> ## Content Index
> Fetch the complete content index at: https://blog.alphahunt.io/llms.txt
> Use this file to discover other available public pages before exploring further.

# Space IoT: Under Siege.
- URL: https://blog.alphahunt.io/space-iot-under-siege/
- Published: 2025-09-11T12:00:24.000Z
- Updated: 2026-10-23T23:47:34.000Z
- Description: If your organization consumes satellite data, runs VSATs (very small aperture terminals), or depends on vendors who do—you’re in scope. Since 2020, attackers have shifted from “space” to the easier target: ground networks and cloud storage.
- Author: Wes
- Tags: space, iot, russia, vsat, 2025

# TL;DR

## Key Points

- **Harden supply chain:** Enforce vendor access controls and audits to block the easiest path into ground networks and cloud buckets.
- **Instrument jamming/spoofing:** Stand up basic detection for GNSS (GPS-like) interference and alert on uplink anomalies.
- **Lock down identities:** Treat ground stations and satellite ops accounts like crown jewels; monitor VPN/IdP drift and service account use.
- **Tighten storage paths:** Turn on access logging, object lock, and anomaly alerts for mission data in S3/Blob stores.
- **Share and learn fast:** Join sector intel sharing (e.g., Space ISAC) so you’re not learning alone during an incident.

---

## The story in 60 seconds

From 2020–2025, state actors (notably Russia, China, Iran, North Korea), ransomware crews, and hacktivists converged on space IoT—mostly via ground networks and cloud stores. **Anchor events**: Viasat KA-SAT disruption (Feb 2022), Interlock-style data exfil/extortion against defense/space supply chains (2024–2025), and 2025 hacktivist operations against Israeli satellite operators.

**Why this works:** supply-chain trust, identity sprawl, flat ops networks, and poorly instrumented storage. TTPs include supply-chain compromise, credential theft, GNSS jamming/spoofing, and living-off-the-land on admin workstations.

Impact is not just “space.” Downstream users lose comms, telemetry, and timing; dual-use services amplify blast-radius. **As of Sept 9, 2025, hybrid campaigns mixing cyber and EW are normal in conflict zones and increasingly hit commercial providers.**

---

# AlphaHunt

Stop doomscrolling, start decisioning. We chewed through the muck so your team doesn’t have to. → [Subscribe!](https://blog.alphahunt.io/#/portal/signup) • Forward to your on-call lead.

(Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :))

---

# See it in your telemetry

## Network

- **VPN:** bursts of password-spray from data-center IPs; new device fingerprints on privileged tunnels.
- **East-West:** admin workstation to sat-modem/ground-station controllers at off hours.
- **Egress:** cloud API endpoints for storage/list/get from unfamiliar regions or ASN.

## Endpoint

- Admin boxes launching built-ins (PowerShell, certutil, netsh) and archive tools pre-exfil.
- Unapproved firmware tools or serial/USB drivers installed on ops laptops.
- Credential access detections (LSASS memory reads, DPAPI abuse).

## Cloud/Storage

- **S3/Blob:** object enumeration followed by large sequential GETs; access via legacy keys; failed object lock delete attempts.
- **IAM:** escalation on service principals tied to data mover jobs; policy edits outside change windows.

## RF/GNSS (if you have it)

- GNSS receiver SNR drops, sudden clock drift, or position jumps.
- Uplink power/BER anomalies aligned with ops windows.

## Mail/IdP

- Targeted phish to ops engineers referencing vendor tickets; new OAuth app consents in IdP.

---

# AlphaHunt

[![CTA Image](https://storage.ghost.io/c/06/e5/06e5730b-7d78-4713-9cec-6cba31d297f5/content/images/2025/08/ah_slack.png)](https://alphahunt.io/?ref=blog.alphahunt.io) 

Ready to level up your intelligence game?

[Sign Up! ](https://alphahunt.io/?ref=blog.alphahunt.io) 

---

# High Impact, Quick Wins

## Turn on object-lock + anomaly alerts for mission data

- **Sell it:** Proven ransomware blast-radius reducer.
- **Measure it**: % critical buckets locked, mean time from suspicious access → alert.

## Privilege hardening for ops identities (MFA, short-lived tokens, service-account rotation)

- **Sell it**: Stops the #1 initial access for ground compromises.
- **Measure it**: % privileged accounts with strong MFA; median key age; failed privileged auth rate.

## Ground-segment segmentation + egress allow-listing

- **Sell it**: Containment when an admin box is popped; limits data theft and tooling download.
- **Measure it**: Allowed egress destinations count; blocked egress attempts from ops VLANs; lateral-movement alerts post-change.

