Viasat KA-SAT attack (2022)

Date 	24 February 2022,Viasat, KA-SAT Network cyber attack overview (30 March 2022) between 5 am and 9 am EEST.Raphael Satter, Satellite outage caused 'huge loss in communications' at war's outset -Ukrainian official, Reuters (15 March 2022)
Suspected actor	Ukraine’s deputy head of State Service of Special Communications and Information Protection, Victor Zhora, has affirmed that they have evidence that the attack “was organized by Russian hackers”.Ellen Nakashima, Russian military behind hack of satellite communication devices in Ukraine at war’s outset, U.S. officials say, The Washington Post (28 March 2022); Frank Bajak, Satellite modems nexus of worst cyberattack of Ukraine war, ABC News (31 March 2022) U.S. intelligence analysts have similarly referred that Russia’s military intelligence agency (the GRU)Gordon Corera, Russia hacked Ukrainian satellite communications, officials believe, BBC (25 March 2022) could have been behind the attack,Ellen Nakashima, Russian military behind hack of satellite communication devices in Ukraine at war’s outset, U.S. officials say, The Washington Post (28 March 2022); Alexander Martin, Russian government hackers linked to cyber attack on first day of Ukraine invasion, Sky News (1 April 2022) and investigated the incident as a potential Russian state sponsored attack.Sean Lyngaas, US satellite operator says persistent cyberattack at beginning of Ukraine war affected tens of thousands of customers, CNN (30 March 2022)
 
According to the cyber-security firm SentinelOne, the rare wiper malware allegedly used for the attack showed developmental similarities to the “VPNFilter” attributed first by the FBI in 2018Juan Andres Guerrero-Saade and Max van Amerongen, AcidRain | A Modem Wiper Rains Down on Europe, Sentinel Labs (31 March 2022) to the APT28 group (or “Fancy Bear”) and later by the NSA to Sandworm group,Carly Page, Viasat cyberattack blamed on Russian wiper malware, Tech Crunch (31 March 2022) both allegedly Russian GRU-backed hacking groups.Carly Page, Ukraine disrupts attempt by Russian hackers to take down energy provider, Tech Crunch (12 April 2022); Emma Vail, A deeper look at hacking groups and malware targeting Ukraine, The Record (27 April 2022); Computer Emergency Response Team of Ukraine (CERT-UA), Five hacker groups that attack Ukraine the most, (22 April 2022) 
On May 10, 2022, the UK’s National Cyber Security Centre,UK Government, Russia behind cyber-attack with Europe-wide impact an hour before Ukraine invasion (10 May 2022); UK National Cyber Security Centre, Russia behind cyber attack with Europe-wide impact an hour before Ukraine invasion (10 May 2022) the US State Department,Antony J. Blinken, Attribution of Russia’s Malicious Cyber Activity Against Ukraine, US Department of State (10 May 2022) and the Council of the EUCouncil of the EU, Russian cyber operations against Ukraine: Declaration by the High Representative on behalf of the European Union (10 May 2022) officially attributed the attack to Russia. Russia has repeatedly denied that it carries out offensive cyber operations.See e.g. James Pearson, Russia downed satellite internet in Ukraine -Western officials, Reuters (11 May 2022); Catherine Stupp, U.S., U.K., EU Blame Russia for Cyberattack on Satellite Provider Viasat, The Wall Street Journal (10 May 2022)
Victims 	Users of modems on Viasat’s KA-SAT satellite network.Sean Lyngaas, US satellite operator says persistent cyberattack at beginning of Ukraine war affected tens of thousands of customers, CNN (30 March 2022) The attack affected a specific consumer-oriented partition of modems,Dan Swinhoe, Viasat: Our network was hit by a “multifaceted and deliberate” cyberattack, DCD (31 March 2022); Viasat, KA-SAT Network cyber attack overview (30 March 2022) in particular on Ukrainian territorySean Lyngaas, US satellite operator says persistent cyberattack at beginning of Ukraine war affected tens of thousands of customers, CNN (30 March 2022) but also a substantial number of customers along Europe.Viasat, KA-SAT Network cyber attack overview (30 March 2022); Sean Lyngaas, Ukraine detains 'hacker' accused of aiding Russian troops amid broader struggle to secure communications, CNN (15 March 2022); Dan Swinhoe, Viasat: Our network was hit by a “multifaceted and deliberate” cyberattack, DCD (31 March 2022)
Target systems 	A Modem Wiper Rains Down on Europe, Sentinel Labs (31 March 2022)
Method 	A Modem Wiper Rains Down on Europe, Sentinel Labs (31 March 2022) Viasat stated that the attackers exploited a “a misconfiguration in a VPN appliance” to gain remote access to a management segment of the ground-based networkIt is not clear if the hackers obtained the credentials or exploited a vulnerability to breach the VPN. See: Ruben Santamarta, VIASAT incident: from speculation to technical details, Reversemode (31 March 2022) and then moved laterally to a segment used to operate the network and executed “legitimate, targeted management commands on a large number of residential modems simultaneously”,Viasat, KA-SAT Network cyber attack overview (30 March 2022) overwriting key data in the flash memory of the modems and thus preventing them from accessing the network.Viasat, KA-SAT Network cyber attack overview (30 March 2022); Christopher Bing and Raphael Satter, Hackers who crippled Viasat modems in Ukraine are still active- company official, Reuters (30 March 2022) 
On 31 March, the cybersecurity firm SentinelOne presented an alternative analysis affirming that the attackers most probably conducted a supply-chain attack and used the “AcidRain” generic wiper malware designed to overwrite the key data in the modems and router’s flash memory.Juan Andres Guerrero-Saade and Max van Amerongen, AcidRain | A Modem Wiper Rains Down on Europe, Sentinel Labs (31 March 2022). The Strain of wiper malware was allegedly discovered by SentinelLabs on 15 March 2022. See: Carly Page, Viasat cyberattack blamed on Russian wiper malware, Tech Crunch (31 March 2022) The binary was apparently able to perform an “in-depth wipe of the filesystem and various known storage device files, before attempting to destroy the data”Carly Page, Viasat cyberattack blamed on Russian wiper malware, Tech Crunch (31 March 2022) and then reboot the devises rendering them inoperable. On the same day, Visat affirmed through a public statement the use of the wiper and stated that this analysis was consistent with the facts presented in the report.Viasat, Public Statement done vía Twitter (31 March 2022); Juan Andres Guerrero-Saade and Max van Amerongen, AcidRain | A Modem Wiper Rains Down on Europe, Sentinel Labs (31 March 2022); Jonathan Greig, Viasat confirms report of wiper malware used in Ukraine cyberattack, The Record (1 April 2022)
Purpose 	The attack ostensibly aimed at interrupting the service,Viasat, KA-SAT Network cyber attack overview (30 March 2022) by rendering the modems of an entire parcel of costumers inoperable,David Jones, Viasat network cyberattack linked to newly discovered Russian wiper, Cybersecurity Dive (1 April 2022) but not compromising the KA-SAT satellite itself, or the supporting ground infrastructure, and being no evidence of access to the users’ data or personal equipment.Dan Swinhoe, Viasat: Our network was hit by a “multifaceted and deliberate” cyberattack, DCD (31 March 2022)
 
