Iberia Confirms Cloud Credential Breach Tied to Infostealer Campaign Targeting Enterprise File-Sharing Platforms

Threat Summary

Category: Aviation Sector Cybersecurity Breach
Features: Credential compromise, cloud data exposure, infostealer-driven intrusion, delayed disclosure
Delivery Method: Stolen employee credentials harvested via infostealer malware; access to enterprise file-sharing platform lacking enforced MFA at time of compromise
Threat Actor: Zestix (also known as Sentap) — financially motivated initial access broker operating in closed forums

---

Spanish flag carrier Iberia has confirmed that recent claims circulating within cybercrime markets regarding stolen corporate data stem from a previously identified security incident discovered in November. The exposure forms part of a broader infostealer-driven campaign targeting enterprise cloud file-sharing environments across multiple industries, with aviation assets among the most sensitive datasets affected.

According to Iberia, the data currently being advertised and auctioned by threat actors matches material accessed during the earlier incident, rather than representing a new breach. The disclosure follows increased visibility around a threat actor known as Zestix, who has been linked to the compromise of dozens of organizations by exploiting password-only cloud access.

---

Core Narrative

The intrusion originated from the compromise of employee credentials rather than exploitation of a software vulnerability. Investigative analysis indicates that infostealer malware infected an Iberia employee endpoint, harvesting stored authentication data that was later replayed against the airline’s corporate file-sharing environment.

The accessed platform was ShareFile, an enterprise document-sharing solution widely used by large organizations to store and exchange internal files. Once authenticated, the attacker gained broad visibility into stored materials without triggering immediate detection.

Approximately 77 gigabytes of data were accessed, including internal aviation technical documentation related to Airbus A320 and A321 aircraft. Exposed materials included maintenance references, damage assessment charts, fleet configuration documentation, engine-related files, and other non-public internal records. While Iberia stated that no flight operations were impacted, the nature of the data underscores the sensitivity of engineering and maintenance environments when hosted in collaborative cloud platforms.

The threat actor subsequently attempted to monetize the stolen data, issuing an extortion demand of approximately $150,000 before shifting to auction-based resale within criminal marketplaces when payment was not secured.

---

Data Exposure Scope

Iberia confirmed that the compromised environment also contained limited customer-related personal data, including:

• Customer names
• Email addresses
• Phone numbers
• Iberia Club membership identifiers
• Selected booking reference codes for future travel

The airline stated that no payment card data or authentication credentials for customer accounts were exposed. As a containment measure, additional authentication controls were applied to affected accounts to prevent unauthorized booking modifications or transactional abuse.

---

Infrastructure at Risk

The breach highlights a structural vulnerability common across aviation, defense, and engineering sectors: the concentration of sensitive technical documentation within cloud-based collaboration tools that are often protected by inconsistent access controls.

While such platforms are operationally convenient, they frequently host:

• Aircraft maintenance and inspection documentation
• Proprietary engineering configurations
• Fleet-specific operational data
• Supplier and vendor records
• Regulatory compliance materials

In this case, Iberia asserted that the affected files were non-operational in nature and did not pose a direct flight safety risk. Even so, the exposure of technical and configuration data introduces downstream risks tied to competitive intelligence, counterfeit documentation, and potential misuse by state-aligned actors seeking insight into aviation systems.

---

Threat Actor Profile

Zestix emerged publicly in late 2024 and operates primarily as an initial access broker, a role that has become central to the modern cybercrime economy. Rather than deploying ransomware directly, the actor focuses on harvesting credentials through infostealer malware and selling validated access to downstream criminal groups.

The actor operates within Russian-language closed forums and monetizes access through cryptocurrency transactions. Additional intelligence has suggested overlap between one of Zestix’s known aliases and Iranian-linked infrastructure, as well as operational intersections with emerging ransomware collectives such as FunkSec.

The effectiveness of Zestix’s activity does not stem from advanced exploitation, but from disciplined credential reuse testing against enterprise environments where MFA enforcement is incomplete or inconsistent.

---

Sector-Level Implications

This incident reinforces a growing pattern across aviation and transportation infrastructure: credential theft has replaced vulnerability exploitation as the dominant initial access vector. Once credentials are compromised, time becomes irrelevant. Passwords harvested months or years earlier remain viable until explicitly invalidated or protected by multi-factor authentication.

Aviation organizations face compounded risk due to the volume of sensitive technical data shared across internal teams, manufacturers, regulators, and maintenance partners. Cloud exposure in this sector carries implications that extend beyond privacy into intellectual property protection and long-term operational integrity.

---

Forecast — 30 Days

• Continued resale and redistribution of Iberia-related data within criminal markets
• Additional disclosures from other organizations targeted in the same infostealer campaign
• Increased regulatory scrutiny of cloud access controls in aviation environments
• Secondary exploitation attempts leveraging exposed booking reference data
• Broader enforcement action against infostealer ecosystems and access brokers

---

TRJ Verdict

This breach was not the result of sophisticated intrusion techniques. It was the predictable outcome of password-only cloud access in an infostealer-dominated threat landscape.

When enterprise file-sharing platforms host sensitive engineering and customer data, authentication enforcement is not optional. Infostealers ensure that every unprotected credential eventually becomes a liability, regardless of how long ago it was stolen.

Iberia’s case illustrates a hard reality for global aviation: cloud convenience without enforced access discipline creates exposure windows measured in years, not days. Until credential-based access is treated as a primary attack surface rather than a secondary concern, aviation organizations will continue to discover breaches long after the data has already changed hands.

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---