---

---

# Research

## Summary

Space IoT infrastructure—including commercial, military, and GNSS satellites, as well as ground systems—has become a prime target for both state and non-state threat actors from 2020 to 2025\. Russian (Sandworm, APT28, Turla), Chinese (APT41, UNC4841), Iranian (Peach Sandstorm), and North Korean (Lazarus Group) state actors have conducted cyber and electronic warfare operations, leveraging supply chain attacks, destructive malware, jamming, spoofing, and espionage to degrade adversary capabilities and collect intelligence. Non-state actors, including ransomware groups (e.g., Interlock) and hacktivists (GhostSec, ArabianGhosts), have exploited cloud storage, supply chains, and VSAT terminals for extortion, disruption, and information warfare.

Key incidents include the Sandworm destructive malware attack on Viasat KA-SAT (2022), Interlock ransomware exfiltration of 4.2 TB from National Defense Corporation (2024–2025), and hacktivist DDoS/credential theft campaigns against Israeli satellite operators (2025). These attacks have caused operational outages, economic losses, and exposed critical dependencies in global infrastructure, with attribution often complicated by proxy use and blended state/non-state operations.

TTPs have evolved to include supply chain compromise (T1195), GNSS jamming/spoofing (T1461/T1462), ransomware/data extortion (T1486), and credential theft (TA0006). Living-off-the-land, social engineering, and targeting of ground infrastructure are increasingly prevalent. The threat landscape is further complicated by hybrid warfare, economic espionage, and the integration of space systems with terrestrial critical infrastructure.

## Background and Context

- Space IoT infrastructure—including commercial, military, and GNSS satellites, as well as ground systems—has become essential for communications, navigation, defense, and critical infrastructure worldwide.
- The period 2020–2025 has seen a surge in both the frequency and sophistication of attacks on space assets, driven by geopolitical tensions, the expansion of commercial space services, and the increasing integration of space systems with terrestrial critical infrastructure.
- Attribution remains challenging due to the use of proxies, criminal partnerships, and the blending of state and non-state actor operations.

---

## Significant State and Non-State Threat Actors (2020–2025)

### State Actors

- **Russia (Sandworm, APT28, Turla, Void Blizzard)**  
  - Engaged in cyber and electronic warfare (EW) targeting Western, Ukrainian, and commercial space assets.
  - Tactics include jamming, spoofing, destructive malware, and espionage.
  - Motivations: Military advantage, intelligence collection, and disruption of adversary C4ISR.
- **China (APT41, UNC4841, Earth Ammit)**  
  - Persistent cyber espionage and supply chain attacks on satellite operators and ground systems.
  - Demonstrated advanced on-orbit maneuvering and dual-use satellite capabilities.
  - Motivations: Strategic intelligence, military modernization, and economic advantage.
- **Iran (Peach Sandstorm, APT33, Predatory Sparrow)**  
  - Conducted cyberattacks against aerospace and satellite infrastructure, often for intelligence and regional influence.
  - Used social engineering, password spraying, and destructive malware.
- **North Korea (Andariel, Lazarus Group)**  
  - Targeted defense, aerospace, and satellite sectors for espionage and military leverage.

### Non-State Actors

- **Ransomware Groups (e.g., Interlock)**  
  - Targeted space sector supply chains and cloud storage (e.g., AWS S3 buckets used for satellite data) for extortion.
  - Example: Interlock ransomware attack on National Defense Corporation and its subsidiary AMTEC, exfiltrating terabytes of data tied to defense and space stakeholders.
- **Hacktivist Groups (e.g., GhostSec, ArabianGhosts, Mr Hamza, Cyber Unit 89)**  
  - Conducted DDoS, web defacement, and claimed intrusions into VSAT terminals and satellite operators, especially during regional conflicts (e.g., Israel-Iran).
  - Motivations: Political signaling, disruption, and information warfare.

---

## Geopolitical Motivations and Operational Trends

- **Military and Strategic Superiority:** States seek to degrade adversary capabilities, gather intelligence, and ensure freedom of action in space.
- **Economic and Technological Espionage:** Theft of intellectual property and disruption of commercial satellite services.
- **Political Signaling and Coercion:** Jamming, spoofing, and cyberattacks as tools of statecraft.
- **Hybrid Warfare:** Integration of cyber, EW, and physical attacks in broader military campaigns.
- **Hacktivism and Criminal Collaboration:** Non-state actors amplify state objectives or pursue financial gain, often blurring attribution.

---

## Evolution of Tactics, Techniques, and Procedures (TTPs)

- **Supply Chain Attacks:** Compromising vendors and cloud services to access satellite networks (e.g., Earth Ammit, Interlock).
- **Jamming and Spoofing:** Advanced GNSS interference, signal hijacking, and broadcast of propaganda.
- **Targeting Ground Infrastructure:** Attacks on control centers, ground stations, and IT networks.
- **Ransomware and Data Extortion:** Encryption and theft of mission-critical data, with threats of public leaks.
- **Living-off-the-Land and Social Engineering:** Use of legitimate tools, credential theft, and phishing to evade detection.

