PaperlayerView exact revision on arXiv

Source-linked AI summary

Rethinking Satellite Cybersecurity: A System-Level Taxonomy and Longitudinal Analysis

Roy Peled, Eran Aizikovich, Edan Habler, Yuval Elovici, Asaf Shabtai

arXiv:2312.01330v2cs.CR

TL;DR

Satellite cybersecurity research lacks an incident-grounded way to connect attacks across system architecture, adversary behavior, and operational impact. This paper constructs a longitudinal incident corpus and satellite-specific lifecycle taxonomy, finding shifts in GNSS interference, ground compromise, user-terminal exploitation, and deception while treating AML as prospective. The framework links behavior to satellite segments, links, subsystems, capabilities, and consequences.

  • Problem

    Existing satellite threat analyses do not adequately connect incidents across system architecture, adversary capabilities and lifecycle tactics, and operational impacts.

    Source: §1.1 · p. 2

  • Method

    The authors compile a source-backed incident corpus with structured metadata and uncertainty indicators, then derive a satellite-specific lifecycle taxonomy linking attack behavior to satellite systems and operations.

    Source: §11 · p. 25

  • Results

    Recent incidents show increasing GNSS jamming and spoofing, ground-segment compromise, user-terminal exploitation, and deception and service-disruption campaigns, while AML remains prospective rather than a publicly confirmed root cause.

    Source: §11 · p. 25

  • Takeaways & Limitations

    The taxonomy provides an operational view connecting adversarial behavior to satellite segments, communication links, spacecraft subsystems, capabilities, and consequences.

    Source: §11 · p. 25

    No publicly confirmed satellite incident has explicitly identified AML as the root cause of failure or compromise.

    Source: §6.6 · p. 12

Abstract

from arXiv · show

Satellite systems are increasingly targeted by cyber and electronic-warfare adversaries as their roles in communication, navigation, Earth observation, and defense expand. Existing surveys do not comprehensively characterize adversarial behavior across the full attack lifecycle and often omit emerging attack surfaces such as adversarial machine learning (AML). This paper presents a satellite-specific taxonomy of tactics, techniques, and procedures (TTPs), developed primarily for low Earth orbit systems and informed by evidence from LEO, MEO, and GEO missions. We analyze the space, ground, communication, and user segments to identify architectural exposures and operational attack surfaces, and compile a dataset of more than 200 publicly reported satellite incidents from 1962 to 2026, including over 80 incidents not covered in prior work. Longitudinal analysis reveals shifts toward ground-segment compromise, GNSS interference, communication disruption, proximity-based counterspace activity, and deception-oriented attacks. Building on these findings, we propose a MITRE ATT&CK-inspired satellite attack lifecycle taxonomy that integrates subsystem exploitation, radio-frequency interference, on-orbit operations, AML, and deception techniques. We demonstrate its practical utility through case studies of the 2022 Viasat KA-SAT cyberattack and a simulation-based ICARUS constellation-scale denial-of-service scenario. The framework combines longitudinal evidence, real-world incidents, and emerging attack modalities to support threat modeling, defensive planning, and the design of detection and mitigation strategies.

1. Introduction

Satellite systems’ expanding societal role and attack surface sharpen the need for incident-driven research that connects adversary behavior to satellite architecture and operational effects. The paper develops that framework through a longitudinal incident corpus, a satellite-specific lifecycle taxonomy, and case studies.

1.1. Satellite Security

  • Satellite reliance and rapid deployment have increased the consequences of disruption, while satellite cybersecurity has received comparatively less research attention than enterprise IT and network security.Prior work often treats only selected attack surfaces or analytical goals, leaving a need for reproducible analysis linking incidents to system segments, capabilities, lifecycle tactics, and impacts.Source: §1.1 · pp. 1–2

1.2. Scope and Purpose

  • The paper adapts MITRE ATT&CK and selectively complements SPARTA with a satellite-specific, incident-grounded taxonomy connecting attack behavior to satellite operations.Its scope is primarily LEO, with applicability to MEO and GEO, and the taxonomy treats AML surfaces as emerging and prospective rather than historically confirmed incident categories.Source: §1.2 · p. 2

