RTX Confirms Airport Services Hit by Ransomware

"The company said in an SEC filing that it became aware of the cybersecurity incident on September 19. The disclosure does not mention Collins Aerospace, the subsidiary that offers the impacted airport check-in and boarding solutions. RTX confirmed that customers have resorted to backup and manual processes, which has led to flights being delayed and cancelled. The company explained that ransomware was found on "systems that support its Multi-User System Environment (MUSE) passenger processing software," adding, "This software enables multiple airlines to share check-in and gate resources at airports, including baggage handling."

"RTX has not mentioned anything about personal or other types of data being stolen in the attack. The company says its investigation into the incident and its impact is ongoing, but does not expect it to have a material impact on its financial condition and operations. It appears that impacted European airports are experiencing delays due to the incident. It has been reported that the vendor has been having difficulties removing the ransomware from its systems, which have become reinfected following cleanup attempts."

"It's worth noting that major companies don't often specifically confirm being targeted in a ransomware attack and instead their SEC filings typically describe a more generic 'cyber incident'. Two cybersecurity experts, Kevin Beaumont and Dominic Alvieri, have independently confirmed that the attack involved an obscure piece of ransomware called HardBit. HardBit emerged in October 2022. Cybercriminals are using the ransomware to encrypt files on compromised s"

RTX became aware of a cybersecurity incident on September 19 that has disrupted airport services. The ransomware impacted systems that support the Multi-User System Environment (MUSE) passenger processing software used to share check-in, gate and baggage handling resources. Customers have reverted to backup and manual procedures, prompting flight delays and cancellations at affected airports. RTX reported no confirmed theft of personal data and said the investigation is ongoing, with no expected material financial impact. Some European airports continue to face delays, and cleanup attempts reportedly led to reinfections. Experts identified the malware as HardBit.

Read at SecurityWeek