---

## Major Incidents (2020–2025)

| Date      | Actor/Group                                     | Target                                      | TTPs                                     | Impact                                                         | Source                |
| --------- | ----------------------------------------------- | ------------------------------------------- | ---------------------------------------- | -------------------------------------------------------------- | --------------------- |
| Feb 2022  | Russia (Sandworm)                               | Viasat KA-SAT (Ukraine/EU)                  | Destructive malware, supply chain        | Disrupted satellite internet, collateral outages in wind farms | \[ENISA, CSIS\]       |
| 2024–2025 | Interlock (Ransomware)                          | National Defense Corp. (US)                 | Ransomware, data exfiltration            | 4.2 TB of sensitive data exfiltrated, extortion                | \[Kratos/Space ISAC\] |
| 2025      | GhostSec, ArabianGhosts, Mr Hamza (Hacktivists) | Israeli satellite operators, VSAT terminals | DDoS, web defacement, claimed intrusions | Disruption, theft of credentials, information warfare          | \[Kratos/Space ISAC\] |
| 2024      | Iran (Peach Sandstorm)                          | Aerospace & satellite sectors               | Password spraying, social engineering    | Espionage, persistent access                                   | \[CSIS\]              |

---

## Impact on Global Security and Critical Infrastructure

- **Operational Disruption:** Attacks have caused loss of connectivity for military, government, and civilian users, impacting command and control, emergency response, and critical infrastructure.
- **Escalation Risks:** Space-based attacks risk escalation into broader military conflict, especially when targeting dual-use assets.
- **Economic Losses:** Ransomware and service outages have resulted in significant financial losses and reputational harm.
- **Strategic Vulnerability:** Demonstrated ability to disrupt or degrade space assets exposes critical dependencies in global infrastructure.

---

## Attribution Challenges

- Attribution is complicated by the use of proxies, criminal partnerships, and the blending of state and non-state operations.
- Many incidents are only made public by attackers, with limited confirmation from victims, making impact assessment and attribution uncertain.
- Analysts often use language such as “assessed with moderate confidence” or “likely” when attributing attacks.

---

# Recommendations, Actions, Suggested Pivots, Forecasts and Next Steps

(Subscribers Only)

---

# Recommendations, Actions and Next Steps

1. **Implement Rigorous Supply Chain and Cloud Security Controls Using Industry Standards**

  - Adopt and enforce NIST SP 800-161 Rev. 1 for Cybersecurity Supply Chain Risk Management (C-SCRM) across all vendors, contractors, and cloud service providers supporting space assets. Require continuous risk assessments, multi-factor authentication, least-privilege access, and encryption for all data at rest and in transit, especially in cloud storage (e.g., AWS S3 buckets) used for satellite data. Integrate these controls into procurement and onboarding processes, and conduct regular audits.
  - This recommendation addresses the documented rise in supply chain and ransomware attacks, such as the Interlock ransomware incident that exfiltrated terabytes of sensitive data from National Defense Corporation and its subsidiary AMTEC, as highlighted in SpaceNews and the intelligence product. By leveraging NIST C-SCRM, organizations can systematically reduce the risk of compromise through third-party relationships.
  - Challenges include the complexity of managing a diverse vendor ecosystem, potential resistance from partners, and the need for ongoing compliance monitoring and training.
  - Metrics for success: Percentage of vendors assessed and compliant with C-SCRM, reduction in third-party-related incidents, and percentage of cloud assets with enforced encryption and MFA.
  - MITRE ATT&CK IDs: T1195 (Supply Chain Compromise), T1078 (Valid Accounts), T1555 (Credentials from Password Stores).
2. **Enhance Detection, Response, and Resilience Against Jamming, Spoofing, and Ground Infrastructure Attacks**

  - Deploy advanced monitoring and anomaly detection systems at ground stations and satellite uplinks to identify GNSS interference, signal hijacking, and unauthorized access attempts. Integrate threat intelligence feeds focused on space sector TTPs, and conduct regular red-teaming and tabletop exercises simulating jamming, spoofing, and destructive malware scenarios. Reference CISA’s Zero Trust and ENISA’s space threat mitigation guidance for technical implementation.
  - This recommendation is grounded in the Viasat KA-SAT incident, where a misconfigured VPN allowed Russian actors to disrupt satellite internet and critical infrastructure, as reported by The Register. Proactive detection and response capabilities are essential to prevent and contain similar attacks.
  - Challenges include the need for specialized detection tools, potential false positives, and the requirement for staff training on space-specific threats.
  - Metrics for success: Mean time to detect/respond to interference events, number of successful red-team detections, and reduction in unplanned outages attributed to cyber/EW attacks.
  - MITRE ATT&CK IDs: T1461 (Signal Jamming), T1462 (Signal Spoofing), T1562 (Impair Defenses).
3. **Formalize and Expand Cross-Sector and International Information Sharing on Space Threats**

