The recent cyber attack on SITA, an air travel solutions software company and a few airlines which includes Air India have been linked to the Chinese state-sponsored threat actor APT41.
Airlines have been warned to search their networks and find out the campaign that may be hidden within their networks. SITA provides solutions to almost 90% of the world’s airline industry.
According to a report by Group-IB analyst Nikita Rostovcev, "After Air India, it was evident the world’s national carriers are dealing with one of the biggest supply-chain attacks in the airline’s history. SITA’s data breach is estimated to have revealed data of 4.5 million passengers."
As per the reports, though the Air India attack was for just 4 days short of 3 months but the threat actors took only 24 hours and 5 minutes to spread Cobalt Strike beacons to the other devices in the airline’s network. SITA is responsible for processing Air India’s personal customer data. The hacked data was put for sale on a leak site for $3,000.
The Group-IB report further said, "The campaign’s code name is ColunmTK. It was formed by combining the first two domains used for DNS tunneling in the attack. "
The ColunmTK campaign committed by APT41 is also known as Wicked Panda, Wicked Spider, Winnti, and Barium. Active since 2007 APT41 is known for supply-chain attacks, cyber espionage, and financial cybercrimes.
The breach of data that happened at Air India involves personal data of customers which included name, date of birth, contact information, passport information, ticket information, Star Alliance and Air India frequent flyer data, and credit card information.
Security-related information such as passwords or CVV numbers of the customers however was not stolen as SITA was not in charge of the same.
SITA post disclosure of the cyberattack revealed Star Alliance and One World airlines were also attacked apart from Finnair, Japan Airlines, Jeju Air, Lufthansa, Malaysia Airlines, Air New Zealand, Cathay Pacific, Singapore Airlines, among others.
