The Weather Server Did It: ATNS and the Secondary Systems That Sink You
Air Traffic and Navigation Services (ATNS) manages 10% of the world’s airspace, according to MyBroadband’s report of 2 October 2026 ; TimesLive puts the figure at more than 6%. MyBroadband also reports that preliminary investigations found malware “commonly associated with the early stages of ransomware attacks” in the operational technology (OT) environment at Chief Dawid Stuurman International Airport.
Facts as publicly reported at 2 October 2026; the investigation is ongoing and details may change. The reporting names a weather support system as the affected system. It does not establish that system as the origin, and it does not state how access was gained. Avi-Go reports the tender documents are unclear on whether East London Airport was also affected.
Most organisations run secondary systems: a building management system (BMS) PC, a network video recorder (NVR), a print server, a vendor-managed appliance. In practice, many of them never reach the asset register, and each sits on a network that matters.
What the public record says
MyBroadband reported that ATNS says its technical teams contained and removed the infection, and that a comprehensive forensic investigation is still required. The same report says network monitoring indicated possible data exfiltration to external IP addresses located in China.
The sources reviewed for this post do not describe ATNS’s inventory, ownership or segmentation. Nothing here judges how ATNS ran its network. The control questions below apply to any organisation.
Why secondary systems escape the register
In many organisations, facilities, security or a vendor buys these systems, and IT hears about them after installation. They often arrive with default credentials, a vendor remote-support tool and a patch cadence nobody owns. They are often placed on the flat corporate LAN because that was the quickest way to make them work.
The configuration management database (CMDB) often misses them, so no review covers them. Nobody is paged when one misbehaves, and its logs frequently go nowhere. On a flat network, an attacker who lands on such a device inherits the trust the network already extends to that address.
In our analysis of Your Vendor’s Breach Is Your POPIA Problem: Third-Party Risk in SA’s Breach Wave , the same problem sits one level up: a compromised supplier and the POPIA liability that follows.
Inventory and ownership
ISO/IEC 27001:2022 Annex A control A.5.9, Inventory of information and other associated assets, requires an inventory with owners. For second-tier systems that means every BMS PC, NVR, print server and vendor appliance has an entry and a named person accountable for it. Record four fields per device: owner, vendor contact, network zone and support end date.
Discovery can start in an afternoon. Pull the switch ARP tables and DHCP leases, compare them with the register, walk the plant room with a facilities lead, and read vendor invoices for anything with a network port. Every unmatched address needs an owner or a retirement date.
Segmentation by zone
Place each class of second-tier system in its own zone with its own VLAN. Enforce the boundary with firewall policy and VLAN access control lists. A.8.20, Networks security, covers managing and controlling network devices. A.8.21, Security of network services, covers the security mechanisms and service levels for network services, including those a provider supplies such as managed links.
Zones for second-tier systems
+-------------------------------------------------------------------+
| CORE ZONE: identity, finance, file, line-of-business |
+--------------------------------+----------------------------------+
^
deny by default, named rules only
|
+--------------------------------+----------------------------------+
| JUMP / BROKER ZONE: logged, time-boxed vendor and admin sessions |
+--------+------------------+------------------+--------------------+
| | |
v v v
+----------------+ +----------------+ +---------------------------+
| FACILITIES | | SECURITY | | OFFICE EDGE |
| BMS PCs | | CCTV NVRs | | print servers, vendor |
| HVAC, lifts | | access control | | appliances |
+----------------+ +----------------+ +---------------------------+
Each zone: named owner, inventory entry, own VLAN, egress allow-list
Operations-critical OT, such as the weather systems in the ATNS reporting, warrants a zone of its own, designed to the IEC 62443 zones-and-conduits model. Deny traffic from every second-tier zone to identity and finance systems, except named flows such as DNS, time and log forwarding, each recorded with an owner. Route vendor remote access through the broker zone, logged and time-boxed. Vendor support keeps working only if the brokered path is agreed with the vendor in writing, which by analogy follows A.5.20, Addressing information security within supplier agreements.
Watch what leaves
According to MyBroadband, network monitoring indicated the possible exfiltration. That detail supports a plain control: a device with a narrow job has a narrow set of outbound destinations. A.8.16, Monitoring activities, expects networks, systems and applications to be monitored for anomalous behaviour.