  - Join and actively participate in the Space Information Sharing and Analysis Center (Space ISAC) and similar international initiatives. Establish protocols for rapid dissemination of TTPs, IOCs, and incident reports, and participate in joint attribution and threat analysis exercises. Leverage Space ISAC’s resources, workshops, and collaborative groups to improve sector-wide situational awareness and collective defense.
  - This recommendation addresses the attribution and intelligence-sharing challenges highlighted in the intelligence product and CISA’s guidance. The Space ISAC’s mission is to facilitate collaboration and timely information exchange, which is critical for defending against both state and non-state threats.
  - Challenges include legal and regulatory barriers, concerns over sensitive data exposure, and the need for standardized reporting formats.
  - Metrics for success: Number of actionable threat intelligence exchanges, participation in joint attribution exercises, and improved attribution confidence levels in incident reports.
  - MITRE ATT&CK IDs: T1598 (Phishing for Information), T1589 (Gather Victim Identity Information), T1608 (Stage Capabilities).

---

# Suggested Pivots

1. How can attribution methodologies for space IoT cyber threats be enhanced by integrating established frameworks such as the Diamond Model and MITRE ATT&CK for ICS/space, and what comparative analysis can be conducted to evaluate their effectiveness against the challenges posed by proxy and blended state/non-state actor operations?
2. What specific supply chain and cloud security standards (e.g., NIST SP 800-161, ISO/IEC 27001) and advanced detection technologies (such as anomaly detection and SIEM integration) can be tailored and implemented to mitigate ransomware and data exfiltration risks in space sector operations, particularly in light of recent attacks like those by Interlock and Earth Ammit?
3. What forward-looking hybrid warfare trends targeting space IoT infrastructure are anticipated over the next 3–5 years, and how should international cooperation frameworks like Space ISAC evolve to enable proactive risk management, real-time threat intelligence sharing, and coordinated defense against combined cyber, electronic warfare, and physical attacks?

---

# Forecast

## Short-Term Forecast (3-6 months)

- **Sustained Increase in Supply Chain and Cloud Storage Attacks Targeting Space Sector**  
The 2025 Space Threat Assessment by Space ISAC indicates ransomware groups like Interlock will continue exploiting supply chain vulnerabilities and cloud storage misconfigurations (e.g., AWS S3 buckets) to exfiltrate sensitive satellite data and demand ransom. The recent Interlock attack on National Defense Corporation (NDC) and AMTEC, which exfiltrated 4.2 TB of data, exemplifies this trend. Organizations should expect more attacks leveraging living-off-the-land techniques and credential theft.
- **Escalation of GNSS Jamming and Spoofing by State Actors in Geopolitical Hotspots**  
Russian and Iranian actors have intensified GNSS interference campaigns, including jamming and spoofing, across conflict zones such as Ukraine and the Middle East. These operations disrupt military and commercial navigation and communication services, with Russia openly threatening commercial assets supporting U.S. military missions. Expect increased GNSS interference events aligned with geopolitical tensions, causing operational disruptions and raising escalation risks.
- **Increased Hacktivist Activity Targeting VSAT Terminals and Ground Infrastructure**  
Hacktivist groups like GhostSec, ArabianGhosts, and Mr Hamza have conducted DDoS, web defacement, and credential theft campaigns against Israeli satellite operators and VSAT terminals amid the Israel-Iran conflict. These politically motivated campaigns serve as information warfare and disruption tools. Similar hacktivist activity is likely to persist or increase in other politically sensitive regions.
- **Ongoing Attribution Challenges and Intelligence Sharing Needs**  
Attribution remains difficult due to proxy use and blending of state and non-state actors. Many incidents are only publicly claimed by attackers, complicating impact assessment. This underscores the need for enhanced cross-sector and international information sharing, such as through Space ISAC, to improve situational awareness and coordinated response.

### Examples

- Interlock ransomware attack on National Defense Corporation and AMTEC exfiltrating 4.2 TB of data (2024–2025)
- Russian Sandworm destructive malware attack on Viasat KA-SAT satellite internet (Feb 2022) causing outages in Ukraine and Europe
- Hacktivist DDoS and credential theft campaigns targeting Israeli satellite operators in 2025
- Iran’s Peach Sandstorm cyber espionage campaign using password spraying and social engineering (2024)

### What to Watch For

- Reports of new supply chain compromises or ransomware incidents involving satellite vendors or cloud providers
- GNSS interference or spoofing events reported in conflict zones or near critical infrastructure
- Public claims or evidence of hacktivist intrusions or disruptions targeting space sector ground infrastructure
- Increased participation and intelligence sharing activity in Space ISAC or similar forums
- Attribution reports indicating use of proxies or blended state/non-state operations

