Viasat has shipped 30,000 replacement modems to customers across Europe. That is the cleanup bill for a cyberattack on its KA-SAT network that hit just as Russia invaded Ukraine.
The U.S. company laid out on Wednesday how the attack worked, the first detailed account since it happened. Its statement called the strike the most serious known cyberattack of the war. Users from Poland to France lost service. Remote access to thousands of wind turbines in central Europe also went dark, which is how the outage got noticed so fast.
It started with a denial-of-service attack, Viasat said, and the traffic came from modems inside Ukraine. The destructive step followed. Attackers got in through a “misconfiguration” in a virtual private network appliance, which gave them remote access from the internet to a “trusted” management console that runs the satellite network. From there they sent one disabling command to modems across Europe at the same moment. The modems were knocked out but not permanently unusable, Viasat said.
The company did not say how the attackers got past the VPN appliance. Ruben Santamarta, a satellite cybersecurity researcher, said it matters whether they stole credentials or used a known vulnerability. Viasat declined to give specifics, citing an ongoing investigation by the U.S. firm Mandiant. The ground network is run by Skylogic, an Italy-based subsidiary of Eutelsat, which sold Viasat the KA-SAT satellite in April of last year.
Who was hit
Viasat said “several thousand customers” in Ukraine were affected. Most of the customers who got replacement modems use the service for home broadband. Ukraine’s top cybersecurity official, Victor Zhora, told reporters earlier this month the attack caused a major loss of communications in Ukraine in the first hours of the invasion. He could not say which agencies beyond the military were hit, but contracts show his own agency, the State Service for Special Communications, is a customer, along with police agencies and municipalities.
Viasat would not tell The Associated Press who it believed was responsible. Ukrainian officials blame Russian hackers. Asked last week who did it, Zhora said: “We don’t need to attribute it since we have obvious evidence that it was organized by Russian hackers to disrupt connection between customers that use this satellite system.”
What came after
Many saw the Viasat attack as a sign that bigger cyberattacks reaching beyond Ukraine were coming. They have not materialized so far. Security researchers say the most damaging cyber operations of the war are probably happening out of sight, aimed at gathering intelligence. Lesser attacks, many apparently by volunteers, have hit both Russia and Ukraine.
Gregory Falco, a Johns Hopkins University professor who studies satellite security, said the damage was minor compared with what the attackers could have done. He thinks they likely kept a foothold in the network. “The attackers don’t want to show their whole hand,” he said.
Also on Wednesday, Google said it had identified a state-backed Russian hacking group running a credential-phishing campaign against the militaries of several Eastern European countries and a NATO think tank. It did not know whether any targets were compromised.
Sources
Sources
- KA-SAT Network cyber attack overview | Viasat
- UK blames Russia for satellite internet hack at start of war
