On February 24, the morning Russia’s tanks rolled into Ukraine, tens of thousands of satellite modems quietly dropped off the internet. They never came back. By March 30, the company that owns the network, Viasat, had shipped nearly 30,000 replacement modems to customers across Europe.
That day Viasat published its most detailed account yet of the attack on KA-SAT, its consumer satellite broadband service. CNN called it one of the most consequential hacks of the war. Reuters was first to report the findings.
How the attackers got in
The intruders did not start with the modems. According to Viasat, they got into the ground-based management network through a misconfigured VPN appliance, which gave them remote access to a trusted part of the system. From there they moved sideways until they reached the segment used to run the network. Then they did something simple and brutal: they issued legitimate management commands to a large number of residential modems at once.
The commands overwrote the flash memory in the devices. The modems could no longer reconnect, and Viasat said none were seen trying to re-enter the network. Hackers had also flooded the modems with traffic to knock them offline, a belt-and-braces approach that CNN read as a sign of how determined they were to cut service in Ukraine.
Viasat was careful about what it did not find. The modems were not physically damaged, it said, and it saw no tampering with modem software or firmware images and no supply-chain interference. A factory reset can restore them. There was no evidence that end-user data was accessed, or that the KA-SAT satellite itself was compromised. Even so, thousands of customers needed new hardware to get back online, which is why the shipments continued.
Who was hit
Viasat said the incident hit the vast majority of previously active modems in Ukraine and a significant number elsewhere in Europe. Its directly managed mobility and government users on KA-SAT were not affected.
The damage did not stop at the border. BleepingComputer noted that modems used to control roughly 5,800 wind turbines in Germany went dark, and that customers in Germany, France, Italy, Hungary, Greece and Poland lost service. Ukraine’s military relies heavily on the KA-SAT network.
Victor Zhora, a senior Ukrainian cyber official, had called the hack on March 15 “a really huge loss in communications in the very beginning of the war.”
Brian Kime, a vice president at the security firm ZeroFox, told CNN the spread was no surprise. “Collateral damage happens in all wars,” he said, adding that if the operation was directed by Putin’s government and aimed at government and military customers, “there easily could have been a similar impact on non-Ukrainian customers, including NATO members.”
Attribution
Viasat did not name anyone, and it hired the US firm Mandiant to investigate. Washington was equally cautious. National Security Council spokesperson Saloni Sharma said the government had no attribution to share and was looking at the case closely, voicing concern over the apparent use of cyber operations to disrupt communications in Ukraine and across Europe.
US officials were treating it as a potential Russian state-sponsored attack. The NSA described an inter-agency and allied effort, including Ukrainian intelligence, to assess its scope and severity. CISA and the FBI put out a joint advisory warning US organizations of possible threats to satellite communication networks.
Viasat’s own conclusion was blunt: the purpose of the attack, it said, was to interrupt service.
Sources
- US satellite operator says persistent cyberattack at beginning of Ukraine war affected tens of thousands of customers :: WRAL.com
- Viasat shares details on KA-SAT satellite service cyberattack
