Overview
On 14 June 2025, the ransomware group Handala publicly claimed responsibility for a major breach of Aerodreams, an aviation company reportedly linked to drone programs, elite pilot training, and covert logistics. The attackers claim to have exfiltrated 400 gigabytes of internal data, which they suggest may soon be leaked.
The incident highlights the increasing convergence of cybersecurity threats and national security implications within the aviation sector. Organisations handling sensitive defence-adjacent or dual-use technologies should treat this as a high-priority threat model.
What Happened?
On 14 June 2025, a post appeared on a dark web site operated by the Handala Hack Team, claiming responsibility for a cyberattack against Aerodreams — a company reportedly involved in sensitive drone programs, elite pilot training, and covert aviation logistics. The attackers allege they exfiltrated 400 gigabytes of internal data, which they intend to disseminate publicly.
The language of the claim suggests a double-extortion strategy, where sensitive data is first stolen and then leveraged to apply pressure through public exposure threats. The post also frames Aerodreams as a covert defence contractor, amplifying the perceived impact and intent behind the breach. While the full content of the stolen data remains unknown, references to “internal data in our hands” raise concerns about the potential inclusion of:
- Technical documentation linked to unmanned systems or avionics
- Pilot rosters or training records for elite or military-aligned crews
- Logistics plans or internal communications connected to covert operations
No encryption of systems has yet been confirmed, suggesting that the breach may have relied on stealthy data exfiltration rather than immediate ransomware deployment. The group is actively promoting links to Telegram channels for further disclosure, indicating that the leak campaign is still unfolding. This aligns with recent tactics used by ideologically motivated or geo-politically influenced cyber actors, who aim not only to extort but to destabilize or expose.
Why This Matters for Aviation
This is not just a corporate ransomware case. It’s a wake-up call for aviation and defence-adjacent industries:
- 400GB of data may include operational files, blueprints, identities, and confidential systems info
- The association with military training and drones introduces national security risk factors
- Public ransomware campaigns using Telegram for amplification make containment and reputation control harder
- The incident raises the bar for what “critical infrastructure cybersecurity” must look like — and how fast it must react
Whether or not Aerodreams operates in your ecosystem, the case should prompt immediate threat reassessment and reinforce regulatory compliance strategies under Part-IS.
Recommended Actions
A. Technical Mitigation
- Activate incident response playbooks for ransomware or nation-state attack scenarios
- Enhance network traffic monitoring, especially to/from known Handala-associated infrastructure
- Scan internal systems for indicators of compromise (IOCs) tied to recent ransomware and Telegram-based exfiltration campaigns
- Force credential rotation for any shared admin, pilot training, or engineering systems
B. Data and Supply Chain Protection
- Review and enforce Data Loss Prevention (DLP) rules on engineering and operations networks
- Encrypt sensitive archives, especially if linked to UAS or training systems
- Perform a supply chain cyber risk review to assess indirect exposure via contractors or shared systems with Aerodreams
C. Awareness and Escalation Readiness
- Issue an internal threat alert referencing the Handala/Aerodreams incident
- Train key departments (Ops, Engineering, IT, Flight Training) to recognize exfiltration attempts or phishing campaigns using leaked data
- Prepare draft external communication templates and escalation flowcharts in case of confirmed linkages
In Summary
This incident is not just a ransomware claim — it is a test of aviation cybersecurity maturity and resilience. The breach of Aerodreams underscores how cyber threats now target safety-critical infrastructure, with intent that goes far beyond financial gain.
For aviation and defence-linked entities, this is a critical moment to:
- Reassess threat scenarios
- Tighten data protection controls
- Elevate risk communication internally and externally
Whether or not your organisation is directly impacted, the attack serves as a live scenario for testing compliance, preparedness, and alignment with EASA Part-IS expectations.