1.3. Contributions

  • The authors provide a reproducible methodology for constructing the incident corpus and deriving the satellite-specific threat taxonomy.The process specifies source selection, inclusion and exclusion criteria, deduplication, metadata, uncertainty handling, and mapping to system and lifecycle features.Source: §1.3 · p. 2
  • The released dataset contains more than 200 source-backed satellite cyber and electronic-warfare incidents spanning 1962–2026, including more than 80 from 2019–2026.It includes structured metadata, references, uncertainty indicators, taxonomy mappings, and subsystem interpretation where public evidence supports it.Source: §1.3 · p. 2
  • The taxonomy integrates ground intrusions, RF interference, GNSS disruption, on-orbit operations, deception, and AML-related attack surfaces in a lifecycle-oriented framework.It is inspired by MITRE ATT&CK and selectively aligned with SPARTA where applicable.Source: §1.3 · p. 2
  • The longitudinal analysis identifies growing GNSS interference and ground-segment compromise, alongside emerging deception-driven counterspace strategies.The analysis spans RF, cyber, physical, and deception-oriented domains.Source: §1.3 · p. 3
  • Case studies of the 2022 Viasat KA-SAT attack and a simulated ICARUS constellation-scale denial-of-service scenario demonstrate the taxonomy’s application to observed and modeled adversarial behavior.The framework connects behavior to tactics, techniques, segments, links, and mission-level impacts.Source: §1.3 · p. 3
  • Together, the work links satellite architecture, communication links, spacecraft subsystems, adversarial behavior, and mission-level impacts through an extended longitudinal incident dataset.The authors position this as an extension of prior survey-based and incident-driven work.Source: §1.3 · p. 3

2. Methodology

The methodology builds a source-backed incident corpus through iterative collection, verification, screening, deduplication, and structured coding. It preserves uncertainty and applies a satellite-specific lifecycle taxonomy only at the level supported by evidence.

2. Methodology

  • Candidate incidents were gathered iteratively from established space-security sources, cross-checked where possible, screened for inclusion, deduplicated, and coded before taxonomy application.The workflow also supports trend analysis and case studies.Source: §2 · p. 3

2.1. Relation to Existing Incident Collections

  • The corpus extends earlier collections with post-2019 coverage, inspectable incident-level metadata, lifecycle interpretations, and explicit preservation of uncertainty in contested cases.It avoids forcing incidents into exhaustive official ATT&CK or SPARTA mappings.Source: §2.1 · p. 4

2.2. Incident Corpus Construction

  • Annual Space Threat Assessment reports from 2020–2025 served as primary sources for recent incidents, supplemented by earlier collections and academic studies.Candidates were reviewed and cross-checked against additional sources for timing, target, attack vector, and operational effect; reports of similar events were compared to distinguish duplicate from separate incidents.Source: §2.2 · p. 4

2.3. Inclusion and Exclusion Criteria

  • The corpus includes reported cyber, electronic-warfare, counterspace, and other security-relevant events, while excluding ungrounded theoretical attacks, non-operational simulations, ordinary failures, and accidental outages absent a suspicious or adversarial component.Research demonstrations were included only when tied to real systems, services, infrastructure, or operationally realistic settings.Source: §2.3 · p. 4

2.4. Unit of Analysis and Deduplication

  • A unit of analysis is a distinct incident or episode; coordinated repeated disruptions may be grouped, while events differing meaningfully in target, service, time, vector, region, or effect remain separate.This conservative deduplication may undercount repeated attacks but reduces inflation from multiple reports of the same activity.Source: §2.4 · pp. 4–5

2.5. Metadata Fields and Coding Process

  • Structured metadata records incident timing, location, actors, victims, targets, services, vectors, threat domain, effects, and references, with additional segment and lifecycle fields when supported.Lifecycle coding is MITRE-inspired but not an exhaustive official ATT&CK or SPARTA row-level mapping; spacecraft subsystem interpretation is included only when evidence supports it.Source: §2.5 · p. 5

2.6. Treatment of Missing and Uncertain Information

  • Because public reports vary in technical detail, coding distinguishes reported evidence, supported inference, and unknown information instead of reconstructing complete attack chains.Inferences are explicitly marked and restricted to supported high-level phases or prerequisites; disputed causality, attribution, and intermediate steps remain uncertain, unlike plausible chain reconstruction in prior work [33].Source: §2.6 · p. 5

