By Rowena Hudson

Russia conducted a cyber-attack on Ukraine’s data connections in space, causing a partial interruption of satellite broadband service. The attack affected several thousand customers in Ukraine and tens of thousands of other customers across Europe. The attack targeted Viasat’s KA-SAT network and used a wiper malware designed to render modems and routers inoperable. The attack impacted the Ukrainian civilian population, who were unable to access reliable information from the government during the conflict.– Viasat worked to stabilize the network, defend against additional attacks, and get impacted users back online.

In light of the recent report from Viasat, Russia not only invaded Ukraine on the ground but also launched a cyber-attack on Ukraine’s data connections in space. This attack targeted Viasat’s KA-SAT network, resulting in a partial interruption of the satellite broadband service.

The cyber-attack impacted several thousand customers in Ukraine and tens of thousands of other fixed broadband customers across Europe. One of the affected parties was Germany’s Enercon, which had its remote monitoring and control systems for 5,800 wind turbines disrupted. These wind turbines had a total capacity of 11 gigawatts.

An investigation by Sentinel Labs revealed that the threat actor used a supply-chain attack to push a wiper designed for modems and routers through the KA-SAT management mechanism. This wiper, known as AcidRain, is an ELF MIPS malware specifically designed to wipe modems and routers by overwriting key data in their flash memory.

While Viasat has not confirmed the characterization of the attack as a supply-chain attack, the CyberPeace Institute website states that it primarily impacted the Ukrainian civilian population. During the conflict, the Ukrainian population was unable to access reliable information from the government due to the interruption of internet services. Some areas experienced a two-week outage.

In response to the attack, Viasat worked with the operator to implement immediate updates to stabilize the network and defend against additional tactics. The president of Viasat Government Systems, Craig Miller emphasized the company’s in-house cyber expertise and capability in maintaining the safety and security of the majority of KA-SAT users. Viasat also initiated a rapid logistical response to get impacted users back online.

This incident highlights the growing concern over space-based attacks and their potential impact on critical infrastructure and civilian populations. As the reliance on satellite networks and space-based technologies increases, it becomes crucial for organizations to prioritize cybersecurity measures to protect against such attacks.

In light of the recent report by experts, the threat of space-based attacks is not limited to government entities and military organizations. Civilian infrastructure, including power grids, communication networks, and transportation systems, are also vulnerable to these attacks. This raises serious concerns for Chief Information Security Officers (CISOs) who must ensure the security of their organizations’ assets and data.

To mitigate the risk of space-based attacks, organizations should invest in robust cybersecurity measures, including regular vulnerability assessments, network monitoring, and incident response plans. Collaboration between government agencies, private sector organizations, and international partners is also essential to develop effective defense strategies against these evolving threats.

After taking everything into account, the cyber-attack on Ukraine’s data connections in space serves as a stark reminder of the potential consequences of space-based attacks. It underscores the importance of prioritizing cybersecurity and implementing proactive measures to safeguard critical infrastructure and civilian populations from such threats. CISOs should be concerned about space-based attacks and take necessary steps to protect their organizations from these emerging risks.

• Editor’s Note: This article covers “The Importance of Space-Based Attacks for CISOs”, in Space News.