How the KA-SAT Cyberattack Broke Connections on Earth

What connects a customer to the internet?#

A satellite broadband connection is a chain. At the customer's premises, a modem connects local equipment to a terminal and dish. Radio links carry data through the satellite to a gateway on the ground. The gateway connects to terrestrial data networks and the wider internet. Replies follow the corresponding route back.

The satellite is therefore one working part of a service that also needs functioning ground systems and customer equipment. A healthy spacecraft cannot make an unusable modem join its network.

ESA's description of the Hylas-1 broadband system usefully separates the gateways and user terminals from the centre that controls the spacecraft and its orbit. It is an architectural example, rather than a map of KA-SAT. The same distinction matters when reading the KA-SAT report: administering customer connectivity does not mean steering a satellite.

The diagram is deliberately conceptual. Its connecting lines show dependencies, not the attackers' exact route, a gateway location or a measured radio beam.

Sources: [3][2]

What did the attackers disable?#

Viasat's 30 March report describes intrusion into a ground management network, followed by misuse of legitimate administrative commands. Those commands overwrote important data in modems' flash memory—the storage that retains information without power—and prevented them reconnecting. The operator reported no evidence that the spacecraft was compromised.

SentinelLabs subsequently described malware called AcidRain, designed to erase data on modems and routers. Its updated research reproduced Viasat's confirmation that a destructive executable had been run using a legitimate management command. The command's administrative legitimacy describes how an operation could be launched; it does not make the executable benign. This also does not establish that the normal firmware-update system was compromised.

That is different from simply overwhelming a radio link. Viasat also described malicious traffic disrupting access early in the incident; the persistent modem failures created a separate recovery problem. Removing the traffic would not itself restore overwritten data.

The affected service was one consumer-oriented network partition, a logical subdivision. This was not every Viasat customer or every service carried by KA-SAT. Geography alone did not define the boundary: customers in different countries could depend on the same administered part of the network.

Sources: [2][1]

What does the attribution establish?#

On 10 May 2022, the European Union attributed the attack to Russia and linked its timing and effects to the invasion of Ukraine. The UK's National Cyber Security Centre assessed Russia as almost certainly responsible and said the Ukrainian military was believed to be the primary target.

These are official assessments of responsibility and intent. They answer a different question from an operator's account of failed equipment. The public declarations do not expose the full underlying intelligence, and the operator's technical report does not independently demonstrate every attribution claim.

The UK assessment also helps explain why a report that Viasat's directly managed government customers were unaffected does not settle who the attackers intended to harm. A customer-service category and an intelligence assessment of a target are different descriptions. Neither establishes a particular secret installation or military unit. The documented civilian consequences stand without inventing one.

Sources: [4][5][2]

Why did the wind turbines keep generating?#

ENERCON told The Stack that satellite-link failure had removed remote monitoring and control for 5,800 turbines in central Europe. It also said those turbines remained operational, generated electricity and could regulate themselves in automatic mode.

A remote connection carries information and commands. The turbine's local control system can continue operating when that connection disappears. Electricity delivery and remote visibility are different functions; losing one does not prove the loss of the other.

There is a further distinction inside the word control. In its 28 March release, ENERCON said grid operators retained access to control turbine behaviour on the electricity network, including limiting power fed into the grid. The failed service connection should therefore not be described as the disappearance of every control path.

The outage was still consequential. ENERCON said turbines without the connection lacked its supervisory monitoring and asked owners and operators to report faults directly to service contacts. Automatic generation did not give the maintenance team its distant view back. Nor does the evidence quantify how much electricity, if any, individual sites failed to produce during the disruption.

Sources: [6][7]

Why did restoration take work at the sites?#

Viasat said the modems were recoverable and that their physical electronics were undamaged. Some received remote updates; replacement modems were supplied where that was the quickest way to restore service. Recoverability on paper and convenient repair for a scattered customer base are different things.

ENERCON's recovery account makes the practical work visible. Service teams replaced satellite modems at turbines, while some wind farms regained communication through mobile networks. In its snapshot for 22 March, 677 wind farms had reconnected and 618 still lacked communication. Those are counts of wind farms, not individual turbines, and describe a historical recovery stage.

ENERCON also identified missing backup communication at many sites and proposed mobile-link retrofits. A second connection can help only if it remains available when the first fails. For a reader considering resilience, the useful question is what else a backup shares with the main service: equipment, administration, connectivity or power. That is a design question prompted by this incident, not a claim that every backup would have prevented it.

Sources: [2][7]

What does this change about a space attack?#

The KA-SAT incident shows how a disruption can follow shared communications infrastructure across national borders. The satellite's survival says little by itself about whether customers can use the service.

Assessing the damage requires several separate questions: is the spacecraft functioning, can customers connect, can operators observe and maintain their equipment, and can the equipment carry out its own task? Here, those answers diverged. Internet access and turbine monitoring suffered while the spacecraft was not reported compromised and turbines continued automatic operation.

A space service has a terrestrial boundary too. Understanding that boundary makes the consequences more precise: a serious communications failure, documented recovery work and international spillover, without an invented orbital collision or continent-wide blackout.

Sources: [2][6][5]