AerCap Sees Ransomware Attack | Aero-News Network
Aero-News Network
RSS icon RSS feed
podcast icon MP3 podcast
Subscribe Aero-News e-mail Newsletter Subscribe

Airborne Unlimited -- Most Recent Daily Episodes

Episode Date

Airborne-Monday

Airborne-Tuesday

Airborne-Wednesday Airborne-Thursday

Airborne-Friday

Airborne On YouTube

Airborne-Unlimited-12.01.25

AirborneNextGen-
11.18.25

Airborne-Unlimited-11.19.25

Airborne-AffordableFlyers-11.20.25

AirborneUnlimited-11.21.25

LIVE MOSAIC Town Hall (Archived): www.airborne-live.net

Fri, Jan 26, 2024

AerCap Sees Ransomware Attack

Aircraft Lessor Hit with 1-Terabyte Hack from 'Slug' Group

AerCap confirmed a ransomware attack in a filing with the US Securities and Exchange Commission, stating that the firm was robbed of 1 terabyte of data by the "Slug" group.

The group has threatened to slowly trickle out releases of the data unless AerCap pays their ransom, setting a 2-week deadline to begin paying. The leak plans appear to have 5 gigabytes published after 3 days of non-payment, 30 gigs after a week, with the rest of the data published at the end of the 2-week term. No indication has been given of how much the ransom sits at.

Slug seemed like a small-timer at first, with only the AerCap caper to their hame,but things have a way of moving quickly in the ransomware space. Unlike the usual method of exploiting weaknesses and encrypting the data and systems of a target, Slug opted for a less invasive and hands-off method. They merely copied internal AerCap data without encrypting anything, allowing the firm to continue on with business as usual. (By ransomware standards, it's a courtesy, though the extortion angle mitigates the kindness quite a bit.) The only drive to enforce ransom payment is the fear of public disclosure of their internal documentation. The company hasn't been too noisy about the hack, and their tone so far appears nonplussed about the whole affair.

In their Form K-6 to the SEC, AerCap gave a brief overview of the event. "On January 17, 2024, we experienced a cybersecurity incident related to ransomware. We promptly took steps to investigate with the support of third-party cybersecurity experts and notified law enforcement. We have full control of all of our IT systems and to date, we have suffered no financial loss related to this incident. Our investigation into this incident, including the extent to which data may have been exfiltrated or otherwise impacted, remains ongoing."

FMI: www.aercap.com

Advertisement

More News

ANN's Daily Aero-Term (11.29.25): Waypoint

Waypoint A predetermined geographical position used for route/instrument approach definition, progress reports, published VFR routes, visual reporting points or points for transiti>[...]

ANN's Daily Aero-Linx (11.29.25)

Aero Linx: Sentimental Journey to Cub Haven Sentimental Journey Flyin began in 1986 with a group of dedicated volunteers working to provide a sentimental return to Lock Haven, the >[...]

NTSB Prelim: Jabiru USA Sport Aircraft LLC J230-SP

The Pilot Would Often Fly Over Their House At A Low Altitude And That Family Members Would Go Outside To Wave On November 14, 2025, at 1708 eastern standard time, a Jabiru USA Spor>[...]

Classic Aero-TV: Crafting The Future of eVTOL Infrastructure

From 2024 (YouTube Edition): Volatus Infrastructure Paves The Way The name “Volatus” seems to be everywhere these days, popping up in a series of partnerships and proje>[...]

Klyde Morris (11.28.25)

Fortnite Conquers All, Klyde FMI: www.klydemorris.com>[...]

blog comments powered by Disqus



Advertisement

Advertisement

Podcasts

Advertisement

© 2007 - 2025 Web Development & Design by Pauli Systems, LC


Debugging Information
ColdFusion Server Enterprise 2023,0,16,330828
Template /FullsizeImage.cfm
Time Stamp 02-Dec-25 05:32 AM
Locale English (US)
User Agent Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)
Remote IP 10.0.20.1
Host Name 10.0.20.1


