What are cyber threats?

A cyber threat refers to the ability and intent of actors to manipulate, disrupt, or exploit digital systems, data, or processes. This involves exploiting existing weaknesses and vulnerabilities. In the context of civil aviation, relevant threats are those that target the digital systems of aircraft, airports, or air traffic control.

​

Why is civil aviation an attractive target?

Due to its highly interconnected and complex systems—ranging from the onboard electronics of modern aircrafts to smart airports and navigation and communication networks—civil aviation presents a particularly large target for cyberattacks. These attacks can have significant consequences, such as disruptions to international travel, economic damage, or public anxiety. At the same time, aviation has always held great significance for the state and society due to its visibility and symbolic power. Furthermore, it is considered an attractive target by perpetrators because the risk of detection in the digital realm is comparatively low.

​

What are the current cyber threats to civil aviation?

Ransomware and other attacks on IT systems threaten the technical infrastructure of airlines, airports, and air traffic control services and can paralyze critical operational processes. Navigation and air traffic control systems are also increasingly targeted by GPS jamming and spoofing, which can impair aircraft positioning and destabilize air traffic. At the same time, hacktivists and criminal groups are relying on DDoS attacks to overload airports or public services, thereby causing visible disruptions. Additionally, espionage and data leaks are gaining significance, as sensitive information regarding personnel, technology, or processes provides attackers with valuable insights and opens new opportunities for other kinds of attack.​

​

Focus International – The Landscape of Cyber Threat ActorsThese actors operate on a global scale, are becoming increasingly professional, and might even be interconnected. Due to its high level of connectivity, its importance to security, and its strong symbolic significance, civil aviation remains one of the most attractive targets worldwide.​

​

1. State-directed and state-sponsored cyber actors

   • Includes actors from China, North Korea, Russia, and Iran, in particular, who use digital means to exert political influence, conduct strategic operations, and carry out disruptive activities against critical infrastructure..

   • These groups have significant resources, use sophisticated attack tools, and pursue long-term geopolitical goals.

2. Politically motivated hacktivists

   • Carry out high-profile actions, often in response to international conflicts—such as the tampering with public address announcements at airports in the US and Canada in connection with the Gaza conflict.

   • Their primary goal is to exert symbolic pressure, cause disruption, and generate media attention.

3. Financially motivated cybercriminals
   • Use ransomware to encrypt critical systems or steal and sell sensitive passenger data on the black market.
   • The aviation industry is particularly attractive because even brief service disruptions can result in high costs, thereby making extortion attempts more effective.

4. Espionage groups and intelligence services

   • Gather specific information about aviation IT systems, processes, personnel, or security architectures to gain strategic advantages or operational access.

   • They often operate covertly and long term, laying the groundwork for future operations or political influence.

 

 

Is Switzerland a focus for these various actors?

Switzerland is also a focus for all relevant cyber actors: state-sponsored or state-backed actors—particularly from Russia and China—are specifically targeting Swiss government agencies, international organizations, and critical infrastructure, including the aviation sector. Politically motivated hacktivists are causing high-profile disruptions worldwide and could also target Switzerland due to the high visibility of its air traffic. Attacks by financially motivated cybercriminals have a proven track record of high incident rates in Switzerland, including over 64,000 reported incidents in 2025 and 222 attacks on critical infrastructure between April and December 2025 (Source: NCSC Annual Report 2025). Furthermore, due to its international significance, Switzerland remains a focal point for espionage groups and intelligence services seeking access to sensitive information via cyber means. As a result, Switzerland—and thus its aviation sector—is part of an interconnected and complex global threat landscape.