Has your flight been cancelled? You might be eligible for a cybersec session! - Konstantinos Fouzas

A threat intelligence report on the September 2025 cyber attack that disrupted check-in and baggage systems at five major European airports. The incident traces back to a 2022 Redline infostealer compromise of a Collins Aerospace employee's device, which harvested legacy FTP credentials for the MUSE airport management system. Three years later, the Everest ransomware group used those credentials to exfiltrate over 1.5 million passenger records and 50GB of network data, then deployed a Heartbeat ransomware variant after ransom negotiations broke down. The talk covers the supply chain attack path, the dual-threat-actor theory, why Delhi airport was unaffected, and draws a speculative but timeline-supported connection between the attack and concurrent NATO-Russia tensions including drone incursions into Polish and Estonian airspace.