Execution Time

Total Time Avg Time Count Template
77 ms 77 ms 1 C:/inetpub/wwwroot/clients/aero-news.net/parsed/main.textpost.cfm
77 ms 77 ms 1 CFC[ C:/inetpub/wwwroot/clients/aero-news.net/Application.cfc | onRequest(/FullsizeImage.cfm) ] from C:/inetpub/wwwroot/clients/aero-news.net/Application.cfc
49 ms 49 ms 1 C:/inetpub/wwwroot/clients/aero-news.net/model/main/actTextPost.cfm
9 ms 9 ms 1 CFC[ C:/inetpub/wwwroot/clients/aero-news.net/Application.cfc | onRequestStart(/FullsizeImage.cfm) ] from C:/inetpub/wwwroot/clients/aero-news.net/Application.cfc
5 ms 5 ms 1 C:/inetpub/wwwroot/clients/aero-news.net/view/layout/dspBannerAds.cfm
4 ms 4 ms 1 C:/inetpub/wwwroot/clients/aero-news.net/model/main/actWidgets.cfm
4 ms 4 ms 1 C:/inetpub/wwwroot/clients/aero-news.net/view/layout/dspWidgets.cfm
3 ms 3 ms 1 C:/inetpub/wwwroot/clients/aero-news.net/view/display/dspTextPost.cfm
2 ms 2 ms 1 C:/inetpub/wwwroot/clients/aero-news.net/fusebox.init.cfm
2 ms 2 ms 1 C:/inetpub/wwwroot/clients/aero-news.net/model/main/qryTextPost.cfm
2 ms 2 ms 1 CFC[ C:/inetpub/wwwroot/clients/aero-news.net/fb551/fusebox5/fuseboxApplication.cfc | compileRequest(main.textpost, CFC: fckeditor.fb551.fusebox5.myFusebox) ] from C:/inetpub/wwwroot/clients/aero-news.net/fb551/fusebox5/fuseboxApplication.cfc
1 ms 1 ms 1 C:/inetpub/wwwroot/clients/aero-news.net/model/main/qryAnnouncements.cfm
1 ms 1 ms 1 C:/inetpub/wwwroot/clients/aero-news.net/model/main/qryWidVideo.cfm
1 ms 1 ms 1 C:/inetpub/wwwroot/clients/aero-news.net/view/layout/widgets/widget_234BannerZone.cfm
1 ms 1 ms 1 CFC[ C:/inetpub/wwwroot/clients/aero-news.net/Application.cfc | onRequestEnd(/FullsizeImage.cfm) ] from C:/inetpub/wwwroot/clients/aero-news.net/Application.cfc
1 ms 1 ms 1 CFC[ C:/inetpub/wwwroot/clients/aero-news.net/components/utils.cfc | tagstripper(<h2><u><strong>Aircraft Lessor Hit with 1-Terabyte Hack from 'Slug' Group</strong></u></h2>

AerCap confirmed a ransomware attack in a filing with the US Securities and Exchange Commission, stating that the firm was robbed of 1 terabyte of data by the "Slug" group. The group has threatened to slowly trickle out releases of the data unless AerCap pays their ransom, setting a 2-week deadline to begin paying. The leak plans appear to have 5 gigabytes published after 3 days of non-payment, 30 gigs after a week, with the rest of the data published at the end of the 2-week term. No indication has been given of how much the ransom sits at.

