Russia’s Flag Carrier Cancels Flights After Hack Attack

Russian flag carrier Aeroflot canceled dozens of flights on Monday as a hacking group claimed credit for disrupting its IT systems.

The majority state-owned carrier said Monday the disruptions traced to an IT infrastructure failure. The Office of the Prosecutor General of Russia attributed the disruption to hackers and said it initiated a criminal investigation.

Belarusian hacktivist group Silent Crow claimed to have “completely compromised and destroyed” the airline’s IT infrastructure. Hackers said they worked with long-established Belarusian hacktivist group Cyber Partisans to wipe about 7,000 physical and virtual servers, amounting to over 22 terabytes of email, shared files and databases.

The hackers’ claims couldn’t be independently verified.

By midday local time on Monday, Aeroflot said it was forced to cancel 47 flights out of the 123 scheduled to fly to or from Moscow’s Sheremetyevo International Airport. Despite Western sanctions imposed over Moscow’s war of conquest against Ukraine, air travel in Russia has remained robust. Parent company Aeroflot Group, which includes Rossiya Airlines and budget airline Pobeda, last year carried 55.3 million passengers, accounting for 42% of the country’s market share, it said. The airline ranks as one of the world’s top 20, based on the volume of passengers carried.

Silent Crow said they first gained access to the airline’s network one year ago and expanded that access to touch its SharePoint, Exchange, customer relationship management, ERP and other systems. The hackers also claimed to have stolen extensive amounts of data on the airline’s customers and said they planned to leak the information.

“We gained access to 122 hypervisors, 43 virtualization installations of zVirt, about a hundred iLO interfaces for server management and 4 Proxmox clusters,” they said. “As a result of the actions, about 7,000 servers – both physical and virtual – were destroyed. The volume of obtained information includes 12 TB of databases, 8 TB of files from Windows Share and 2 TB of corporate mail.”

“Glory to Ukraine! Long live Belarus!” the group posted. “The personal data of all Russians who have ever flown with Aeroflot have now also gone on a journey – though without luggage and one-way.”

Russians seeking to travel by air have grown accustomed to intermittent disruptions, often due to Ukraine targeting the country’s airspace with drones as part of Kyiv’s effort to bring the war home to everyday Russians. One heavy wave of attacks earlier this month forced Russian airlines to cancel 485 flights and delay 1,900 more, leading to billions of rubles in additional costs, Russia’s federal air transportation agency said.

Belarusian Hacktivist Hits

Silent Crow has previously hit Russian targets, including major telecommunications provider Rostelecom. In January, the telecom told Russian state-owned news agency Tass that hackers appeared to have leaked over 154,000 customers’ email addresses and 101,000 phone numbers.

Its first claimed attack was against Rosreestr, Russia’s official cadastre and cartography agency. It claimed in January to have stolen tens of thousands of records with personal details including the Russian equivalent of U.S. Social Security numbers. Russian media reported at the time that the agency was investigating the matter.

The group appears to be a rebrand of an earlier hacking group active since mid-2022 that went by “DumpForums,” according to Russian cybersecurity firm Bi.zone. DumpForums targeted Russian government agencies and hosted a forum of the same name, the firm said, which tracks DumpForums as “Phoenix Hyena.”

Cyber Partisans is a Belarusian hacktivist group that first appeared in September 2020, in the wake of incumbent authoritarian leader Alyaksandr Lukashenka claiming to have been reelected after winning over 80% of the vote. The United States, the European Union and other governments rejected the election results.

Cyber Partisans has since launched a number of attacks aimed at the authoritarian regimes in both Belarus and Russia. These included disrupting railway services in Belarus in late February 2022 to slow the deployment of Russian troops (see: Cyber Standoff: 51 Groups Tied to Russia-Ukraine War Attacks).

In a technical report released last month, Moscow-based cybersecurity firm Kaspersky detailed some of the group’s tactics, including its use of phishing attacks to gain initial access. The group has also used a never-before-seen backdoor, dubbed Vasilek, that instead of communicating with a command-and-control server “uses a Telegram group to send collected data and receive commands, which may have helped the group evade detection,” together with various network tunneling and proxying tactics, it said.

Cyber Partisans has been tied to multiple incidents involving wiper malware, nicknamed Pryanik.

“Since November 2021, the group has used the so-called ‘bomb’ technique in attacks on industrial enterprises for the first time – malware pre-installed in the system that is automatically activated according to specified parameters, for example, at a certain time,” Kaspersky said.

The wiper appears to have been used against multiple targets, including a Belarus fertilizer production plant in April 2024, where the attackers claim to have stopped a boiler room from operating but to have purposefully not gone any further into the target’s operational technology environment, which the attackers said “could have led to serious physical consequences or even to the emergence of an emergency situation.”