Ransomware and Data Extortion Groups Intensify Targeting of Aviation and Aerospace Sector

The aviation and aerospace sector experienced concentrated cyber activity in 2025–2026, with confirmed ransomware disruptions (notably the Collins Aerospace MUSE outage) and a Tulsa Airports data exposure linked to Qilin; analysts also report identity-based intrusions by Scattered Spider, continued targeting by LockBit and Cl0p, and emerging GNSS/satellite interference risks. The report recommends prioritizing shared-platform resilience, stronger identity verification and anti-social-engineering controls, vendor security assessments, and planning for GNSS-related operational impacts.