) ] from C:/inetpub/wwwroot/clients/aero-news.net/components/utils.cfc
1 ms 1 ms 1 CFC[ C:/inetpub/wwwroot/clients/aero-news.net/fb551/fusebox5/myFusebox.cfc | init(fusebox, [complex value], [complex value]) ] from C:/inetpub/wwwroot/clients/aero-news.net/fb551/fusebox5/myFusebox.cfc
1 ms 1 ms 1 CFC[ C:/inetpub/wwwroot/clients/aero-news.net/fb551/fusebox5/myFusebox.cfc | trace(Fusebox, Request completed) ] from C:/inetpub/wwwroot/clients/aero-news.net/fb551/fusebox5/myFusebox.cfc
0 ms 0 ms 1 C:/inetpub/wwwroot/clients/aero-news.net/CustomTags/bph/QuerySim.cfm
0 ms 0 ms 1 C:/inetpub/wwwroot/clients/aero-news.net/cftags/sharelinks.cfm
0 ms 0 ms 1 C:/inetpub/wwwroot/clients/aero-news.net/model/comments/actDisqus.cfm
0 ms 0 ms 1 C:/inetpub/wwwroot/clients/aero-news.net/model/main/actFooter.cfm
0 ms 0 ms 1 C:/inetpub/wwwroot/clients/aero-news.net/model/main/qryAudio.cfm
0 ms 0 ms 1 C:/inetpub/wwwroot/clients/aero-news.net/model/main/qryNewscats.cfm
0 ms 0 ms 1 C:/inetpub/wwwroot/clients/aero-news.net/view/comments/dspDisqus.cfm
0 ms 0 ms 1 C:/inetpub/wwwroot/clients/aero-news.net/view/display/dspAnnouncements.cfm
0 ms 0 ms 1 C:/inetpub/wwwroot/clients/aero-news.net/view/layout/dspNewscats.cfm
0 ms 0 ms 1 C:/inetpub/wwwroot/clients/aero-news.net/view/layout/dspSidebar.cfm
0 ms 0 ms 1 C:/inetpub/wwwroot/clients/aero-news.net/view/layout/layAnnNew.cfm
0 ms 0 ms 1 C:/inetpub/wwwroot/clients/aero-news.net/view/layout/widgets/widget_admin.cfm
0 ms 0 ms 1 C:/inetpub/wwwroot/clients/aero-news.net/view/layout/widgets/widget_flashAd.cfm
0 ms 0 ms 1 C:/inetpub/wwwroot/clients/aero-news.net/view/layout/widgets/widget_podcasts.cfm
0 ms 0 ms 1 C:/inetpub/wwwroot/clients/aero-news.net/view/layout/widgets/widget_search.cfm
0 ms 0 ms 1 C:/inetpub/wwwroot/clients/aero-news.net/view/layout/widgets/widget_today.cfm
0 ms 0 ms 1 C:/inetpub/wwwroot/clients/aero-news.net/view/layout/widgets/widget_topvideos.cfm
0 ms 0 ms 13 CFC[ C:/inetpub/wwwroot/clients/aero-news.net/components/utils.cfc | RandomNumber() ] from C:/inetpub/wwwroot/clients/aero-news.net/components/utils.cfc
0 ms 0 ms 1 CFC[ C:/inetpub/wwwroot/clients/aero-news.net/fb551/fusebox5/fuseboxAction.cfc | getAccess() ] from C:/inetpub/wwwroot/clients/aero-news.net/fb551/fusebox5/fuseboxAction.cfc
0 ms 0 ms 1 CFC[ C:/inetpub/wwwroot/clients/aero-news.net/fb551/fusebox5/fuseboxApplication.cfc | expandFuseboxPath(parsed/) ] from C:/inetpub/wwwroot/clients/aero-news.net/fb551/fusebox5/fuseboxApplication.cfc
0 ms 0 ms 2 CFC[ C:/inetpub/wwwroot/clients/aero-news.net/fb551/fusebox5/fuseboxApplication.cfc | getCoreToAppRootPath() ] from C:/inetpub/wwwroot/clients/aero-news.net/fb551/fusebox5/fuseboxApplication.cfc
0 ms 0 ms 1 CFC[ C:/inetpub/wwwroot/clients/aero-news.net/fb551/fusebox5/fuseboxApplication.cfc | getVersion() ] from C:/inetpub/wwwroot/clients/aero-news.net/fb551/fusebox5/fuseboxApplication.cfc
0 ms 0 ms 1 CFC[ C:/inetpub/wwwroot/clients/aero-news.net/fb551/fusebox5/fuseboxEvent.cfc | init([complex value], [complex value], CFC: fckeditor.fb551.fusebox5.myFusebox) ] from C:/inetpub/wwwroot/clients/aero-news.net/fb551/fusebox5/fuseboxEvent.cfc
0 ms 0 ms 2 CFC[ C:/inetpub/wwwroot/clients/aero-news.net/fb551/fusebox5/myFusebox.cfc | getMyself() ] from C:/inetpub/wwwroot/clients/aero-news.net/fb551/fusebox5/myFusebox.cfc
0 ms 0 ms 1 CFC[ C:/inetpub/wwwroot/clients/aero-news.net/fb551/fusebox5/myFusebox.cfc | getSelf() ] from C:/inetpub/wwwroot/clients/aero-news.net/fb551/fusebox5/myFusebox.cfc
4 ms  STARTUP, PARSING, COMPILING, LOADING, & SHUTDOWN
91 ms  TOTAL EXECUTION TIME
red = over 250 ms average execution time