---

## Long-Term Forecast (12-24 months)

- **Maturation of Hybrid Warfare Targeting Space IoT Infrastructure**  
Adversaries, especially Russia and China, will increasingly integrate cyber, electronic warfare (EW), and physical attacks in coordinated campaigns against space assets and ground infrastructure. This hybrid warfare aims to degrade adversary command, control, communications, computers, intelligence, surveillance, and reconnaissance (C4ISR) capabilities and exert political coercion without triggering full-scale conflict.
- **Expansion and Formalization of Supply Chain Security and Zero Trust Architectures**  
In response to persistent supply chain and ransomware threats, space sector organizations will adopt rigorous cybersecurity supply chain risk management frameworks such as NIST SP 800-161 Rev. 1 and implement Zero Trust principles tailored for space systems. This includes continuous vendor risk assessments, multi-factor authentication, encryption, network segmentation, and anomaly detection integrated into procurement and operational processes.
- **Enhanced International and Cross-Sector Collaboration via Space ISAC and Related Initiatives**  
Information sharing and joint attribution efforts will become more formalized and widespread, improving situational awareness and collective defense capabilities. Legal, regulatory, and technical frameworks will evolve to facilitate rapid exchange of TTPs, IOCs, and incident reports, enabling proactive risk management against emerging threats.
- **Emergence of Advanced Persistent Threats with On-Orbit Maneuvering and Dual-Use Capabilities**  
China and Russia will continue developing and deploying sophisticated on-orbit maneuvering satellites and dual-use technologies capable of signals intelligence, satellite inspection, and potentially offensive counterspace operations. Indicators to watch include unusual satellite proximity events, multi-satellite formations, and uncharacteristic orbital maneuvers reported by space situational awareness entities.
- **Increased Targeting of Commercial Space Services and Dual-Use Assets**  
As commercial space services expand and integrate with critical infrastructure, adversaries will prioritize these targets for economic espionage, disruption, and ransom. The blurred lines between civilian and military space assets will elevate risks of collateral damage and escalation, necessitating tailored cybersecurity policies and minimum standards.
- **Development of Regulatory and Policy Frameworks Addressing Space Cybersecurity and Ransomware**  
Given the demonstrated ransomware threat to space assets, expect growing efforts by governments and industry to establish minimum cybersecurity standards, conduct tabletop exercises, and fund research into resilience measures. International cooperation on norms and legal frameworks for space cybersecurity will also advance, though challenges remain due to geopolitical competition.

### Examples

- Russian satellites (Kosmos 2581, 2582, 2583) performing close formation flying and rendezvous & proximity operations (RPO) in 2025
- China’s Four Heavenly Kings network and on-orbit refueling/docking missions demonstrating advanced dual-use capabilities
- Adoption of NIST SP 800-161 and Zero Trust frameworks in critical infrastructure sectors as a model for space cybersecurity
- Space ISAC’s growing role in facilitating international threat intelligence sharing and joint attribution
- University of Munster’s demonstration of ransomware attacks on satellites via software-defined radios (SDR) highlighting ransomware risks in space

### What to Watch For

- Formal adoption and enforcement of supply chain risk management and Zero Trust policies by major satellite operators and vendors
- Increased volume and speed of actionable intelligence exchanges and joint attribution exercises in Space ISAC and international forums
- Public disclosures or space situational awareness reports of anomalous satellite maneuvers, proximity events, or uncharacteristic orbital behaviors
- Rising ransomware or espionage incidents targeting commercial space service providers and dual-use assets
- Legislative or regulatory initiatives addressing space cybersecurity, ransomware resilience, and international norms

### Analytic Confidence and Caveats

- Confidence in short-term forecasts is high given recent documented incidents and ongoing geopolitical tensions
- Long-term forecasts carry moderate confidence due to uncertainties in adversary strategic decisions, technological developments, and international policy evolution
- Attribution challenges and potential misinformation campaigns may obscure true threat actor identities and intentions, requiring cautious interpretation of open-source reports

