Airbus Hit by Cyber Attacks on Suppliers

PARIS (AFP) — European aerospace giant Airbus has been hit by a series of attacks by hackers who targeted its suppliers in a search for commercial secrets, security sources told Agence France-Presse, adding they suspected a China link.

There have been four major attacks on Airbus in the past 12 months, according to two security sources involved in investigating the hacking.

The group has long been considered a tempting target because of the cutting-edge technologies that have made it one of the world's biggest commercial plane manufacturers, and a strategic military supplier.

In January, it acknowledged a security incident that "resulted in unauthorized access to data," but people with knowledge of the attacks outlined a concerted and far bigger operation over the past year.

Hackers targeted British engine-maker Rolls-Royce and the French technology consultancy and supplier Expleo, as well as two other French contractors working for Airbus that AFP was unable to identify.

Airbus and Rolls-Royce did not immediately reply to requests for comment. Expleo said it would neither "confirm nor deny" that it had been targeted.

Romain Bottan of the aerospace security specialist BoostAerospace said the attacks show that hackers are seeking out weak links in the chain to compromise Airbus's systems.

"Very large companies are very well-protected, it's hard to pirate them, so smaller companies are a better target," he said.

The attack against Expleo was discovered at the end of last year but the group's system had been compromised long before, one of the sources said on condition of anonymity.

"It was very sophisticated and targeted the VPN, which connected the company to Airbus," the source said.

A VPN, or virtual private network, is an encrypted network that enables employees to gain access to company systems remotely.

Airbus suppliers sometimes operate in a VPN linking them with colleagues at the plane-maker.

The other attacks used the same methods, with the first of them detected at a British subsidiary of Expleo, formerly known as Assystem, as well as Rolls-Royce, which provides engines for Airbus planes.

According to several of the sources, the hackers appeared to be interested in technical documents linked to the certification process for different parts of Airbus aircraft.

They said that several stolen documents were related to the engines of the Airbus military transport plane A400M, which has some of the most powerful propeller engines in the world.

One of the sources said the hackers were also interested in the propulsion systems for the Airbus A350 passenger jet, and its avionics systems that control the plane.

None of the sources who spoke to AFP could identify the perpetrators of the attacks, citing the extreme difficulty in obtaining evidence and identification in any cyber attack.

Many state-backed and independent hackers are known to use tools to disguise their tracks, or they may leave clues intended to confuse investigators or lead them to blame someone else.

But the sources said they suspected Chinese hackers were responsible, given their track record of stealing sensitive commercial information and the existence of a motive.

China has launched manufacturing of its first midrange airliner, the C919, but the group behind it — state-owned planemaker Comac — is struggling to gain certification.

Engines and avionics are "areas in which Chinese research and development is weak," one of the sources said.

In its quest to break the stranglehold of Airbus and its U.S. rival Boeing on the global aircraft market, Beijing also has ambitions to build a long-haul jet called the C929, which will be developed in partnership with Russia.

Several sources said they believed a group of hackers linked to the Chinese Communist Party, known as APT10, could be behind the attacks.

The United States considers APT10 to be state-backed hackers linked to the Chinese intelligence services and military.

But another source pointed to a different group of Chinese hackers known as JSSD, which are believed to operate under the regional security ministry in the coastal state of Jiangsu.

"The JSSD is focused on the aerospace industry," one source said, adding that they employ people "familiar with the language, the software and aerospace codes."

In October 2018, the U.S. Department of Justice named several JSSD officers as responsible for a hacking operation targeting an engine being developed by U.S.-based General Electric and French aerospace group Safran.

"At the time of the intrusions, a Chinese state-owned aerospace company was working to develop a comparable engine for use in commercial aircraft manufactured in China and elsewhere," a U.S. statement said.

France and Airbus have been left in a delicate position by the discovery of the hacking attacks, the sources said, with the country and company needing to take into account their commercial ties with China.

The attacks show the vulnerability of Airbus to intrusions via its global supplier network, and the value of its technology to foreign countries.

"The aerospace sector is the one that suffers most from cyberattacks, mostly through spying or people seeking to make money from this industry," said Bottan of BoostAerospace.

There is also a major industrial risk for Airbus, with hackers potentially able to knock out production for strategic suppliers, which would have a knock-on effect on production.

"If someone wanted to slow down production, they can quickly identify the critical supplier, the single sources, which are unique in their role," one expert said.

Belgian aerospace design and manufacturing firm ASCO had a major IT meltdown this year caused by malware, and it took a month to restore its systems, one source said.

That incident hit Airbus production.

© Agence France-Presse

Subscribe to Closing Arguments

Sign up for new weekly newsletter Closing Arguments to get the latest about ongoing trials, major litigation and hot cases and rulings in courthouses around the U.S. and the world.

Email *

Submit