Ransomware Toolkit Discovered on South Africa’s Air Traffic Control Network

What happened

A ransomware toolkit was installed on at least one operational network that underpins South Africa’s air traffic control system. The discovery triggered a request for external cyber‑security assistance to contain and remediate the threat.

Why it matters for trust and compliance

• The event underscores why continuous control‑assurance and documented incident‑response processes are essential for safety‑critical infrastructure, providing defensible evidence for regulators and auditors.
• Map the ransomware incident to your incident‑response control objective and capture forensic evidence as audit‑ready documentation.
• Validate backup and recovery procedures to ensure rapid service restoration without regulatory penalties.

Who is affected

Recommended actions

1. Align the incident with your incident‑response and recovery controls; collect logs, forensic data, and remediation steps for audit readiness.
2. Test and verify backup/restore capabilities under realistic disruption scenarios.
3. Coordinate with national cyber‑response teams or vetted third‑party experts for containment and remediation.