On February 24, 2022, hours before tanks crossed into Ukraine, Russia's opening move took place 22,000 miles above: operatives took down Viasat's KA-SAT satellite network.

The collateral damage reached far beyond Ukraine. Around 5800 Enercon wind turbines across central Europe lost remote monitoring and control, although the turbines continued operating.

The targeted attack took out tens of thousands of modems, including those used by Ukrainian military communications, causing a comms blackout at the worst possible moment.

Few of us look up and think about the security of the infrastructure orbiting overhead, but the Viasat incident is proof that it is not only vulnerable, but already on the target list.

Space Infrastructure’s Biggest Attack Surface is on Earth

A space system is far more than the spacecraft. It includes ground stations, control centers, engineering systems, cloud services, suppliers and user terminals. Most of that digital attack surface remains firmly on Earth.

Flying in the void gives space infrastructure enviable physical security, but that isolation cuts both ways.

Viasat's attackers never touched the space segment at all, because the ground segment offers all the usual entry points of any enterprise network and, once compromised, it can reach up and touch the spacecraft directly.

Meanwhile, a satellite's hardware is essentially frozen the moment it launches, often for a decade or more, with no realistic path to physical inspection or repair.

Threat analysis by the EU’s cybersecurity agency ENISA flags this as one of the sector's critical supply chain exposures, since hardware can be tampered with anywhere along a long, often international, manufacturing chain.

One scenario the agency documents requires nothing more sophisticated than a USB drive plugged into a satellite during assembly or transit, long before it reaches a launch pad.

With physical access off the table after launch, the remaining route in is communications, particularly software updates, where malware can be injected much like any terrestrial system.

A UK Space Agency-commissioned report reached a similar conclusion, rating supply chain compromise among the most likely cyber threats facing UK space capabilities.

Visibility and Accountability in Space is Getting Harder

A growing number of organizations now have a hand in managing space infrastructure, especially as private ventures launch projects and work jointly with government agencies.

Component manufacturers, launch providers, ground station operators and software vendors sit alongside the satellite operator itself, each a potential point of failure with its own standards and blind spots.

ENISA's threat actor analysis reflects who can now exploit that sprawl of state-nexus groups, financially motivated criminals, hacktivists and careless employees, none of whom need to breach an operator directly when a weaker supplier sits somewhere in the chain.

The public record likely understates how often this happens. Incidents are routinely recorded as anomalies, handled discreetly by contractors or, in the case of military and intelligence infrastructure, classified outright.

In March 2026, the US, Canada, Australia and New Zealand issued joint guidance on securing low Earth orbit satellite communications, calling for continuous monitoring, comprehensive audit logging and intrusion detection across the sector.

Four allied nations aligning on the same baseline is an encouraging sign.

Detection Assumes You Can Still Reach the Threat

Most security architectures assume a way back in when something goes wrong: pull a device offline, roll out a patch, and get an engineer's hands on the hardware. Except none of that holds a few hundred miles up.

Orbital patterns mean communication windows are short, bandwidth is expensive, and the hardware in question was often finalized long before. There is no "just SSH in and fix it," so that rules out traditional detection and response, therefore, the focus instead has to sit on preventing the threat from materializing at all.  

Every file, update and command destined for a spacecraft needs validating before it reaches anything mission-critical, not flagged once it's already running.

Engineering and test environments need genuine separation from live operational systems too, so a mistake at a single supplier can't find its way through to mission control.

Firewalls alone aren't enough for the most sensitive of these paths, since software-based controls can, in principle, be reconfigured or bypassed.

At the boundaries between ground networks, software controls alone may not provide sufficient assurance for the most sensitive pathways.

Where information must cross in only one direction, a data diode can enforce that direction physically. Files crossing that boundary should also undergo malware scanning, content disarm and reconstruction and strict validation.

Commands and software updates require separate controls, including cryptographic signing, authentication, allowlisting and integrity verification.

The same logic should extend to onboard decision-making, with enough local intelligence to validate commands and drop into a safe state independently, rather than waiting on a verdict from a ground station that might be an hour from its next contact window.

The Viasat attack showed how a single compromised login can take down a critical satellite network in minutes. Every scenario for a breach like this, from a stray USB drive on an assembly line to a tampered update pushed months into a mission, points to the same conclusion.

The vulnerability rarely sits with the spacecraft, but with everyone and everything that touches it on the way up.

That won't be the whole story for much longer. As more capability moves into orbit, a compromised spacecraft could become the source of an attack rather than only the target. Space cybersecurity built around defending the ground segment alone will need to evolve alongside it.