Public officials have pointed to the alleged purpose of disrupting satellite communications in UkraineSean Lyngaas, US satellite operator says persistent cyberattack at beginning of Ukraine war affected tens of thousands of customers, CNN (30 March 2022) amid the intensification of the conflict in Ukraine on 24 February 2022.Matt Burgess, A Mysterious Satellite Hack Has Victims Far Beyond Ukraine, Wired (23 March 2022) In this regard, experts have claimed Viasat’s network also provided communications services to the Ukrainian military and security forces,Ellen Nakashima, Russian military behind hack of satellite communication devices in Ukraine at war’s outset, U.S. officials say, The Washington Post (28 March 2022); James Pearson, Raphael Satter, Christopher Bing and Joel Schectman, Exclusive: U.S. spy agency probes sabotage of satellite internet during Russian invasion, sources say, Reuters (12 March 2022) and that the attack could have intended to hit “aspects of military command and control in Ukraine”.David Jones, Viasat network cyberattack linked to newly discovered Russian wiper, Cybersecurity Dive (1 April 2022); See also: Gordon Corera, Russia hacked Ukrainian satellite communications, officials believe, BBC (25 March 2022) This assessment was reiterated in the statements of the USAntony J. Blinken, Attribution of Russia’s Malicious Cyber Activity Against Ukraine, US Department of State (10 May 2022) and the UK,UK Government, Russia behind cyber-attack with Europe-wide impact an hour before Ukraine invasion (10 May 2022) while the Council of the EU referred to the “facilitation of the military action”.Council of the EU, Russian cyber operations against Ukraine: Declaration by the High Representative on behalf of the European Union (10 May 2022)
Result 	A Modem Wiper Rains Down on Europe, Sentinel Labs (31 March 2022) including those used by military and other governmental agencies,Ellen Nakashima, Russian military behind hack of satellite communication devices in Ukraine at war’s outset, U.S. officials say, The Washington Post (28 March 2022) causing major loss in internet communication.Frank Bajak, Satellite modems nexus of worst cyberattack of Ukraine war, ABC News (31 March 2022) It has also impacted tens of thousands of customers across Europe,Viasat, KA-SAT Network cyber attack overview (30 March 2022) including satellite internet users from Poland, Germany, the UK, France, and the Czech Republic.Matt Burgess, A Mysterious Satellite Hack Has Victims Far Beyond Ukraine, Wired (23 March 2022) The alleged spillover of the attack, included the outage of the remote monitor and control of 5,800 wind turbines in Germany operated by Enercon,Juan Andres Guerrero-Saade and Max van Amerongen, AcidRain | A Modem Wiper Rains Down on Europe, Sentinel Labs (31 March 2022); Reuters, Satellite outage knocks out thousands of Enercon's wind turbines (28 February 2022) that were kept offline for several weeks.Raphael Satter, Satellite outage caused 'huge loss in communications' at war's outset -Ukrainian official, Reuters (15 March 2022); Dan Swinhoe, Viasat: Our network was hit by a “multifaceted and deliberate” cyberattack, DCD (31 March 2022)
 
