“When the payroll system halts, the silence speaks louder than words,” remarked Dragan Petrovic, an aviation industry analyst based in Belgrade, capturing the unusual stasis enveloping Air Serbia. For eleven consecutive days, Serbia’s flag carrier has been grappling with a persistent cyber siege that insiders claim represents a ‘deep breach’ of its Active Directory infrastructure—a core element of its IT ecosystem. The airline has yet to publicly confirm the extent of the incursion, but the fallout is unmistakably tangible: delayed payslips, operational uncertainty, and a mounting sense of vulnerability.
Air Serbia, established in 2013 following the dissolution of Jat Airways, has grown into a symbol of national pride and economic connectivity in the Western Balkans. However, as the digital landscape becomes increasingly treacherous, the airline’s recent cyberattack underscores an uncomfortable truth faced by many carriers: legacy systems and critical IT infrastructures are lucrative targets for adversaries seeking disruption or exploitation.
According to sources familiar with the incident, the attackers penetrated deeply into Air Serbia’s Active Directory—a system responsible for managing user permissions and access across the corporate network. Such a breach, if confirmed, can effectively provide cybercriminals near-unfettered control, allowing them to move laterally, escalate privileges, and potentially exfiltrate sensitive data or disable operational capabilities. The delayed issuance of employee payslips is a symptom of these broader systemic impacts.
Cybersecurity experts observing the incident caution that the lack of public disclosure may be part of a deliberate containment strategy. “In many cases, organizations withhold detailed information during an ongoing investigation to avoid tipping off attackers or causing undue panic,” said Jelena Markovic, a cybersecurity consultant specializing in critical infrastructure protection. “However, transparency is crucial for restoring trust, especially when employee livelihoods and customer confidence are at stake.”
From a policy perspective, this event adds to the growing chorus calling for enhanced regulatory frameworks around cybersecurity in the aviation sector. The European Union Aviation Safety Agency (EASA) recently emphasized the increasing importance of cyber resilience, urging member states to harmonize efforts against such threats. Serbia, while not yet an EU member, aligns many of its aviation standards with European benchmarks, and Air Serbia’s predicament may prompt accelerated reforms.
Meanwhile, passengers have expressed concern over potential disruptions. Although no flight cancellations or delays have been officially attributed to the cyberattack, the incident fuels anxiety over data privacy and operational reliability. The aviation industry, historically reliant on complex and often outdated IT systems, faces a dual challenge: safeguarding passenger data and ensuring uninterrupted service amid escalating cyber threats.
Adversaries targeting national carriers like Air Serbia often have multifaceted motives—ranging from financial gain through ransomware to geopolitical signaling. The Western Balkans’ geopolitical sensitivity may add layers of complexity to attribution and response efforts. As Dragan Petrovic observed, “In this region, cyber incidents sometimes reflect broader strategic contests rather than isolated criminal acts.”
In conclusion, Air Serbia’s ongoing cyber ordeal is a sobering reminder that the turbulence confronting modern airlines extends beyond the skies. It raises urgent questions about preparedness, resilience, and the balance between secrecy and transparency. How many other carriers are flying blind to similar vulnerabilities? As cyber threats ascend, will the aviation sector recalibrate its defenses before the next attack takes flight?
Source: https://go.theregister.com/feed/www.theregister.com/2025/07/16/air_serbia_cyberattack/
