Loading story…
Indian authorities have confirmed that multiple major airports across the country, including those in Delhi, Mumbai, Kolkata, Hyderabad, Bangalore, Amritsar, and Chennai, have experienced GPS spoofing and jamming incidents. The Civil Aviation Minister, Ram Mohan Naidu, reported to parliament that these attacks have been ongoing since 2023, with a notable increase in recent months. The incidents have forced pilots to rely on manual navigation methods, as satellite-based navigation became unreliable, though no direct harm was reported. The Airports Authority of India is working with the Wireless Monitoring Organization to identify the source of the interference and is implementing advanced cybersecurity measures to protect IT networks and infrastructure.
A particularly disruptive GPS spoofing attack occurred on November 7, 2025, affecting flight operations and airport tarmac activities at several key airports, including Indira Gandhi International Airport in New Delhi. The attack led to significant flight delays, cancellations, and operational chaos, highlighting the severe risks posed by such cyber threats to aviation safety and airspace management. The Indian government has officially classified these incidents as targeted cyber-attacks and emphasized the urgent need for enhanced security protocols to mitigate future risks.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
India's Civil Aviation Minister publicly confirmed that GPS spoofing and jamming had been detected at eight major airports. The Airports Authority of India and the Wireless Monitoring Organization are investigating the source while continuing cybersecurity upgrades to aviation systems.
Recent GPS spoofing or jamming incidents were specifically noted at Indira Gandhi International Airport in Delhi. Authorities said no harm has been reported from the interference.
India's Civil Aviation Minister said GPS spoofing and jamming incidents have been occurring regularly at major airports since 2023. The affected airports include Delhi, Kolkata, Amritsar, Mumbai, Hyderabad, Bangalore, and Chennai, with eight major airports impacted in total.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A Georgia Institute of Technology study of Automatic Identification System (AIS) broadcasts from more than 367,000 vessels identified 31 persistent maritime navigation-anomaly hotspots between late November 2024 and early February 2025. Researchers found strong or corroborated evidence of coordinated, regional GPS spoofing in at least 22 locations, documenting 17,936 anomalous episodes affecting 2,663 vessels and more than 31,000 hours of physically implausible or correlated vessel movements. The activity appeared in heavily traveled waterways and showed geographic and temporal alignment with regional conflicts and sanctions, including persistent disruption in the Red Sea and Strait of Hormuz. Red Sea anomalies near Port Sudan in January 2025 resembled conditions associated with the May 2025 grounding of the container ship *MSC Antonia*. The researchers cautioned that AIS analysis cannot identify the transmitter, operator, or spoofing technology responsible and likely misses short-lived, localized, and single-vessel incidents.
Oct 2, 2026
A cyberattack targeting Collins Aerospace, a key provider of check-in and boarding systems, caused significant operational disruption at major European airports including Heathrow, Brussels, and Berlin. The attack rendered automated check-in and baggage drop systems inoperable, forcing airports to revert to manual processes, resulting in widespread delays and cancellations. No evidence of data theft or ransomware has been reported, but the incident highlights the critical risk posed by third-party vendor vulnerabilities in aviation infrastructure.
Jun 29, 2026
China-linked threat activity was reported against both critical infrastructure in India and diplomatic targets in Europe, with researchers describing sustained espionage and pre-positioning operations rather than confirmed destructive attacks. Recorded Future’s Insikt Group said intrusions hit seven Indian State Load Dispatch Centers near the disputed Ladakh border, as well as India’s national emergency response apparatus and an Indian logistics subsidiary, using **ShadowPad** malware, compromised DVR/IP camera devices for command-and-control, and the **FastReverseProxy** tool. The activity was assessed as likely intended to establish access and collect intelligence inside India’s power sector. Separately, Proofpoint said China-aligned actor **TA416** increased operations against European diplomatic entities as Russia-Ukraine tensions escalated, including targeting a person involved in refugee and migrant services. The campaigns used web bugs to confirm active recipients before sending malicious links that ultimately deployed updated **PlugX** malware through ZIP archives, droppers, and DLL search-order hijacking. Proofpoint found substantial overlap between TA416 and the publicly reported **Red Delta** cluster, while Beijing publicly denied involvement in the India-related accusations and said it opposes cyberattacks.
Aug 15, 2026