Aeroflot Cyberattack: Hackers Claim Total Infrastructure Destruction

Photo: ec.europa.eu

Hacker groups Silent Crow and Cyberpartisans BY have claimed responsibility for a massive cyberattack on the digital infrastructure of Russian airline Aeroflot, according to Kommersant. The airline confirmed IT system failures that led to dozens of flight delays and cancellations but did not disclose the exact cause.

Silent Crow claims it spent a year inside Aeroflot's corporate network and ultimately destroyed approximately 7,000 physical and virtual servers. The group allegedly accessed all key company systems, including flight history databases, executive workstations, surveillance footage, and internal control servers. According to News.ru, attackers also had control over hypervisors, VM platforms, Proxmox clusters, and internal server interfaces.

The group claims to have obtained 12 TB of data. In a Telegram post, Silent Crow stated:
"All these resources are now inaccessible or destroyed. Recovery may cost tens of millions of dollars. The damage is strategic."

Aeroflot acknowledged a system disruption and announced forced schedule adjustments, including flight cancellations and delays. Passengers were advised to monitor airport displays and PA announcements.
"Our technical team is working to minimize operational disruptions and restore services. We apologize for the inconvenience," the airline said.

According to RIA Novosti, 42 flights were cancelled in Moscow on July 28, including routes to:

Astrakhan, Grozny, Yekaterinburg, Yerevan, Kazan, Kaliningrad, Krasnoyarsk, Makhachkala, Mineralnye Vody, Minsk, Murmansk, Omsk, Orenburg, Orsk, Samara, Perm, Sochi, St. Petersburg, Stavropol, Tyumen, Ufa, Chelyabinsk, Kirovsk, Elista, and Astana.

Flights from these cities to Moscow were also canceled. Passengers were advised to retrieve baggage or rebook within 10 days, although ticket offices at Sheremetyevo were temporarily unable to assist. Crowds formed in terminals, with reports of long waits and limited information. Reuters noted that some travelers left despite already checked-in baggage. Moscow's transport prosecutor has launched an investigation.

Disruptions at Russian airports have occurred before due to Ukrainian drone attacks. Aeroflot had previously reported changes in schedules for the same reason, as did other carriers, RBC reported. On the night of July 28, drones were active in the Rostov, Orel, Bryansk, and Kaluga regions, Ura.ru stated. A day earlier, a drone attack disrupted operations at St. Petersburg’s Pulkovo Airport, where 21 departing and 76 arriving flights were delayed. Destinations affected included Moscow, Sochi, Kazan, Samara, Yerevan, Baku, Antalya, Tbilisi, and others. Flights to Shymkent and Enfidha were canceled.

The Aeroflot situation highlights the growing instability of Russian air travel. In addition to technical failures, drone attacks are straining airport operations. For thousands of passengers, flying has become a lottery—cancellations, delays, lack of information, and rebooking problems are the norm. Cyber vulnerability is no longer theoretical—it directly affects travel logistics.