Sources: NSA and other agencies are investigating an attack that disabled Viasat's satellite internet service in Europe on February 24 as Russia invaded Ukraine
Context & Ripple Effects
The Russia/Ukraine cyberwar opened with a strike on Viasat's KA-SAT hours before tanks crossed the border, and this Reuters report shows the US intelligence community formally taking up the forensic work. The timing matters: the outage hit on February 24, the first day of the invasion, making it the clearest early signal that the war would include attacks on civilian communications infrastructure.
Subsequent reporting filled in the scale — roughly 27,000 users across Europe were knocked offline, thousands of them still down weeks later — and by May the UK and EU had publicly attributed the attack to Russia (formal government attribution)
First-order effects
- Viasat faces a dual burden: restoring tens of thousands of disconnected European customers while its network becomes evidence in an active multi-agency NSA-led investigation.
- US and allied intelligence agencies must coordinate attribution from shared forensics, since the outage degraded connectivity well beyond Ukraine's borders.
Second-order effects
- Government attribution converts a technical incident into a diplomatic one, giving the UK and EU grounds for collective response against Russia over an attack on commercial infrastructure.
- Satellite operators across Europe face immediate customer and regulator scrutiny of their ground-segment security, since the KA-SAT breach showed modems and management tools can be weaponized at fleet scale.
Third-order effects
- The pattern points toward satellite networks being treated as critical wartime targets on both sides — mirrored later when hackers claimed the takedown of Russian provider Dozor-Teleport — pushing countries and the satellite industry toward a rethink of satellite cybersecurity standards.
- If commercial satcom stays a battlefield objective, operators will need state-grade defense and incident-sharing arrangements, blurring the line between telecom providers and national-security infrastructure.
The trend: Commercial satellite internet is becoming a frontline target in interstate conflict, forcing governments to attribute attacks publicly and the industry to rebuild cybersecurity around ground infrastructure.