2.7. Taxonomy Application and Consistency Checking

  • Taxonomy mappings use supported evidence or explicitly marked high-level inference, retain broad categories when details are unavailable, and represent satellite-specific behaviors without forcing unsupported SPARTA matches.The final dataset was checked for duplicates, inconsistent terminology, unsupported classifications, missing references, and inconsistent inference labeling.Source: §2.7 · p. 5

3. Threat Analysis

The threat analysis uses a structured adversary–asset–vulnerability framework to develop a satellite-specific threat model. Its ecosystem view emphasizes exposures and dependencies across ground, space, communication, and user segments.

3. Threat Analysis

  • The threat model proceeds from segment-level exposures and vulnerabilities to six adversary capability tiers, then uses historical incidents to derive and evaluate a satellite-specific lifecycle taxonomy.The analysis draws on the NIST Ontology for Modeling Enterprise Security and uses MITRE ATT&CK logic, selectively aligning with SPARTA where applicable.Source: §3 · pp. 5–6, Figure 2 · p. 6

4. Satellite Ecosystem

  • The ecosystem analysis treats interfaces and structural dependencies across ground, space, communication, and user segments as attack surfaces that shape threat propagation.These dependencies inform the taxonomy developed later in the paper.Source: §4 · p. 6

4.1. Ground Segment

  • Ground infrastructure spans stations, mission control, data processing, and remote terminals, often connected to enterprise networks and external providers.Command and telemetry traffic passes through ground infrastructure, so compromise may enable system takeover or stealthy manipulation; processing and remote-terminal workflows also add software, supply-chain, and network exposure.Source: §4.1 · p. 6

4.2. Space Segment

  • The space segment includes LEO, MEO, and GEO satellites; the analysis focuses primarily on LEO constellations, whose distributed architectures and COTS reliance expand attack surfaces.Integrated subsystems and mission payloads have distinct trust boundaries and dependencies, while internal spacecraft buses may provide lateral-movement pathways under adversarial control.Source: §4.2 · p. 7

4.3. Communication Segment

  • RF and network links connect space, ground, and users, creating operational dependencies vulnerable to interference, spoofing, protocol manipulation, and network compromise.Direct-to-device connectivity and 3GPP non-terrestrial network standards are reshaping architectures and expanding protocol-level exposure.Source: §4.3 · p. 7

4.4. User Segment

  • User-side exposure includes receivers, terminals, platforms, and cloud or API services, making this heterogeneous segment an indirect but potentially high-impact attack surface.Distributed ground systems and integration with terrestrial networks create additional susceptibility to interference, misconfiguration, and other exposure.Source: §4.4 · p. 7

5. Satellite Subsystems

Satellite subsystems divide into mission payloads and an operational bus, with their interfaces and interconnections creating distinct trust boundaries and potential attack paths. The architecture of those connections shapes whether compromise stays localized or can spread across subsystems.

5. Satellite Subsystems

  • Payloads deliver mission-specific functions, while the bus sustains spacecraft operation; payload compromise can affect processing, storage, downlink scheduling, RF behavior, and bus interfaces.Modern payloads may include onboard processing, third-party software, reconfigurable RF components, and external data interfaces.Source: §5 · pp. 7–8

5.1. Electrical Power Subsystem (EPS)

  • EPS powers spacecraft components, ADCS controls orientation and stability, and disruption of either can degrade multiple functions or threaten mission control.Power-flow manipulation may propagate across the spacecraft; ADCS disruption may affect pointing, communications, and payload operations.Source: §5.1 · pp. 8–9, §5.2 · p. 9

5.3. Communication Subsystem (COMMS)

  • COMMS carries platform and payload traffic over RF links, exposing spacecraft to interference, spoofing, jamming, signal hijacking, and protocol attacks.TT&C uses the communication link for platform control, health monitoring, tracking, telemetry, and command execution; its compromise may enable unauthorized commands or operational disruption.Source: §5.3 · p. 9, §5.4 · p. 9