The modems were no longer able to access the network and therefore, even if not permanently unusable, could only be restored by a factory reset.Viasat, KA-SAT Network cyber attack overview (30 March 2022); Matt Burgess, A Mysterious Satellite Hack Has Victims Far Beyond Ukraine, Wired (23 March 2022) Although Viasat did not provide precise information on the number of affected devices, it has stated that “nearly 30,000 fresh modems had already been shipped to distributors to bring customers back online”.Christopher Bing and Raphael Satter, Hackers who crippled Viasat modems in Ukraine are still active- company official, Reuters (30 March 2022) The EU Agency for Cybersecurity reported at least 27,000 devices were impacted.Matt Burgess, A Mysterious Satellite Hack Has Victims Far Beyond Ukraine, Wired (23 March 2022)
 
However, the attack did not compromise users on other Viasat networks worldwide, including airlinesMatt Burgess, A Mysterious Satellite Hack Has Victims Far Beyond Ukraine, Wired (23 March 2022) or other government users of the KA-SAT satellite network.Viasat, KA-SAT Network cyber attack overview (30 March 2022) It did not damage the satellite itself nor the network infrastructure.Viasat, KA-SAT Network cyber attack overview (30 March 2022); Gordon Corera, Russia hacked Ukrainian satellite communications, officials believe, BBC (25 March 2022) There was also no reported impact on the physical or electrical components of the modems,Viasat, KA-SAT Network cyber attack overview (30 March 2022); Jonathan Greig, Viasat confirms report of wiper malware used in Ukraine cyberattack, The Record (1 April 2022) and there is no evidence of impact on users’ data or access to the customers’ personal equipment.Matt Burgess, A Mysterious Satellite Hack Has Victims Far Beyond Ukraine, Wired (23 March 2022)
Aftermath 	Although mitigation and recovery actions to stabilize the network and restore service began immediately,Viasat, KA-SAT Network cyber attack overview (30 March 2022) as of May 2022, thousands of customers still remained offline.James Pearson, Raphael Satter, Christopher Bing and Joel Schectman, Exclusive: U.S. spy agency probes sabotage of satellite internet during Russian invasion, sources say, Reuters (12 March 2022); Matt Burgess, A Mysterious Satellite Hack Has Victims Far Beyond Ukraine, Wired (23 March 2022) The company’s spokesperson affirmed that priority in the recovery was given to “critical infrastructure and humanitarian assistance”.James Pearson, Raphael Satter, Christopher Bing and Joel Schectman, Exclusive: U.S. spy agency probes sabotage of satellite internet during Russian invasion, sources say, Reuters (12 March 2022)
 
Viasat affirmed that while in certain cases modems promptly received “over-the-air” software updates, around 30,000 new modems were shipped to effectively restore the functionality of the service, and stated to have continued the provision upon the distributors’ request.Viasat, KA-SAT Network cyber attack overview (30 March 2022) In addition, it stressed to be working on the enhancement of the network’s security.
 
On 30 March 2022, Reuters reported that Viasat was still witnessing some repeated attempts to interfere with the satellite services, but that these were being thwarted by defensive measures.Christopher Bing and Raphael Satter, Hackers who crippled Viasat modems in Ukraine are still active- company official, Reuters (30 March 2022)
 
As of May 2022, the attack was being investigated by cyber-security firms hired by Viasat,Carly Page, Viasat cyberattack blamed on Russian wiper malware, Tech Crunch (31 March 2022); Sean Lyngaas, US satellite operator says persistent cyberattack at beginning of Ukraine war affected tens of thousands of customers, CNN (30 March 2022) and multiple intelligence and security agencies, including the US National Security Agency, the French cyber-security agency and the Ukrainian intelligence.James Pearson, Raphael Satter, Christopher Bing and Joel Schectman, Exclusive: U.S. spy agency probes sabotage of satellite internet during Russian invasion, sources say, Reuters (12 March 2022); Matt Burgess, A Mysterious Satellite Hack Has Victims Far Beyond Ukraine, Wired (23 March 2022); Dan Swinhoe, Viasat: Our network was hit by a “multifaceted and deliberate” cyberattack, DCD (31 March 2022)
Analysed in 	Although no scenario addresses this exact set of circumstances, relevant scenarios include:
Scenario 03: Cyber operation against the power grid
Scenario 10: Legal review of cyber weapons
Scenario 13: Cyber operations as a trigger of the law of armed conflict
Scenario 22: Cyber methods of warfare
Scenario 24: Internet blockage
Collected by: Dominique Steinbrecher
Category:Example
Category:2022