Baseline each second-tier zone for two weeks first, so backup jobs and vulnerability scanners do not flood the alerts. Then allow-list outbound destinations per zone and alert on any new external IP address or volume spike. New east-west flows deserve an alert too, since they can indicate lateral movement. In our analysis of The Breach a Journalist Had to Report: What Gauteng’s e-Panic Button Teaches Us About Section 22 , a third party told an organisation about its own exposure. Egress alerting lets your team find it first.
When the vendor owns the box
BleepingComputer reported on 30 September 2026 that Cisco warned of active exploitation of CVE-2026-76504 in Catalyst SD-WAN Manager, the fifth actively exploited SD-WAN vulnerability this year. Help Net Security reported on 2 October 2026 that CVE-2026-104286 in FortiMail was exploited before a fix existed. As of that date, Fortinet said the fixed releases (8.0.2, 7.6.7 and 7.4.9) had not yet been published and FortiMail 7.2 would get no fix and must move to 7.4 or later.
In our guide on Your Firewall’s Management Console Belongs Off the Public Internet: Lessons from the September KEV Surge , management-console exposure is covered in full. Write patch service levels and interim-workaround obligations into every vendor agreement, and name the person in your organisation accountable when the vendor is late.
Control mapping
| Control | What it requires | What it means for second-tier systems |
|---|---|---|
| A.5.9 Inventory of information and other associated assets | Inventory of assets with owners | Every BMS PC, NVR, print server and vendor appliance has an entry and a named owner |
| A.8.16 Monitoring activities | Networks, systems and applications monitored for anomalous behaviour | Traffic in second-tier zones is logged and anomalies are reviewed |
| A.8.20 Networks security | Managed and controlled networks and devices | Includes vendor-managed boxes |
| A.8.21 Security of network services | Defined security mechanisms and service levels for network services | Managed links carry written requirements |
| A.8.22 Segregation of networks | Groups of services and systems segregated | Second-tier systems sit in their own zones with minimal, explicit rules to core |
FAQ
How did attackers get into ATNS?
The public reporting does not say. According to MyBroadband, ATNS’s request for quotation asks forensic investigators to determine the root cause and how the malware was installed. The entry vector and origin remain unconfirmed as of 2 October 2026.
Do BMS, CCTV and print devices belong in an ISO 27001 asset register?
Yes, whenever they connect to a network. An unregistered device falls outside the scope an auditor can test.
Find your weather servers: a checklist for this month
==================================================================
FIND YOUR WEATHER SERVERS
==================================================================
1. INVENTORY
[ ] Pull ARP tables and DHCP leases; list every unregistered device
2. OWNERSHIP
[ ] Assign a named owner to every second-tier device
[ ] Record vendor contact and support end date per device
3. SEGMENTATION
[ ] Place each device class in its own VLAN and zone
[ ] Deny each zone to identity and finance except named flows
4. EGRESS
[ ] Baseline outbound traffic per zone for two weeks
[ ] Alert on new external destinations and new east-west flows
5. VENDOR
[ ] Add patch service levels and workaround duties to contracts
[ ] Route vendor remote access via a logged, time-boxed broker
==================================================================
Second-tier systems follow the same rules as the core: a register entry, a named owner, a zone, an allow-list and a vendor who answers to a contract.
Sources: MyBroadband, 2 October 2026 ( https://mybroadband.co.za/news/security/670359-china-linked-hackers-attacked-south-africas-air-traffic-control-system.html); TimesLive, 26 September 2026 ( https://www.timeslive.co.za/news/business/2026-09-26-air-traffic-agency-probes-cyberattack/); Avi-Go ( https://avi-go.com/news/articles/7c8a8d8dd4bccb8f69fa211689a38517); BleepingComputer, 30 September 2026 ( https://www.bleepingcomputer.com/news/security/cisco-warns-of-new-sd-wan-authentication-bypass-zero-day-exploited-in-attacks/); Help Net Security, 2 October 2026 ( https://www.helpnetsecurity.com/2026/10/02/fortinet-fortimail-vulnerability-cve-2026-104286/) . Facts as publicly reported; the sources reviewed include no full ATNS post-incident account.