Ransomware Hits Air Traffic Control in Africa

Air Traffic and Navigation Services (ATNS), the South African state company that manages air traffic and weather operations across roughly 10% of the world's airspace, has discovered malware linked to ransomware on an operational technology (OT) network — the specialised systems that control physical infrastructure rather than standard office IT, according to Dark Reading.

ATNS says its internal teams detected suspicious activity in systems supporting weather services for air traffic control and moved quickly to contain it. Preliminary analysis found malware consistent with the early stages of a ransomware attack, along with signs of data exfiltration (files being copied and sent out) to external IP addresses based in China.

Two incidents at two separate facilities are now under investigation. The OT compromise occurred at Port Elizabeth Airport in South Africa (FAPE). A second, distinct incident — possibly an insider theft of data — took place at Maputo International Airport in Mozambique (FAMM). These are geographically separate events at separate airports in two different countries. A third site, East London Airport in South Africa, may also have been caught up in the OT incident, though the documentation is unclear on that point.

ATNS is now seeking outside cyber-forensics firms to investigate, having publicly issued a request for quotes on 18 September. The company believes the attack was stopped before any disruption to flights occurred.

This is part of a broader trend. Ransomware attacks against aviation targets increased sixfold in 2025, according to aviation firm Thales.

What to do: If you work in or near critical infrastructure and receive unexpected prompts to open files or change credentials, escalate it immediately — do not assume it is routine.

Researchers at ThreatDown have identified a new botnet called Carbonato, according to Dark Reading. Docker is software that lets developers run applications inside isolated containers on a server. Carbonato targets Docker installations where the remote management port (2375) has been left open and unprotected — something Docker explicitly advises against.

Once inside, the botnet installs an AI agent that takes instructions from an attacker-controlled Telegram chat, hunts for AI API keys (credentials that allow access to paid AI services), and then spreads to neighbouring servers doing the same thing. The agent is built on an open source framework, meaning the attacker assembled this from publicly available parts.

The fix is straightforward: if you manage any servers running Docker, verify that port 2375 is not exposed to the internet.

What Fireware OS is: The operating system that runs WatchGuard Firebox network security appliances, which organisations use to protect their networks from unauthorised access.

What it is: A code injection flaw in how Fireware OS handles BOVPN over TLS client configurations. BOVPN (Branch Office VPN) is a feature that creates encrypted tunnels between office locations. An attacker who controls the remote VPN server can push malicious instructions through that tunnel.

Who's at risk: Any organisation using a WatchGuard Firebox appliance configured to connect to a BOVPN over TLS server. If the remote server is compromised or attacker-controlled, your appliance is exposed.

CVSS: 9.2 (Critical — patch today.)

Root cause: The OS fails to sanitise input received from the remote VPN server during connection setup. Because that input is trusted and passed into system commands without validation, a malicious server can inject arbitrary commands. The appliance effectively executes whatever the remote end tells it to.

Attack vector: An attacker positions themselves as — or compromises — the remote VPN server your Firebox connects to. During the TLS handshake, the attacker sends crafted configuration data containing embedded commands. The Firebox processes this input without checking it, and those commands run with root privileges — full administrative control of the device.

Detection strategies: Check Fireware OS system logs for unexpected command execution or configuration changes following VPN tunnel establishment. Look for outbound connections to unfamiliar IP addresses initiated by the Firebox itself. Monitor for new administrative accounts or changed credentials on the appliance.

Recommended actions:

1. Update Fireware OS to version 2026.3.2, 2026.2.3, 12.12.3, or 12.5.21 immediately.
2. Audit all BOVPN over TLS remote server configurations and confirm each endpoint is trusted and controlled by your organisation.
3. Restrict management access to the Firebox to known, internal IP ranges only.

Every secure website uses a digital certificate — a credential issued by a Certificate Authority (CA) that tells your browser the site is legitimate and that your connection is encrypted. Cloudflare has announced it is launching a public CA, free for any website, that will support both current encryption and next-generation post-quantum security standards, according to Dark Reading.

If you run a website, this means free, automatically renewed certificates hardened against future quantum computing threats — with no technical rebuild required. For everyday readers, the practical benefit is more websites maintaining valid, up-to-date certificates, which means fewer "your connection is not secure" warnings caused by expired credentials.

Keep an eye on Cloudflare's CA announcement for availability updates.

President Trump and the CEOs of Anthropic, Google, Meta, OpenAI, Nvidia, and xAI signed a voluntary agreement pledging internal controls, independent external audits, and board-level oversight of AI safety, according to SecurityWeek. The accord is described as "morally binding" but carries no legal enforcement mechanism. Critics note that several commitments are steps the companies had already announced. The agreement leaves the door open to future legislation.