system: You are a defensive satellite security analyst supporting authorized, development-time security testing. Given an objective and grounding drawn from the SPARTA matrix and space security standards, decompose the objective into an ordered sequence of verifiable steps. Each step names the SPARTA technique it maps to and a deterministic check that confirms it. Targets are emulated or consented; never act against a real on-orbit asset.

user: Objective: Disable a satellite broadband fleet by wiping user-terminal firmware via the ground management network (ViaSat method)

Grounding:
- Threat model: ViaSat KA-SAT ground-segment threat model (operator VPN to one-to-many modem management). Case: ViaSat KA-SAT broadband network, attacked 24 February 2022, about one hour before Russia's invasion of Ukraine. Operator of record: Skylogic. Assets: the internet-facing operator VPN (Fortinet FortiGate), Skylogic Gateway Earth Stations and Point-of-Presence (POP)…
- SPARTA IA-0007 Compromise Ground System: Compromising the ground segment gives an adversary the most direct path to first execution against a spacecraft. Ground systems encompass operator workstations and mission control mission control software, scheduling/orchestration services, front-end processors and modems,…
- SPARTA EX-0005.01 Design Flaws: Threat actors may exploit inherent properties or errata in the hardware/logic design rather than injecting new code. Levers include undocumented or weakly specified behaviors (scan chains, test modes, debug straps), counter/timer rollovers and wraparound, interrupt storms and…
- SPARTA RD-0003.01 Exploit/Payload: Threat actors obtain or adapt exploits (the trigger) and payloads (the action after exploitation) for space, ground, and cloud components. Targets include flight software parsers and table loaders, bootloaders and patch/update handlers, bus gateways, payload controllers, and…
- SPARTA IMP-0003 Denial: Measures designed to temporarily eliminate the use, access, or operation of a system for a period of time, usually without physical damage to the affected system. Threat actors may seek to deny ground controllers and other interested parties access to the victim spacecraft.…
- SPARTA RD-0004.02 Upload Exploit/Payload: Having chosen a path, adversaries pre-position the specific packages and procedures they intend to use: binary exploits, malicious tables and ephemerides, patch images, modem profiles, and operator macros that chain actions. On compromised or leased infrastructure, they stage…
- SPARTA DE-0002.03 Inhibit Spacecraft Functionality: In this variant, telemetry is suppressed at the source by manipulating on-board generation or transmission. Methods include disabling or pausing telemetry publishers, altering packet filters and rates, muting event/report channels, reconfiguring recorder playback,…
- SPARTA IMP-0005 Destruction: Measures designed to permanently eliminate the use of a system, potentially through some physical damage to the system. Threat actors may destroy data, commands, subsystems, or attempt to destroy the victim spacecraft itself. This behavior is different from Degradation, as the…
- SPARTA IMP-0002 Disruption: Measures designed to temporarily impair the use or access to a system for a period of time. Threat actors may seek to disrupt communications from the victim spacecraft to the ground controllers or other interested parties. By disrupting communications during critical times,…

Decompose this objective into an ordered plan of verifiable steps.

assistant: Plan:
1. Gain VPN access and pivot to the modem management network
   - Technique: IA-0007 Compromise Ground System [ST0003]
   - Action: Exploit the unpatched operator VPN, then use the resulting ground-system foothold to reach the trusted internal network that manages the modem fleet.
   - Check: a perimeter foothold has an authorized-lab path to the fleet management plane.
2. Weaponize a modem/router wiper (AcidRain)
   - Technique: RD-0003.01 Exploit/Payload [ST0002]
   - Action: Develop AcidRain, a wiper tailored to the SurfBeam2 modem and router platform, designed to overwrite flash and erase firmware and configuration.
   - Check: the lab payload overwrites only the designated emulator image and produces the expected non-bootable test state.
3. Abuse the fleet management mechanism to push the wiper (supply-chain delivery)
   - Technique: RD-0004.02 Upload Exploit/Payload [ST0002]
   - Action: Use the legitimate KA-SAT management/distribution mechanism to push AcidRain to roughly 40,000 to 45,000 modems at once, a supply-chain-style delivery that rides a trusted one-to-many channel.
   - Check: the management plane can deliver an arbitrary, unsigned software image to many terminals without integrity verification or rate limiting.
4. Overwrite terminal flash to brick the modems
   - Technique: IMP-0005 Destruction [ST0009]
   - Action: On each modem, AcidRain overwrites the flash memory, erasing firmware and configuration so the device cannot boot or rejoin the network.
   - Check: a terminal applies a flash-overwrite payload without verifying a firmware signature, leaving it non-bootable.
5. Run a simultaneous denial-of-service to block reconnection and slow mitigation
   - Technique: IMP-0002 Disruption [ST0009]
   - Action: While modems dropped offline, the attackers flooded the network so surviving and recovering terminals could not reconnect, and so ViaSat and Skylogic had less room to deploy mitigations.
   - Check: the network control path has no surge/abuse protection that preserves operator management access during a flood.