Space Warfare: Russian Hackers' Satellite Attack Unveiled |  Black HAT conference | August 11, 2023
Channel: Hacking Space Frontier
Date: 2023-08-11

In a presentation at the Black Hat conference, officials from the National Security Agency (NSA) and satellite internet provider Viasat shared new insights into a significant cyberattack that occurred during Russia's invasion of Ukraine:

1. **Attack Overview**: The cyberattack, carried out by Russian hackers, targeted Viasat, a satellite internet provider. The attack affected Viasat's KA-SAT network, leaving its modems inoperable in Ukraine. The attack had ripple effects, causing disruptions to wind turbines in Germany and various organizations across Europe.

2. **Attack Impact**: The attack was aimed at degrading the communication capabilities of the Ukrainian government and military. Thousands of modems were taken offline, impacting various sectors including residential subscribers, wind farms, commercial airlines, government networks, and intelligence services around the world.

3. **Attack Details**: The attack involved two separate phases. The initial breach targeted a VPN installation in Turin, Italy, which provided network access to administrators and operators. The hackers gained access to management servers, allowing them to deliver wiper malware to the modems, rendering many of them permanently inoperative.

4. **Response and Mitigation**: Viasat struggled to respond to the attack due to the majority of affected modems being in Europe, while the company is based in the U.S. The NSA became involved to coordinate efforts with Viasat. However, a second attack ensued, overwhelming Viasat's systems and incident responders. The company had to rebuild its network infrastructure from scratch to mitigate future attacks.

5. **Attribution and Sanctions**: The NSA worked to attribute the attack definitively to Russian actors. The attribution process aimed to support the implementation of sanctions against the hackers. In May 2022, both the U.S. and European countries imposed sanctions on Russia, aiming to financially burden the country. These actions were a response to the attack, though not directly linked to the Viasat hack.

6. **Ongoing Threat**: Viasat anticipates further attacks from the hackers and has taken measures to improve network hygiene. The attackers have to change tactics more frequently due to Viasat's network rebuilding efforts.

7. **Unanswered Questions**: Some aspects of the attack, such as how the Russian hackers initially gained access to the VPN system, remain unexplained.

The presentation highlighted the complexities of the attack, the collaborative response between Viasat and the NSA, and the broader implications of such cyberattacks on critical infrastructure and international relations.