5.5. Thermal Control Subsystem (TCS)

  • Thermal control failures can degrade performance or damage hardware, while propulsion disruption can alter trajectory, reduce station-keeping, or increase collision risk.These risks are especially consequential on long-duration missions or in densely populated orbital regimes.Source: §5.5 · p. 9, §5.6 · p. 9

5.7. Command & Data Handling Subsystem (C&DHS)

  • C&DHS coordinates command processing, telemetry, scheduling, storage, and subsystem communication, so compromise may enable persistent access, unauthorized commands, or broader spacecraft control.It is often implemented by, or tightly coupled with, the onboard computer.Source: §5.7 · p. 9

5.8. Star Architecture

  • Star architectures give C&DHS dedicated links to each subsystem, enabling isolation and direct control but adding wiring complexity and targetable interfaces.Figure 5 depicts the star bus architecture.Source: §5.8 · p. 9, Figure 5 · p. 9

5.9. Linear Bus Architecture

  • Linear bus architectures simplify integration through a shared backbone but may weaken subsystem isolation and facilitate lateral movement after initial access.Common interfaces include CAN, SPI, and I2C; many bus types offer limited native authentication or privilege separation.Source: §5.9 · pp. 9–10, Figure 6 · p. 10

6. Satellite Vulnerabilities

Satellite vulnerabilities span ground, space, communication, user, subsystem, and machine-learning layers. The section treats them as operational exposures that may cross segment and subsystem boundaries.

6.1. Ground Segment Vulnerabilities

  • Ground infrastructure is often the most accessible and operationally exposed segment, with physical, network, cloud, supply-chain, and third-party-service paths to mission systems.Integration with broader IT environments can make compromise a route to data theft, command manipulation, or persistent operational access.Source: §6.1 · p. 10

6.2. Space Segment Vulnerabilities

  • Space-segment risks include COTS components, multi-tier supply chains, and fragmented cybersecurity standards, with difficult post-launch servicing extending the consequences of weaknesses.The paper notes there is no universally enforced cybersecurity baseline for satellite systems.Source: §6.2 · p. 10

6.3. Communication Segment Vulnerabilities

  • Communication vulnerabilities include weak link protections, protocol gaps, exposed COM/FEP and TT&C gateways, and constellation-link congestion attacks.Linkflooding can use legitimate-looking traffic to degrade availability across selected links, gateways, or regions, unlike RF jamming.Source: §6.3 · p. 11

6.4. User Segment Vulnerabilities

  • User-segment exposure includes service-provider infrastructure, access networks, and widely distributed terminals, where compromise can disrupt service or enable traffic interception and routing manipulation.The section cites the Viasat KA-SAT incident as an illustration of user-terminal risks.Source: §6.4 · p. 11

6.5. Subsystem Vulnerabilities

  • Subsystem risks range from physical degradation and human error to cyber compromise, weak isolation, and vulnerable onboard buses that can permit injected commands or lateral movement.Shared interfaces often lack native authentication, encryption, message provenance, or privilege separation.Source: §6.5 · pp. 11–12

6.6. Vulnerabilities of Machine Learning in Satellite Systems

  • Satellite ML introduces exposure through manipulable sensor inputs, corrupted telemetry, constrained onboard hardware, poisonable updates, misclassification, and ground-dependent data pipelines.These risks may affect functions including ADCS, autonomy, anomaly detection, scheduling, and network management.Source: §6.6 · p. 12
  • The AML risks are prospective: the authors are unaware of publicly confirmed satellite incidents explicitly identifying AML as the root cause of failure or compromise.The analysis draws on existing satellite ML deployments and analogies to terrestrial AML attacks.Source: §6.6 · p. 12

7. Adversaries & Capabilities

The paper separates adversary identity from operational capability to interpret incidents and taxonomy entries against feasible capability profiles. It uses six actor tiers and a complementary capability model.

7.1. Threat Actors

  • The six-tier adversary model distinguishes actors by resources, intent, and tradecraft maturity, and many documented incident-corpus events map to Tier 1, Tier 4, and Tier 6 adversaries.Source: §7.1 · p. 13

7.2. Capability Categories

  • Capability categories describe practical means for satellite attacks, including RF and laser signaling, EMP, physical attack, launch, positional access, and insider relationships.Table 4 compares actor tiers by the relative feasibility of acquiring or sustaining capabilities for different attack classes.Source: §7.2 · pp. 13–14

8. A Brief History of Satellite Attacks

The incident corpus extends prior histories into a five-domain taxonomy and shows how reported satellite attacks and their operational effects have changed over time.

