Quick links
Press Enter to search, Esc to close
Significant cyber incident
On 24 February 2022, about one hour before Russia's full invasion of Ukraine, attackers disabled many satellite modems on Viasat's KA-SAT network.
In short
On 24 February 2022, about one hour before Russia's full invasion of Ukraine, attackers disabled many satellite modems on Viasat's KA-SAT network. Viasat says an intruder used a misconfigured VPN appliance to reach the management side and send commands that overwrote modem memory. Several thousand customers in Ukraine and tens of thousands across Europe lost service. The EU, UK and US attributed the attack to Russia on 10 May 2022.
On 24 February 2022, Viasat’s KA-SAT satellite network suffered a cyber-attack that partly interrupted its consumer broadband service. Viasat says most users were unaffected, but several thousand customers in Ukraine and tens of thousands of other fixed broadband customers across Europe were hit. The damage was limited to one consumer partition run for Viasat by Skylogic, a Eutelsat subsidiary.
The UK says the attack began about one hour before Russia launched its major invasion of Ukraine. It says the primary target is believed to have been the Ukrainian military, but personal and commercial internet users were also affected. It adds that wind farms in central Europe were affected.
Viasat says it saw no evidence that end-user data was accessed. It believes the purpose of the attack was to interrupt service. It shipped nearly 30,000 replacement modems to distributors by 30 March 2022.
On 10 May 2022 the EU, the UK and the US said Russia was responsible. Each statement is covered under attribution below.
Viasat completes the purchase of the wholesale broadband business, the KA-SAT satellite and its ground infrastructure. Skylogic keeps running the ground segment for Viasat.
Viasat detects high volumes of focused, malicious traffic from modems in Ukraine. It is a targeted denial of service attack.
Other modems join the traffic, making it harder for legitimate modems to enter or stay on the network.
Large numbers of modems across much of Europe leave the network over about 45 minutes.
Tens of thousands of modems have dropped off and do not return. The UK says this happened about one hour before the full invasion began.
Stabilization and mitigation start at once. Viasat says the network was largely stable within hours and fully stable within several days.
Replacement modems and over-the-air updates are used to bring customers back online through distributors.
Viasat publishes its KA-SAT cyber-attack overview. Nearly 30,000 modems have been shipped to distributors.
The EU, UK and US announce that Russia was responsible. CISA updates its advisory with the US attribution.
Viasat’s forensic work found a ground-based network intrusion. The attacker used a misconfiguration in a VPN appliance to gain remote access to the trusted management segment of the KA-SAT network.
The attacker moved sideways through the trusted management network to a segment used to manage and operate the network.
From there the attacker ran legitimate, targeted management commands on a large number of residential modems at the same time. These commands overwrote key data in the modems’ flash memory. The modems could not reach the network, but were not permanently unusable.
Viasat found no tampering with modem software or firmware images, no supply-chain interference, and no evidence that normal software update processes were used. It found no evidence that the satellite or its ground infrastructure was directly compromised. Viasat also described an early denial of service from modems in Ukraine, around 0302 UTC. The sources opened do not say how those modems came to send that traffic.
EU Council High Representative declaration (EEAS copy), 10 May 2022: strongly condemns the malicious cyber activity conducted by the Russian Federation against Ukraine, which targeted the KA-SAT network operated by Viasat.
UK NCSC, 10 May 2022: assesses that Russia was almost certainly responsible for the attack on Viasat on 24 February. The UK Foreign Office press release of the same day says new UK and US intelligence suggests Russia was behind it.
US, 10 May 2022: CISA's SATCOM advisory was updated to say the US government attributes this threat activity to Russian state-sponsored malicious cyber actors. The State Department statement it points to could not be opened, so its wording is not used here.
The UK separately assesses that Russian Military Intelligence was almost certainly involved in the 13 January 2022 defacements of Ukrainian government websites and the Whispergate malware. That statement is about those events, not the Viasat attack. None of the sources opened names a specific group for the Viasat attack, so no group page is linked.
Ukraine: several thousand customers lost service, and the attack hit a majority of the previously active modems in Ukraine (Viasat, 30 March 2022).
Rest of Europe: tens of thousands of other fixed broadband customers lost service (Viasat). The EU says it caused communication outages and disruptions across several public authorities, businesses and users in Ukraine and affected several EU Member States (EU, 10 May 2022).
Energy: the UK says wind farms in central Europe were affected (NCSC and FCDO, 10 May 2022). The sources opened do not give numbers for turbines or say what part of control was lost.
Equipment: the UK press release quotes Viasat saying tens of thousands of terminals were damaged and cannot be repaired. Viasat's own overview says the modems can be restored by factory reset. Sources differ.
Data: Viasat found no evidence that end-user data was accessed. Mobility and government users on KA-SAT, and other Viasat networks, were not affected.
Cost figures were not stated in the sources opened.
Statements by Ukrainian agencies and by the German government were not opened for this page.
Viasat says the intruder entered through a misconfigured VPN appliance and reached the trusted management segment. Check every VPN appliance configuration and who can reach management networks.
The attacker sent legitimate management commands to many modems at once. Limit and log who can push commands to fleets of devices.
Wind farms and internet users in several countries were affected through one satellite provider. Know which suppliers your operations depend on and what the fallback is.
Modems could be reset, but many needed new units or over-the-air fixes. Plan how devices will be recovered if their memory is wiped.
CISA and FBI advise independent encryption across links leased from or provided by a SATCOM provider.
CISA and FBI advise reviewing trust relationships with IT service providers and requiring monitoring and incident notification in contracts.
List every VPN appliance that reaches a management network. Review its configuration and require multi-factor authentication where possible.
Confirm who and what can reach the segment that manages your devices, and alert on new paths into it.
Check that commands sent to many devices at once need extra approval and are logged and alerted on.
Map which services (satellite, mobile, remote monitoring) your operations rely on, and agree a fallback with each supplier.
Check that service provider contracts require monitoring, logging and notification of security incidents on their infrastructure.
Where you lease links from a provider, add your own encryption on top.
Test how you would restore a large number of field devices after their memory is wiped, including spare stock.
A cyber-attack on its KA-SAT network partly interrupted consumer satellite broadband. Several thousand customers in Ukraine and tens of thousands across Europe were affected, per Viasat.
Viasat says forensics found an intruder who used a misconfiguration in a VPN appliance to reach the trusted management segment of the network.
Viasat says there was no evidence that the KA-SAT satellite or its supporting ground infrastructure was directly involved, impaired or compromised.
The EU, UK and US attributed the attack to Russia on 10 May 2022. The sources opened do not name a specific group for it.
Yes. The EU says several EU Member States were affected, and the UK says wind farms and internet users in central Europe were affected.
Viasat says they could be fully restored by factory reset, though many customers received replacement modems. The UK press release quotes Viasat saying terminals cannot be repaired, so sources differ.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.