[Space] cybersecurity why satellites need protecting too

[Sting]

TL;DR

• Space systems have four parts to protect: the satellites, the ground stations that control them, the radio and laser links between them and the user terminals people rely on
• The February 2022 cyber attack on Viasat's KA-SAT network, attributed by the EU, UK and US to Russia, disabled tens of thousands of satellite modems across Europe and disrupted remote monitoring of thousands of wind turbines in Germany
• Research presented in 2025 by UC San Diego and the University of Maryland found that around half of the geostationary satellite signals they observed carried unencrypted traffic, including mobile network and in flight data
• Jamming and spoofing of satellite navigation signals have become widespread in some regions, affecting aviation and shipping
• Guidance is maturing, from US Space Policy Directive 5 and NIST reports to the EU's proposed Space Act, and long lived satellites need crypto agility for the post quantum era

Why space is a cybersecurity issue

Satellites underpin modern life in ways most people never notice. They provide navigation and timing for phones, aircraft, ships and power grids, carry television and internet traffic, observe weather and climate, and support banking, agriculture and defence. When satellite services fail, the effects ripple across many sectors at once. That makes space systems critical infrastructure in every meaningful sense

For a long time, satellite security relied on obscurity and physical inaccessibility. Satellites were expensive, specialised and operated by a few governments and companies, so attacks seemed unlikely. That assumption no longer holds. Thousands of commercial satellites now operate, ground equipment is increasingly built from standard IT components and attackers have shown both interest and capability

This thread explains the main parts of a space system, the threats each faces, real incidents and research findings, and how the industry and governments are responding. It also connects space security to post quantum cryptography, a topic close to this forum's heart. The tone is constructive, because awareness and good practice are growing quickly. Space security is becoming a recognised discipline

The four segments

Space systems are usually described in segments. The space segment consists of the satellites themselves, with their onboard computers, sensors and communication equipment. The ground segment includes control centres, ground stations, antennas and the networks connecting them. The link segment covers the radio and laser connections carrying commands, telemetry and user data

The user segment includes terminals, receivers and devices that use satellite services, from satellite dishes and phones to navigation receivers in cars and aircraft. Each segment has different vulnerabilities, and attackers often target the easiest one. In practice, ground and user segments are frequently weaker than satellites themselves, because they connect to ordinary networks. A secure satellite is only as strong as the systems that command it

Attackers vary widely in capability. Nation states have the resources for sophisticated operations against military and commercial satellites, while criminals may target ground systems for ransom or data. Hacktivists have claimed attacks on satellite related services during conflicts. Defences must account for this range

A landmark attack: Viasat KA-SAT

On 24 February 2022, as Russia's full scale invasion of Ukraine began, attackers disrupted Viasat's KA-SAT satellite broadband network, which served customers across Europe including Ukrainian users. They exploited a misconfigured VPN appliance to access the ground network, then pushed destructive commands that wiped tens of thousands of user modems, using malware later dubbed AcidRain. Modems in several countries were rendered unusable and had to be replaced. Around 5,800 wind turbines in Germany lost remote monitoring because they relied on the network

In May 2022, the European Union, the United Kingdom and the United States publicly attributed the attack to Russia. The incident showed that attacks on satellite systems can have immediate, cross border effects on civilian infrastructure. It also showed that the weakest point was not the satellite but the ground network and user terminals. Many space security discussions since then have referenced KA-SAT as a turning point

Unencrypted signals in the sky

Research has revealed how much satellite traffic travels without protection. In 2025, researchers from the University of California, San Diego and the University of Maryland presented a study, often referred to by its title Don't Look Up, in which they used commercial satellite equipment on a university rooftop to observe signals from 39 geostationary satellites. They reported that around half of the signals they captured contained unencrypted IP traffic. Only a minority of transponders used link level encryption, and few consistently used encryption such as IPsec

The exposed data included mobile network backhaul with text messages and calls from some carriers, in flight Wi-Fi traffic, voice over IP calls, corporate and banking data, and some government and military information. The researchers notified affected organisations, several of which then enabled encryption. The study echoed earlier research presented at security conferences showing satellite eavesdropping with modest equipment. Encryption on satellite links should never be assumed

Jamming and spoofing

Satellite navigation signals from GPS, Galileo, GLONASS and BeiDou are weak by the time they reach Earth, making them easy to jam with transmitters that drown them out. Spoofing goes further, broadcasting fake signals that trick receivers into reporting the wrong position or time. Both have become widespread in some regions, particularly around conflict zones such as the Baltic, the eastern Mediterranean and the Middle East. Aviation and maritime authorities have issued repeated warnings

The effects can be serious. Aircraft have lost navigation accuracy, ships have reported false positions, and systems that rely on satellite timing can drift. Aviation safety bodies have called for better resilience, including backup navigation and receivers that detect spoofing. This is one reason quantum navigation and timing technologies, discussed in other threads here, attract so much interest