8.1. Trends Over Time

  • The trend analysis uses structured incident fields, but the corpus is limited by public reporting, possible regional and signal-layer overrepresentation, and thinner technical detail for earlier events.Incident reporting may omit classified or unreported events.Source: §8.1 · pp. 14–15

8. A Brief History of Satellite Attacks

  • The corpus contains more than 200 publicly reported incidents from 1962–2026, including more than eighty incidents from 2019–2026, mapped to a five-domain segment taxonomy.The domains are space, ground, user, communication link, and cross-cutting threats.Source: §8.1 · p. 14, §8 · p. 14, Figure 8 · p. 16

8.1. Trends Over Time

  • By the 2020s, reported attacks included coordinated multi-vector operations across segments; the partial decade already exceeded prior decades, with communication-link threats still most frequent and ground threats rising.Earlier periods featured broadcast jamming, hijacking, interference and eavesdropping, followed by GPS spoofing and cryptographic exploitation in the 2000s.Source: §8.1 · p. 14
  • Availability is the most frequently affected security property, while denial-of-service is the leading operational impact; both distributions allow incidents to occupy multiple categories.Integrity and confidentiality impacts also appear, and denial-of-service is followed by attacks on ground endpoints, eavesdropping, and network-communication tampering.Source: §8.1 · pp. 14–15

8.2. Space Segment Threats

  • Space-segment threats target orbital spacecraft buses, payloads, onboard firmware, and intersatellite interfaces, potentially affecting availability, integrity, or operational control.The threats span kinetic and cyber domains.Source: §8.2 · p. 16

Kinetic & Physical Attacks

The paper describes kinetic and non-kinetic physical threats to spacecraft, with non-kinetic events sometimes reported or hypothesized.

Kinetic & Physical Attacks

  • Destructive U.S. and Soviet ASAT tests date to the Cold War, followed by demonstrations by China in 2007 and India in 2019.These events highlighted direct spacecraft-loss risk.Source: Kinetic & Physical Attacks · p. 16
  • Destructive ASAT events also create a long-term orbital-debris hazard.Source: Kinetic & Physical Attacks · p. 16
  • Suspected laser illumination in 2006 was reported, while EMP and ultrawideband disruption scenarios were described as hypothesized threats that may degrade subsystems without contact.Source: Kinetic & Physical Attacks · p. 16

On-Orbit Cyber & Operational Attacks

The section spans on-orbit, ground, user, communication-link, and cross-cutting threats, illustrating how attacks can affect spacecraft operations and satellite services.

On-Orbit Cyber & Operational Attacks

  • On-orbit cyber threats include spacecraft hijacking, payload compromise, firmware manipulation, service disruption, and orbit or trajectory interference.Software-defined subsystems, reprogrammable COTS components, and remote updates expand the attack surface and feasibility of persistent exploitation.Source: On-Orbit Cyber & Operational Attacks · p. 16

Signal Disruption & Deception

  • Communication-link threats affect RF uplinks, downlinks, and inter-satellite links; communication-link attacks are the most frequently reported class, with jamming and spoofing among the documented disruption and deception methods.Jamming has been documented since the MED-TV disruption in 1995, while the 2013 White Rose of Drachs incident illustrates navigation-signal misdirection.Source: Figure 10 · p. 17, §8.5 · p. 17, Signal Disruption & Deception · p. 18

Network & Infrastructure Intrusion

  • Ground intrusions commonly use stolen credentials, phishing, or exposed remote access; reported footholds may enable movement into mission systems and telemetry infrastructure.Examples include the 2006 NASA spearphishing compromise and intrusions attributed to APT groups targeting aerospace organizations.Source: Network & Infrastructure Intrusion · p. 17

System Compromise & Service Disruption

  • The 2022 Viasat KA-SAT incident showed that exploiting remote-access infrastructure with destructive malware could disrupt tens of thousands of terminals.Other reported consequences include telemetry manipulation, data destruction, and loss of mission-control capabilities.Source: System Compromise & Service Disruption · p. 17

