Operation Layover: How we tracked an attack on the aviation industry to five years of compromise
Summary: Cisco Talos traced a RAT discovered in an aviation-industry attack back to an actor it assesses with high confidence is based in Nigeria and has been active for at least five years, using off-the-shelf malware and purchased crypters rather than its own tooling. The actor has targeted aviation since at least 2018, using emails with an attached PDF that linked to a .vbs file hosted on Google Drive to deliver AsyncRAT and njRAT, and the domain akconsult[.]linkpc[.]net was first seen on July 2, 2015.
Bottom line: Talos notes that actors running smaller attacks can keep doing them for years under the radar, and that these are the actors feeding the underground market of credentials and cookies later used by larger groups in 'big game hunting' - so a low-sophistication intrusion at your organization may be the first stage of someone else's major incident.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026