Space Systems: From System Failures to APT Attacks

Space Systems: From System Failures to APT Attacks

Kaspersky ICS CERT compiled a retrospective of incidents involving space systems — from the earliest automation errors to modern attacks on satellite communications. According to publicly available data, just over 100 attacks were recorded between 1957 and the early 2020s, although actual estimates vary widely depending on whether signal jamming and spoofing, traffic interception, and other incidents are counted as attacks.

Several noteworthy observations:

• Attacks on space infrastructure do not always require sophisticated tools. In 2009, militants in Iraq intercepted video feeds from U.S. drones using the SkyGrabber program, which cost just $26.

• Satellite infrastructure can be not only a target but also a tool for attackers. In the 2010s, for example, the Turla group intercepted unencrypted traffic from satellite providers and leveraged actively used IP addresses to disguise communications with compromised systems.

• The consequences of attacks can extend far beyond the space industry. In 2022, an attack on the Viasat operator affected around 30,000 satellite terminals in Europe and disrupted the remote operation of more than 5,800 wind turbines.

• Attacks on Global Navigation Satellite Systems (GNSS) are becoming a distinct area of concern. In 2023, reports indicated a sharp increase in navigation signal spoofing in the Black Sea region. Kaspersky's analysis showed that more than 3,000 GNSS receivers are vulnerable to attacks over the internet.

The retrospective's main conclusion is that a "space system" has long encompassed more than a satellite in orbit. It is an interconnected infrastructure consisting of ground stations, communications links, user terminals, software, and suppliers. To cause serious disruption, attackers often need only compromise the most accessible link in this chain.