Controllers and pilots depend on weather data for flight planning, visibility reports and runway decisions. If those feeds are locked or altered, airports may have to slow traffic or fall back on manual procedures.

According to the Sunday Times, a compromise could disrupt flight planning and links between weather providers and control towers. That is why the incident draws attention despite the reported containment.

What the new survey shows about South Africa ransomware costs

The ATNS case surfaced days after Sophos, a British cybersecurity company, presented its South African ransomware report on 18 September. It surveyed 135 local organisations hit in the previous year.

The median ransom demand fell 57 percent, from US$1 million in the 2025 report to US$427,000. The median payment fell 28 percent, to US$305,000.

Recovery remains expensive. Excluding any ransom, the average recovery cost was US$1.08 million, down from US$1.31 million a year earlier.

Speed is the weak point. Only 40 percent of South African victims recovered within a week, down from 47 percent. That was the lowest share of any country surveyed.

How attackers get in

Stolen or compromised login details were the most common technical cause, behind 27 percent of attacks. Exploited software flaws followed at 25 percent and malicious email at 22 percent.

Asked about internal weaknesses, 47 percent cited a lack of protection, the highest of any country in the survey. Another 43 percent cited too few staff, and 42 percent a known security gap.

There was progress on backups. Their use to restore encrypted data rose from 35 percent of victims to 54 percent.

Fewer organisations paid to get their data back: 58 percent, down from 71 percent a year earlier.

What it means for foreign businesses and travellers

For travellers, there is no sign of any operational impact on flights so far. The open question is whether the intrusion reached systems beyond weather services.

For foreign companies exposed to South Africa ransomware risk, the survey points to identity security and tested offline backups. Slow recovery, not the ransom itself, is where most of the damage lies.

The forensic findings will show whether state infrastructure has the same gaps that private firms report. ATNS says it will share information once the investigation is complete.

Frequently Asked Questions