Terminal Exploitation

  • User-segment attacks target terminals and downstream services through firmware exploitation, credential compromise, botnets, and subscription fraud.Reported targets have expanded from satellite-TV piracy to maritime, aviation, and emergency-response users.Source: Terminal Exploitation · p. 17, §8.4 · p. 17

Localized Denial of Service

  • Portable jamming or spoofing can disrupt individual receivers, and GNSS-dependent platforms face immediate operational hazards; availability and denial-of-service lead the corpus's affected-property and impact categories.Operational impacts also include attacks on ground endpoints, eavesdropping, and tampering with network communications.Source: Localized Denial of Service · p. 17, Figure 11 · p. 17, Figure 12 · p. 17

Signal Interception & Takeover

  • Interception threats include passive eavesdropping, takeover of satellite transmissions, replay attacks, and cryptographic interception using commercial RF equipment.Examples include NATO imagery interception in 2002 and interception of unencrypted UAV video feeds.Source: Signal Interception & Takeover · p. 18

8.6. Cross-Cutting Threats

  • Cross-cutting threats span multiple segments and include insider activity, supply-chain compromise, and manipulation of satellite-derived data.Source: §8.6 · p. 18

Insider & Supply-Chain Threats

The paper connects satellite threats across system segments and the attack lifecycle, grounding its taxonomy in incident patterns and architecture. It positions the taxonomy as complementary to SPARTA and useful for defensive planning.

8.7. Summary

  • Satellite threats have shifted from early RF interference and broadcast hijacking toward coordinated operations combining link-layer attacks, ground intrusions, and space-segment targeting.The paper presents the taxonomy as a framework for analyzing these threats and supporting defense planning.Source: §8.7 · p. 18

8.8. Mitigation Framework

  • The mitigation framework maps safeguards to threat classes and operational segments using prevention, detection, and restoration, supporting defensive planning across subsystem and cross-segment attack paths.The mapping draws on attack paths observed in real-world incidents.Source: §8.8 · p. 18

9. MITRE-Inspired Satellite Attack Lifecycle Taxonomy

  • The lifecycle matrix organizes satellite-relevant techniques by adversarial phase and links attack behavior to exposed subsystems or interfaces and operational impact.Subsystem interpretation is applied only when the incident description, cited sources, or attack model supports it; many public reports lack enough detail for confident subsystem attribution.Source: §9 · pp. 18–19

9.1. Reconnaissance and Resource Development

  • Reconnaissance and resource development span orbital tracking, RF observation, technical and supply-chain research, ML-service discovery, and preparation of cyber or non-cyber capabilities.Initial access may use physical, RF, cyber, supply-chain, or data-driven pathways, including access to ML models and data pipelines.Source: §9.1 · pp. 19–20, §9.2 · pp. 20–21

9.3. Persistence

  • Persistence techniques maintain access after entry, while execution can manipulate systems through RF signals, cyber capabilities, commands, firmware, physical interaction, power, or ML inputs.Defense evasion includes telemetry manipulation, suppression of fault management, masquerading, and exploiting operational modes.Source: §9.3 · p. 21, §9.4 · pp. 21–22, §9.5 · p. 22

9.6. Lateral Movement

  • Lateral movement models propagation across spacecraft subsystems, satellites, ground systems, and mission segments, while impact includes disruption, control, destruction, and deception of data or analytics.The framework includes paths such as receiver-to-bus and constellation hopping, alongside deception of remote-sensing or ML models.Source: §9.6 · pp. 22–23, §9.7 · p. 23

9.8. Relationship to SPARTA

  • The taxonomy integrates cyber, RF, physical, deception, and adversarial machine-learning threats while distinguishing historical evidence from emerging or research-supported attack surfaces.Its corpus contains more than 200 publicly documented incidents spanning 1962–2026.Source: §9.8 · p. 23
  • The taxonomy complements SPARTA by connecting adversarial behavior to satellite architecture, subsystem exposure, propagation paths, incidents, and mission-level impact.SPARTA remains a structured space-cyber knowledge base for organizing techniques and supporting defensive analysis.Source: §9.8 · pp. 23–24

10. Demonstration: Using the Taxonomy to Model Attacks

The paper demonstrates its taxonomy through a documented Viasat attack and a modeled constellation-scale denial-of-service scenario. Its mappings distinguish reported evidence from supported inference and explicitly modeled behavior.