SQL Queries

post (Datasource=AeroNews, Time=1ms, Records=1) in C:\inetpub\wwwroot\clients\aero-news.net\model\main\qryTextPost.cfm @ 05:32:39.039
SELECT
	cb.ContentBlockID as id,
	cb.ContentBlockName as title,
	cb.Display,
	ct.DisplayTemplate,
	cb.HTMLContent as description,
	cb.ForumCode,
	cb.Icon,
	convert(varchar(20), cb.Display, 111) AS GroupDate,
	t.TeaserText as teaser,
	cb.SortOrder
FROM
	vwContentBlock cb INNER JOIN ContentType ct
	ON cb.ContentTypeCode = ct.ContentTypeCode
	LEFT OUTER JOIN Teaser t
	ON cb.ContentBlockID = t.ContentBlockID AND t.TeaserType <> 'L'
WHERE
	cb.ContentBlockID = ?
	AND Status IN ('60','80') AND (Display <{ts '2025-12-02 05:32:39'} OR Display IS NULL)
Query Parameter Value(s) -
Parameter #1(CF_SQL_varchar) = 9C73E7BB-C630-4732-A889-C02889D2BF28

GetAnnouncements (Datasource=AeroNews, Time=0ms, Records=1, Cached Query) in C:\inetpub\wwwroot\clients\aero-news.net\model\main\qryAnnouncements.cfm @ 05:32:39.039
SELECT HTMLContent
FROM ContentBlockLive
WHERE ContentBlockKey = 'ANNOUNCE' 
	AND Status = 60 
	AND ((Display <{ts '2025-12-02 05:00:00'} OR Display IS NULL) 
	AND (Expire > {ts '2025-12-02 05:00:00'} OR Expire IS NULL))
qryAudio (Datasource=AeroNews, Time=0ms, Records=0, Cached Query) in C:\inetpub\wwwroot\clients\aero-news.net\model\main\qryAudio.cfm @ 05:32:39.039
SELECT NewID() as id,
	CAST(episodesid AS VARCHAR(38)) as myid,
	title,
	CAST(subtitle  AS Varchar(800)) as teaser, 
	CAST(summary AS Varchar(2000)) as description,
	ApprovedDate as published,
	episodefile as filelocation, 
	podcastsid as categoryid,
	CAST('audio' AS char(8)) as mytype,
	ApprovedDate as GroupDate,
	SPACE(2) AS previewimage,
	0 AS sortorder
FROM episodes
	WHERE Approved = 1 
		
	AND ApprovedDate <{ts '2025-12-02 05:00:00'} ANd ApprovedDate > {ts '2025-11-28 05:00:00'} 

Order By published DESC, sortorder DESC
qryWidVideo (Datasource=AeroNews, Time=0ms, Records=3, Cached Query) in C:\inetpub\wwwroot\clients\aero-news.net\model\main\qryWidVideo.cfm @ 05:32:39.039
SELECT TOP 3
videoId as id, 
	convert(varchar(38), videoId) as myid, 
	title, 
	CAST(description AS Varchar(2000)) as description, 
	Cast(teaser AS Varchar(800))as teaser,
	published,
	filelocation, 
	categoryid,
	CAST('video' AS char(8)) as mytype,
	published as GroupDate,
	previewimage,
	0 AS sortorder
	
