Russian Airline Suffered Cyberattack Website and Other Systems Affected

Krasnoyarsk Regional Airlines (KrasAvia) confirmed a sophisticated cyberattack that has rendered its primary online services inoperable. 

The breach targeted the airline’s web portal and associated back-end systems, including the Passenger Service System (PSS) and flight planning applications. 

As a result, passengers are currently unable to complete e-ticket purchases or check in online, prompting KrasAvia to revert to manual processes for flight assignments, crew scheduling, and ground handling.

According to the airline’s press service, the incident was first detected at approximately 08:00 MSK, when automated alerts from the network intrusion detection system (IDS) indicated anomalous traffic patterns consistent with a distributed denial-of-service (DDoS) attack combined with unauthorized access attempts. 

Subsequent analysis revealed malicious payloads, possibly leveraging a zero-day exploit to bypass perimeter firewalls and deploy a custom malware strain within the corporate network. 

KrasAvia immediately activated its incident response plan, isolating affected servers and engaging an external digital forensics team to conduct a root cause analysis.

Passengers have been advised to contact the airline’s call centers or visit offline ticketing agencies to arrange travel. 

“We are currently doing everything possible to avoid and minimize the consequences,” stated the airline. 

“All flights have been switched to manual flight and flight management. Unfortunately, tickets are no longer available online. People are contacting us, and we are redirecting them to offline agencies.”

KrasAvia Website Down

With the KrasAvia website down and no clear timeline for restoration, a crisis communication channel via Telegram has emerged as the only interim information source, according to reports.

The Borus Telegram channel initially published a screenshot of the compromised homepage before it was promptly removed. 

KrasAvia has declined to comment on the extent of data exfiltration but confirmed that an internal audit is in progress, coordinated with Russia’s Federal Service for Supervision of Communications (Roskomnadzor) and the National Computer Incident Response Team (CERT-RU).

This incident bears striking similarities to the high-profile attack on Aeroflot earlier this summer, which exploited vulnerabilities in third-party software to disrupt flight operations and ground control systems. 

In that case, Aeroflot’s security operations center (SOC) detected lateral movement by threat actors using remote access trojans (RATs) before containing the breach. 

Industry experts warn that airlines remain a prime target due to their reliance on interconnected IT and operational technology (OT) systems, often with outdated infrastructure that lacks robust security controls, such as multi-factor authentication (MFA) and real-time endpoint detection and response (EDR).

KrasAvia assures passengers that safety remains uncompromised and that flight crews continue standard operating procedures (SOPs) for secure communications. 

Updates regarding system recovery and ticketing resumption will be posted on the airline’s social media accounts and official press releases. 

As the investigation continues, the broader aviation sector watches closely, recognizing that enhanced threat intelligence sharing and hardened cybersecurity defenses are critical to mitigating future disruptions.

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.