Flights across Russia came to a standstill on Monday after a major cyberattack hit Aeroflot, the country’s largest airline. The incident has forced the cancellation of over 60 flights and brought critical systems offline, in what appears to be one of the most damaging airline hacks in recent Russian history.
According to a report by TechCrunch, the pro-Ukrainian hacker collective known as Silent Crow, in collaboration with Belarusian actors, claimed responsibility. In a Telegram post, the group stated they had seized control of Aeroflot’s internal infrastructure, including terabytes of data, before “destroying everything we touched.”
National Outages, Widespread Cancellations
By midday Monday, Aeroflot’s entire digital ecosystem was reportedly rendered inoperable. This included its flight scheduling software, passenger check-in systems, internal directories, and booking portals. Aeroflot’s public website was also offline, showing only a generic message that access had been “temporarily restricted.”
Footage shared on social media from Sheremetyevo International Airport showed departure boards filled with “CANCELLED” notices across multiple destinations. Long queues of passengers stood waiting with no information or assistance available.
Russian prosecutors confirmed the cyberattack in a statement carried by state media outlet RIA Novosti, calling it a “sophisticated breach of national transportation infrastructure.” Officials added that the Federal Security Service (FSB) is leading the investigation.
Who Is Silent Crow?
Silent Crow is a relatively new but increasingly visible hacktivist group. Their Telegram channel, launched in late 2024, has taken credit for previous cyber operations against Russian government institutions, including a breach of Rosreestr, the country’s real estate registry, earlier this year. The group’s stated goal is to destabilize the Russian regime’s infrastructure in retaliation for the ongoing invasion of Ukraine.
In their message regarding Aeroflot, Silent Crow said the airline “played a vital logistical role in the regime’s movement of troops and equipment.” They framed the attack as part of a broader “digital insurgency” aimed at undermining state capacity without harming civilians.
Screenshots shared by the group show what appear to be login panels, employee records, and system access maps suggesting deep penetration into Aeroflot’s backend systems. While TechCrunch could not independently verify the images, cybersecurity researchers cited by CyberScoop said they appeared credible based on past attack signatures.
Expert Reactions: ‘Highly Targeted and Devastating’
Cybersecurity experts have warned that the Aeroflot breach may become a case study in state-aligned cyber warfare. If true, the fact that hackers claim to have “destroyed” rather than simply copied data raises additional concerns.
The breach has reignited conversations about the vulnerability of critical infrastructure in wartime conditions. Russia has invested heavily in digital defenses over the last decade, but many of its older systems especially in state-controlled firms like Aeroflot remain susceptible to coordinated attacks.
Potential Fallout for Russian Aviation
Aeroflot is one of Russia’s national symbols and a major economic player, with over 50 million passengers served in 2024 alone. The airline also coordinates regional routes that are vital for connecting remote areas, especially in Siberia and the Far East.
Analysts expect that restoring operations could take days or even weeks, depending on whether system backups were also compromised. If data destruction is confirmed, Aeroflot may face long-term operational and reputational damage.
“This may go down as one of the most paralyzing cyber incidents ever to hit a national airline,” said Andrey Zakharov, a Russian journalist who has covered cybercrime and technology policy. “And in the middle of peak travel season, the impact is multiplied.”
Government Response and Security Measures
While the Kremlin has not issued an official statement as of publication, Russian state media have downplayed the incident, referring only to a “technical failure.” However, multiple reports suggest that President Vladimir Putin was briefed on the hack early Monday morning and ordered the Ministry of Digital Development to coordinate with the FSB on containment.
Meanwhile, Reuters reports that Russian airspace authorities have restricted new flight authorizations for other carriers while the issue is investigated, citing fears of systemic compromise.
Some IT experts are urging Russian companies to accelerate the migration away from legacy systems. “If Aeroflot can fall, so can Gazprom, so can Transneft,” said cybersecurity consultant Denis Matveev. “We are looking at the real consequences of digital complacency.”
International Reaction
While Western governments have not officially commented on the breach, aviation regulators in the EU and the U.S. are reportedly reviewing data-sharing arrangements with Aeroflot and other Russian aviation entities.
Some cybersecurity experts believe the attack may escalate tensions between NATO-aligned countries and Russia in cyberspace. “This is digital sabotage with geopolitical undertones,” said one Western cyber-policy analyst tracking the incident. “It will raise questions about offensive cyber norms and rules of engagement.”
As of Tuesday morning, Aeroflot’s website remains offline, and most flights are still grounded. Silent Crow has not posted additional statements, and no ransom demands or negotiations have been confirmed. Russia’s response over the next 48 hours may determine whether this attack remains a technical crisis or becomes a political flashpoint in the digital theatre of modern warfare.
Comments