FROM Videos
WHERE active = 1 AND approved = 1 AND published <{ts '2025-12-02 05:00:00'} 
ORDER BY published DESC
widgetsorted (Datasource=, Time=3ms, Records=6) in C:\inetpub\wwwroot\clients\aero-news.net\model\main\actWidgets.cfm @ 05:32:39.039
SELECT *
	FROM qryWidgets
	WHERE wname IN('flashAd','today','search','podcasts','topvideos','adsection234')
	ORDER By sortorder
NewsCategories (Datasource=AeroNews, Time=0ms, Records=7, Cached Query) in C:\inetpub\wwwroot\clients\aero-news.net\model\main\qryNewscats.cfm @ 05:32:39.039
SELECT 
			ContentTypeName, ContentTypeCode
		FROM ContentType 
		WHERE CategoryCode = 'NEWS' AND CONTENTTYPECODE <> 'ATRVNW'
		ORDER BY ContentTypeName
NewsCategories2 (Datasource=AeroNews, Time=0ms, Records=8, Cached Query) in C:\inetpub\wwwroot\clients\aero-news.net\model\main\qryNewscats.cfm @ 05:32:39.039
SELECT 
			ContentTypeName, ContentTypeCode
		FROM ContentType 
		WHERE CategoryCode = 'NEWS'
		ORDER BY ContentTypeName


Scope Variables

CGI Variables:
AUTH_PASSWORD=
AUTH_TYPE=
AUTH_USER=
CERT_COOKIE=
CERT_FLAGS=
CERT_ISSUER=
CERT_KEYSIZE=
CERT_SECRETKEYSIZE=
CERT_SERIALNUMBER=
CERT_SERVER_ISSUER=
CERT_SERVER_SUBJECT=
CERT_SUBJECT=
CF_TEMPLATE_PATH=C:\inetpub\wwwroot\clients\aero-news.net\FullsizeImage.cfm
CONTENT_LENGTH=0
CONTENT_TYPE=
CONTEXT_PATH=
GATEWAY_INTERFACE=CGI/1.1
HTTPS=off
HTTPS_KEYSIZE=
HTTPS_SECRETKEYSIZE=
HTTPS_SERVER_ISSUER=
HTTPS_SERVER_SUBJECT=
HTTP_ACCEPT=*/*
HTTP_ACCEPT_ENCODING=gzip, br, zstd, deflate
HTTP_ACCEPT_LANGUAGE=
HTTP_CONNECTION=Keep-Alive
HTTP_COOKIE=CFID=5151428; CFTOKEN=1a9078ac8786d7ea-B2332802-0034-21D9-7C224AC0D860F380; JSESSIONID=48784B1FBAEB4427C392C0F3AF83F0A3.cfusion
HTTP_HOST=www.aero-news.net
HTTP_REFERER=
HTTP_URL=/FullsizeImage.cfm?do=main.textpost&id=9C73E7BB-C630-4732-A889-C02889D2BF28
HTTP_USER_AGENT=Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)
LOCAL_ADDR=10.0.20.10
PATH_INFO=
PATH_TRANSLATED=C:\inetpub\wwwroot\clients\aero-news.net\FullsizeImage.cfm
QUERY_STRING=do=main.textpost&id=9C73E7BB-C630-4732-A889-C02889D2BF28
REMOTE_ADDR=10.0.20.1
REMOTE_HOST=10.0.20.1
REMOTE_USER=
REQUEST_METHOD=GET
SCRIPT_NAME=/FullsizeImage.cfm
SERVER_NAME=www.aero-news.net
SERVER_PORT=80
SERVER_PORT_SECURE=0
SERVER_PROTOCOL=HTTP/1.1
SERVER_SOFTWARE=Microsoft-IIS/10.0
WEB_SERVER_API=
Cookie Variables:
CFID=5151428
CFTOKEN=1a9078ac8786d7ea-B2332802-0034-21D9-7C224AC0D860F380
JSESSIONID=48784B1FBAEB4427C392C0F3AF83F0A3.cfusion
Session Variables:
sessionid=48784B1FBAEB4427C392C0F3AF83F0A3.cfusion
urltoken=CFID=5151428&CFTOKEN=1a9078ac8786d7ea-B2332802-0034-21D9-7C224AC0D860F380&jsessionid=48784B1FBAEB4427C392C0F3AF83F0A3.cfusion
URL Parameters:
do=main.textpost
id=9C73E7BB-C630-4732-A889-C02889D2BF28
Debug Rendering Time: 23 ms