## MITRE ATT&CK IDs

T1195, T1195.002, T1461, T1462, T1486, T1530, T1078, T1555, T1598, T1589, T1608, TA0001, TA0040, TA0006, T1530

---

# Appendix

## References

1. (2025-09-02) - [Threat Briefing Year in Review: 2025 Space Threat Assessment (Space ISAC)](https://www.kratosspace.com/constellations/articles/threat-briefing-year-in-review-2025-space-threat-assessment?ref=blog.alphahunt.io)
2. (2025-04-28) - [CSIS 2025 Space Threat Assessment: Cyberattacks on space systems persist, tracking harder amid infrastructure threats](https://industrialcyber.co/reports/csis-2025-space-threat-assessment-cyberattacks-on-space-systems-persist-tracking-harder-amid-infrastructure-threats/?ref=blog.alphahunt.io)
3. (2025-07-04) - [Space ISAC warns of heightened cyber threats, GNSS interference in new threat assessment](https://industrialcyber.co/critical-infrastructure/space-isac-warns-of-heightened-cyber-threats-gnss-interference-in-new-threat-assessment/?ref=blog.alphahunt.io)
4. (2025-03-26) - [ENISA Space Threat Landscape 2025](https://www.enisa.europa.eu/publications/enisa-space-threat-landscape-2025?ref=blog.alphahunt.io)
5. (2024-06) - [CISA Space Systems Security and Resilience Landscape: Zero Trust in the Space Environment (PDF)](https://www.cisa.gov/sites/default/files/2024-06/Space%20Systems%20Security%20and%20Resilience%20Landscape%20-%20Zero%20Trust%20in%20the%20Space%20Environment%20%28508%29.pdf?ref=blog.alphahunt.io)
6. (2022-05) - [NIST SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations](https://csrc.nist.gov/pubs/sp/800/161/r1/final?ref=blog.alphahunt.io)
7. (2025-09-02) - [Space ISAC - Space Information Sharing and Analysis Center](https://spaceisac.org/?ref=blog.alphahunt.io)
8. (2022-03-30) - [Viasat spills on the Russian attack, warns of continued risks (The Register)](https://www.theregister.com/2022/03/30/viasat%5Fspills%5Fon%5Frussian%5Fattack/?ref=blog.alphahunt.io)
9. (2025-06-02) - [Space assets could be held ransom. Will we have any choice but to pay? (SpaceNews)](https://spacenews.com/space-assets-could-be-held-ransom-will-we-have-any-choice-but-to-pay/?ref=blog.alphahunt.io)
10. (2025-04-01) - [Cybersecurity Supply Chain Risk Management (C-SCRM) Guide (GSA)](https://www.gsa.gov/system/files?file=C-SCRM%20Acquisition%20Guide%20April%202025%20508reviewed.pdf&ref=blog.alphahunt.io)

## AlphaHunt

Stop doomscrolling, start decisioning. We chewed through the muck so your team doesn’t have to. → [Subscribe!](https://blog.alphahunt.io/#/portal/signup) • Forward to your on-call lead.

(Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :))

(c) 2025 CSIRT Gadgets, LLC

---

## MITRE ATTACK

## Techniques

1. \[T1195\] Supply Chain Compromise – Used in attacks where adversaries compromise vendors or software updates to access satellite networks, as seen in the Interlock ransomware attack on National Defense Corporation and the Viasat KA-SAT incident (Sandworm).

  - Directly mapped to: Interlock ransomware (data exfiltration via supply chain), Sandworm (Viasat KA-SAT supply chain compromise).
  - [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195/?ref=blog.alphahunt.io)
  - [ENISA Space Threat Landscape Report 2025, p. 24](https://www.enisa.europa.eu/sites/default/files/2025-03/Space%5FThreat%5FLandscape%5FReport%5Ffin.pdf?ref=blog.alphahunt.io)
  - [CSIS 2025 Space Threat Assessment](https://industrialcyber.co/reports/csis-2025-space-threat-assessment-cyberattacks-on-space-systems-persist-tracking-harder-amid-infrastructure-threats/?ref=blog.alphahunt.io)
2. \[T1461\] Signal Jamming – Used by Sandworm and Russian state actors to disrupt satellite communications, notably in the Viasat KA-SAT incident, causing widespread outages in Ukraine and Europe.

  - Directly mapped to: Sandworm (Viasat KA-SAT, GNSS jamming), Russian military operations.
  - [Signal Jamming](https://attack.mitre.org/techniques/T1461/?ref=blog.alphahunt.io)
  - [ENISA Space Threat Landscape Report 2025, p. 18](https://www.enisa.europa.eu/sites/default/files/2025-03/Space%5FThreat%5FLandscape%5FReport%5Ffin.pdf?ref=blog.alphahunt.io)
  - [Space ISAC Threat Briefing 2025](https://www.kratosspace.com/constellations/articles/threat-briefing-year-in-review-2025-space-threat-assessment?ref=blog.alphahunt.io)
3. \[T1486\] Data Encrypted for Impact – Ransomware groups like Interlock have used this technique to encrypt and extort space sector organizations, exfiltrating terabytes of sensitive data from National Defense Corporation and AMTEC.

