A look at Russia's cyberattack on Viasat's KA-SAT network in February 2022, leading some countries and the satellite industry to rethink satellite cybersecurity
Andreas Wickberg loves snowmobiling to the house he built in the icy reaches of Lapland, north of the Arctic Circle.
Context & Ripple Effects
The attack opened the Russia/Ukraine cyberwar before most of it was even visible: as Bloomberg's retrospective notes, the strike on Viasat's KA-SAT network hit on February 24, 2022, the same day Russian troops crossed into Ukraine — the opening move of the cyber campaign that initially drowned beneath the conventional war coverage. Within weeks, NSA and other agencies were investigating the outage that knocked satellite internet offline across Europe (NSA probe into the KA-SAT blackout).
The picture has since sharpened: researchers tied the disruption to AcidRain, an allegedly Russia-linked wiper sharing DNA with VPNFilter (AcidRain identified as the culprit), the blast radius extended to roughly 27,000 European users beyond Ukraine (27K users hit across Europe), and by May the UK and EU formally attributed the attack to Russia (UK-EU attribution to Russia). The year-later framing matters because it converts a wartime incident into a standing lesson about satellites as attackable infrastructure.
First-order effects
- Viasat spent weeks restoring service to thousands of still-offline modems across Europe, while Ukraine's military and government — heavy KA-SAT users at invasion's start — lost connectivity in their first hours of war.
- The UK and EU's formal attribution put Russia publicly on record as the attacker, giving Western governments a named case study for treating commercial satellite operators as critical national infrastructure.
Second-order effects
- Satellite operators beyond Viasat face pressure to redesign modem and terminal security, since AcidRain showed a single wiper pushed through a management plane can brick hardware fleets at scale — a cost and firmware-update burden across the industry's installed base.
- Governments that leaned on commercial satcom for resilience now weigh redundant, diversified providers and hardened procurement terms, reshaping how defense and civil agencies buy satellite capacity.
Third-order effects
- If the pattern holds, commercial satellite networks get pulled into the same regulatory and alliance frameworks as telecoms — attribution statements like the UK-EU one becoming the template for collective response to attacks on shared orbital infrastructure.
- Satellite broadband's role as wartime backup makes it a strategic target, pushing the industry toward treating every ground terminal as part of a defended perimeter rather than a consumer device.
The trend: Commercial satellite networks are being reclassified from consumer services to contested strategic infrastructure, with states building attribution and defense doctrine around them.