Satellite communications can be jammed too. Conflicts have seen attempts to jam satellite internet terminals, prompting operators to update software and change transmission techniques. Resilient waveforms, frequency agility and directional antennas help. The contest between jammers and operators is ongoing

Commercial satellites increasingly support military and government users. That dual use makes commercial operators potential targets in conflicts, as the KA-SAT attack showed. Governments are working out how to protect commercial space infrastructure they rely on. Insurance and liability questions add complexity

Attacking satellites directly

Attacks on satellites themselves are harder but not impossible. Satellites run software that can contain vulnerabilities, and command links that lack strong authentication could in principle be abused to send malicious commands. Researchers have demonstrated weaknesses in some satellite firmware and protocols in controlled settings. Older satellites, designed before cybersecurity was a priority, may have limited protections

Security research in orbit has become more organised. The US Air Force and Space Force ran Hack-A-Sat competitions from 2020, inviting teams to find vulnerabilities in satellite systems, and in 2023 a small satellite called Moonlighter launched as an on orbit hacking sandbox for the competition. Such programmes build skills and reveal weaknesses safely. They reflect a shift towards treating space systems like any other attack surface

Ground stations and supply chains

Ground systems are often the most exposed part of a space system. They use ordinary servers, networks and software, and they may be connected to corporate IT or the internet. Ground station as a service offerings, where operators rent antenna time from cloud providers and specialist companies, add flexibility but also new dependencies. Strong identity, segmentation and monitoring are as important here as in any critical infrastructure

Supply chains matter too. Satellites and ground equipment incorporate components and software from many suppliers, including commercial off the shelf parts in small satellites. A compromised component or update could affect many missions. Supply chain security practices from the wider IT world, such as software bills of materials and secure development frameworks, increasingly apply to space

Small satellites deserve particular attention. CubeSats and other small spacecraft are cheaper and quicker to build, and many are launched by universities, startups and research groups with limited security expertise. Some have used unencrypted or weakly protected command links. Guidance tailored to small missions is growing, and secure by default components would help

Guidance and regulation

Governments have begun setting expectations. In September 2020, the US issued Space Policy Directive 5, establishing cybersecurity principles for space systems, including protection against unauthorised access, encryption of command links and supply chain risk management. NIST has published reports including IR 8270, Introduction to Cybersecurity for Commercial Satellite Operations, and IR 8401, on applying its Cybersecurity Framework to satellite ground segments. CISA coordinates with industry through working groups on space systems

In Europe, the European Commission proposed an EU Space Act in June 2025, including cybersecurity and resilience requirements for space operators serving the EU market. The NIS2 Directive already includes space as a sector of high criticality for some operators. The European Space Agency and national agencies have expanded their space security work. Standards bodies such as the Consultative Committee for Space Data Systems maintain security protocols for spacecraft communications

The post quantum dimension

Satellites present a particularly hard post quantum challenge. Many operate for ten to fifteen years or more, and their onboard cryptography may be difficult or impossible to replace after launch. Command authentication and encryption keys protected today with classical public key cryptography could become vulnerable during a satellite's operating life. Data downlinked today could also be recorded for future decryption

Crypto agility is therefore essential for new missions. Designers should plan for software updatable cryptography, sufficient processing capacity for larger post quantum keys and signatures, and key management that can transition to algorithms such as ML-KEM and ML-DSA. Symmetric cryptography with strong keys, such as AES-256, remains robust and is widely used for link encryption. Agencies and standards bodies are working on post quantum guidance for space systems

Practical steps for operators and users

• Encrypt all satellite links carrying sensitive data, and verify encryption is enabled rather than assumed
• Authenticate command links strongly and protect key management systems
• Secure ground systems with segmentation, phishing resistant MFA, patching and monitoring
• Treat user terminals as network endpoints that need updates and hardening
• Use resilient navigation and timing with backups and spoofing detection
• Apply supply chain security practices to satellite components and software
• Design new missions with crypto agility and a post quantum migration path

Closing thoughts

Space is no longer beyond the reach of cyber attackers, and the KA-SAT attack, research on unencrypted satellite links and widespread jamming all show why protection matters. The good news is that awareness has grown sharply, guidance is maturing and operators are investing in security. Many of the most effective measures are familiar ones, such as encryption, strong authentication and secure ground networks. Applying them consistently would close many gaps

If you work in the space sector, satellite communications or navigation, please share your perspective in the replies. Insights on practical challenges, such as patching satellites in orbit, would be especially valuable. This is a field where collaboration between space engineers and security professionals is essential


Key references for citation

• EU, UK and US attribution statements on the Viasat KA-SAT attack, May 2022
• Viasat, KA-SAT network cyber attack overview, 2022
• UC San Diego and University of Maryland researchers, Don't Look Up (study of unencrypted GEO satellite links), ACM CCS 2025
• US Space Policy Directive 5, Cybersecurity Principles for Space Systems, September 2020
• NIST IR 8270 and NIST IR 8401
• European Commission, proposal for an EU Space Act, June 2025