  - Directly mapped to: Interlock ransomware (ransomware, data extortion).
  - [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486/?ref=blog.alphahunt.io)
  - [SpaceNews: Space assets could be held ransom](https://spacenews.com/space-assets-could-be-held-ransom-will-we-have-any-choice-but-to-pay/?ref=blog.alphahunt.io)
  - [ENISA Space Threat Landscape Report 2025, p. 27](https://www.enisa.europa.eu/sites/default/files/2025-03/Space%5FThreat%5FLandscape%5FReport%5Ffin.pdf?ref=blog.alphahunt.io)

### Tactics

1. \[TA0001\] Initial Access – Techniques such as supply chain compromise, phishing, and credential theft are used by both state and non-state actors (e.g., Peach Sandstorm, Interlock, hacktivists) to gain access to space sector networks and ground systems.

  - [Initial Access](https://attack.mitre.org/tactics/TA0001/?ref=blog.alphahunt.io)
  - [CSIS 2025 Space Threat Assessment](https://industrialcyber.co/reports/csis-2025-space-threat-assessment-cyberattacks-on-space-systems-persist-tracking-harder-amid-infrastructure-threats/?ref=blog.alphahunt.io)
2. \[TA0040\] Impact – Techniques like ransomware, destructive malware, and jamming are used to disrupt, degrade, or destroy space and ground infrastructure, as seen in the Viasat KA-SAT and Interlock incidents.

  - [Impact](https://attack.mitre.org/tactics/TA0040/?ref=blog.alphahunt.io)
  - [ENISA Space Threat Landscape Report 2025, pp. 18–28](https://www.enisa.europa.eu/sites/default/files/2025-03/Space%5FThreat%5FLandscape%5FReport%5Ffin.pdf?ref=blog.alphahunt.io)
3. \[TA0006\] Credential Access – Techniques such as password spraying and credential theft are used by Peach Sandstorm (Iran) and hacktivist groups to gain unauthorized access to satellite and aerospace networks.

  - [Credential Access](https://attack.mitre.org/tactics/TA0006/?ref=blog.alphahunt.io)
  - [CSIS 2025 Space Threat Assessment](https://industrialcyber.co/reports/csis-2025-space-threat-assessment-cyberattacks-on-space-systems-persist-tracking-harder-amid-infrastructure-threats/?ref=blog.alphahunt.io)

### Procedures

1. \[T1195.002\] Compromise Software Supply Chain – Used in the Viasat KA-SAT incident (Sandworm) and by APT41 in persistent supply chain attacks on satellite operators and ground systems.

  - [Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/?ref=blog.alphahunt.io)
  - [ENISA Space Threat Landscape Report 2025, p. 24](https://www.enisa.europa.eu/sites/default/files/2025-03/Space%5FThreat%5FLandscape%5FReport%5Ffin.pdf?ref=blog.alphahunt.io)
2. \[T1530\] Data from Cloud Storage Object – Interlock ransomware and other non-state actors have targeted cloud storage (e.g., AWS S3 buckets) used for satellite data, exfiltrating sensitive information for extortion.

  - [Data from Cloud Storage Object](https://attack.mitre.org/techniques/T1530/?ref=blog.alphahunt.io)
  - [Space ISAC Threat Briefing 2025](https://www.kratosspace.com/constellations/articles/threat-briefing-year-in-review-2025-space-threat-assessment?ref=blog.alphahunt.io)
3. \[T1462\] Signal Spoofing – Used by Russian and Iranian actors to disrupt GNSS and satellite operations, as documented in ENISA and Space ISAC reports.

  - [Signal Spoofing](https://attack.mitre.org/techniques/T1462/?ref=blog.alphahunt.io)
  - [ENISA Space Threat Landscape Report 2025, p. 18](https://www.enisa.europa.eu/sites/default/files/2025-03/Space%5FThreat%5FLandscape%5FReport%5Ffin.pdf?ref=blog.alphahunt.io)

### Software

1. \[S0608\] WhisperGate – Destructive malware used by Sandworm in the Viasat KA-SAT incident, targeting satellite and critical infrastructure.

  - [WhisperGate](https://attack.mitre.org/software/S0608/?ref=blog.alphahunt.io)
  - [ENISA Space Threat Landscape Report 2025, p. 19](https://www.enisa.europa.eu/sites/default/files/2025-03/Space%5FThreat%5FLandscape%5FReport%5Ffin.pdf?ref=blog.alphahunt.io)
2. \[S0662\] Cobalt Strike – Used by APT41, Interlock, and other actors for post-exploitation and lateral movement in space sector attacks.

  - [Cobalt Strike](https://attack.mitre.org/software/S0662/?ref=blog.alphahunt.io)
  - [Space ISAC Threat Briefing 2025](https://www.kratosspace.com/constellations/articles/threat-briefing-year-in-review-2025-space-threat-assessment?ref=blog.alphahunt.io)
3. \[S0386\] Mimikatz – Used by Peach Sandstorm and hacktivist groups for credential dumping and access escalation in aerospace and satellite sector intrusions.

