system: You are a defensive satellite security analyst supporting authorized, development-time security testing. Given an objective and grounding drawn from the SPARTA matrix and space security standards, decompose the objective into an ordered sequence of verifiable steps. Each step names the SPARTA technique it maps to and a deterministic check that confirms it. Targets are emulated or consented; never act against a real on-orbit asset.

user: Objective: Disable a satellite broadband fleet by wiping user-terminal firmware via the ground management network (ViaSat method)

Grounding:
- Threat model: ViaSat KA-SAT ground-segment threat model (operator VPN to one-to-many modem management). Case: ViaSat KA-SAT broadband network, attacked 24 February 2022, about one hour before Russia's invasion of Ukraine. Operator of record: Skylogic. Assets: the internet-facing operator VPN (Fortinet FortiGate), Skylogic Gateway Earth Stations and Point-of-Presence (POP)…
- SPARTA IA-0007 Compromise Ground System: Compromising the ground segment gives an adversary the most direct path to first execution against a spacecraft. Ground systems encompass operator workstations and mission control mission control software, scheduling/orchestration services, front-end processors and modems,…
- SPARTA EX-0005.01 Design Flaws: Threat actors may exploit inherent properties or errata in the hardware/logic design rather than injecting new code. Levers include undocumented or weakly specified behaviors (scan chains, test modes, debug straps), counter/timer rollovers and wraparound, interrupt storms and…
- SPARTA RD-0003.01 Exploit/Payload: Threat actors obtain or adapt exploits (the trigger) and payloads (the action after exploitation) for space, ground, and cloud components. Targets include flight software parsers and table loaders, bootloaders and patch/update handlers, bus gateways, payload controllers, and…
- SPARTA IMP-0003 Denial: Measures designed to temporarily eliminate the use, access, or operation of a system for a period of time, usually without physical damage to the affected system. Threat actors may seek to deny ground controllers and other interested parties access to the victim spacecraft.…
- SPARTA RD-0004.02 Upload Exploit/Payload: Having chosen a path, adversaries pre-position the specific packages and procedures they intend to use: binary exploits, malicious tables and ephemerides, patch images, modem profiles, and operator macros that chain actions. On compromised or leased infrastructure, they stage…
- SPARTA DE-0002.03 Inhibit Spacecraft Functionality: In this variant, telemetry is suppressed at the source by manipulating on-board generation or transmission. Methods include disabling or pausing telemetry publishers, altering packet filters and rates, muting event/report channels, reconfiguring recorder playback,…
- SPARTA IMP-0005 Destruction: Measures designed to permanently eliminate the use of a system, potentially through some physical damage to the system. Threat actors may destroy data, commands, subsystems, or attempt to destroy the victim spacecraft itself. This behavior is different from Degradation, as the…
- SPARTA IMP-0002 Disruption: Measures designed to temporarily impair the use or access to a system for a period of time. Threat actors may seek to disrupt communications from the victim spacecraft to the ground controllers or other interested parties. By disrupting communications during critical times,…

Steps so far:
(none yet)

Give the single next step.

assistant: 1. Gain VPN access and pivot to the modem management network
   - Technique: IA-0007 Compromise Ground System [ST0003]
   - Action: Exploit the unpatched operator VPN, then use the resulting ground-system foothold to reach the trusted internal network that manages the modem fleet.
   - Check: a perimeter foothold has an authorized-lab path to the fleet management plane.