10. Demonstration: Using the Taxonomy to Model Attacks

  • The case studies map lifecycle steps only when supported by public reporting, supported high-level inference, or explicit simulation assumptions, without reconstructing unsupported intermediate steps.The paper also maps six additional incidents to illustrate consistency across attack types, segments, objectives, and impacts.Source: §10 · p. 24

10.1. Case Study — Viasat Cyberattack

  • Approximately 40,000 modems were disabled across Europe in the Viasat attack, disrupting Ukrainian military communications and civilian users, including German wind turbines.The attack entered through a misconfigured VPN appliance in the KA-SAT ground-segment management environment; AcidRain malware remotely overwrote modem flash storage.Source: §10.1 · p. 24

10.2. Case Study — ICARUS

  • ICARUS models denial of service against LEO networks by coordinating traffic to congest selected links, potentially degrading throughput and increasing latency.The scenario assumes attacker-controlled endpoints and knowledge of constellation topology, orbital motion, and routing constraints; it is not documented as a real-world incident.Source: §10.2 · pp. 24–25

11. Conclusion and Future Work

The paper concludes that satellite cybersecurity requires an incident-grounded, system-level model, supported by a structured corpus and a satellite-specific lifecycle taxonomy. It identifies evolving threats and practical applications while outlining open research challenges.

11. Conclusion and Future Work

  • Satellite cybersecurity requires linking adversarial behavior to architecture, communication paths, spacecraft subsystems, capabilities, and mission-level impact.The authors argue isolated incident chronologies, generic frameworks, or subsystem descriptions alone are insufficient.Source: §11 · p. 25
  • The corpus covers publicly reported satellite cyber and electronic-warfare incidents from 1962–2026, with structured metadata, uncertainty indicators, source references, and lifecycle mappings.It includes more than 80 incidents from 2019–2026 and preserves source-level uncertainty for suspected or contested cases.Source: §11 · p. 25
  • The taxonomy integrates cyber, RF, physical, deception-oriented, and adversarial machine-learning attack surfaces into a lifecycle framework linked to satellite segments, subsystems, and operational consequences.It is inspired by MITRE ATT&CK and selectively aligned with SPARTA where applicable.Source: §11 · p. 25
  • Recent incidents show increasing GNSS jamming and spoofing, ground-segment compromise, user-terminal exploitation, deception, and service disruption, while AML remains primarily prospective.The corpus distinguishes confirmed incidents from suspected, contested, and research-motivated attack classes.Source: §11 · p. 25
  • The framework is demonstrated through the confirmed 2022 Viasat KA-SAT attack and a simulation-based ICARUS constellation-scale denial-of-service scenario.These cases illustrate potential support for threat analysis, detection design, mitigation planning, and comparisons across attack types and impacts.Source: §11 · pp. 25–26
  • The dataset and taxonomy can support resilient-architecture design, intrusion detection, defensive simulation, mission-level risk assessment, and threat-intelligence sharing.Future work includes constellation-scale lateral movement and cascading failures, AI-enabled payload and autonomy risks, ambiguous-report validation, and supply-chain and cross-organizational exposures.Source: §11 · p. 26

Declaration of Generative AI Use

The authors report using generative AI tools to assist with literature exploration, candidate incident identification, and supplementary-material organization and formatting.

Declaration of Generative AI Use

  • Generative AI assisted literature exploration, candidate incident identification, and supplementary-material organization and formatting; the authors say they independently reviewed and verified incident entries, classifications, source mappings, and technical claims.The authors edited and validated the final manuscript and take responsibility for its content.Source: Declaration of Generative AI Use · p. 26

Appendix A. Reported Attacks and Research Mapped to Our Taxonomy

Appendix A provides concise descriptions of reported attacks and maps reported attacks and research to the paper’s taxonomy.

Appendix A. Reported Attacks and Research Mapped to Our Taxonomy

Related papers

Loading 2312.01330v2…