  - [Mimikatz](https://attack.mitre.org/software/S0386/?ref=blog.alphahunt.io)
  - [CSIS 2025 Space Threat Assessment](https://industrialcyber.co/reports/csis-2025-space-threat-assessment-cyberattacks-on-space-systems-persist-tracking-harder-amid-infrastructure-threats/?ref=blog.alphahunt.io)

### Mitigations

1. \[M1047\] Audit – Regularly audit supply chain partners and cloud service providers to detect compromise, as recommended in response to supply chain and ransomware threats.

  - [Audit](https://attack.mitre.org/mitigations/M1047/?ref=blog.alphahunt.io)
  - [NIST SP 800-161 Rev. 1: C-SCRM](https://csrc.nist.gov/pubs/sp/800/161/r1/final?ref=blog.alphahunt.io)
2. \[M1037\] Filter Network Traffic – Deploy network filtering and anomaly detection at ground stations and uplinks to detect jamming, spoofing, and unauthorized access.

  - [Filter Network Traffic](https://attack.mitre.org/mitigations/M1037/?ref=blog.alphahunt.io)
  - [CISA Space Systems Security and Resilience Landscape](https://www.cisa.gov/sites/default/files/2024-06/Space%20Systems%20Security%20and%20Resilience%20Landscape%20-%20Zero%20Trust%20in%20the%20Space%20Environment%20%28508%29.pdf?ref=blog.alphahunt.io)
3. \[M1027\] Password Policies – Enforce strong password policies and multi-factor authentication to mitigate credential access attacks by Peach Sandstorm and hacktivist groups.

  - [Password Policies](https://attack.mitre.org/mitigations/M1027/?ref=blog.alphahunt.io)
  - [ENISA Space Threat Landscape Report 2025, p. 29](https://www.enisa.europa.eu/sites/default/files/2025-03/Space%5FThreat%5FLandscape%5FReport%5Ffin.pdf?ref=blog.alphahunt.io)

### Groups

1. \[G0034\] Sandworm Team (BlackEnergy, TeleBots, Voodoo Bear, Iron Viking)

  - Russian state actor responsible for destructive attacks on satellite and critical infrastructure, including the Viasat KA-SAT incident (T1461, T1195, S0608).
  - [Sandworm Team](https://attack.mitre.org/groups/G0034/?ref=blog.alphahunt.io)
  - [ENISA Space Threat Landscape Report 2025, p. 19](https://www.enisa.europa.eu/sites/default/files/2025-03/Space%5FThreat%5FLandscape%5FReport%5Ffin.pdf?ref=blog.alphahunt.io)
2. \[G0096\] APT41 (Double Dragon, BARIUM, Winnti)

  - Chinese state actor known for supply chain attacks and persistent espionage targeting satellite operators and ground systems (T1195, T1195.002, S0662).
  - [APT41](https://attack.mitre.org/groups/G0096/?ref=blog.alphahunt.io)
  - [CSIS 2025 Space Threat Assessment](https://industrialcyber.co/reports/csis-2025-space-threat-assessment-cyberattacks-on-space-systems-persist-tracking-harder-amid-infrastructure-threats/?ref=blog.alphahunt.io)
3. \[G0087\] Lazarus Group (Hidden Cobra)

  - North Korean state actor targeting aerospace and satellite sectors for espionage and military advantage (T1195, S0662).
  - [Lazarus Group](https://attack.mitre.org/groups/G0087/?ref=blog.alphahunt.io)
  - [Space ISAC Threat Briefing 2025](https://www.kratosspace.com/constellations/articles/threat-briefing-year-in-review-2025-space-threat-assessment?ref=blog.alphahunt.io)
4. Interlock (Ransomware Group)

  - Non-state actor responsible for ransomware and data exfiltration attacks on space sector supply chains and cloud storage (T1486, T1530, S0662).
  - [SpaceNews: Space assets could be held ransom](https://spacenews.com/space-assets-could-be-held-ransom-will-we-have-any-choice-but-to-pay/?ref=blog.alphahunt.io)
  - [ENISA Space Threat Landscape Report 2025, p. 27](https://www.enisa.europa.eu/sites/default/files/2025-03/Space%5FThreat%5FLandscape%5FReport%5Ffin.pdf?ref=blog.alphahunt.io)
5. GhostSec, ArabianGhosts, Mr Hamza (Hacktivist Groups)

  - Non-state actors conducting DDoS, web defacement, and credential theft against VSAT terminals and satellite operators (TA0006, T1530, S0386).
  - [Space ISAC Threat Briefing 2025](https://www.kratosspace.com/constellations/articles/threat-briefing-year-in-review-2025-space-threat-assessment?ref=blog.alphahunt.io)
  - [ENISA Space Threat Landscape Report 2025, p. 28](https://www.enisa.europa.eu/sites/default/files/2025-03/Space%5FThreat%5FLandscape%5FReport%5Ffin.pdf?ref=blog.alphahunt.io)