Over 22,000 miles above Earth, KA-SAT is locked in orbit. Traveling at 7,000 miles per hour, in sync with the rotation of the planet, the satellite delivers high-speed internet to people across Europe. Since 2011, he’s been helping homeowners, businesses, and the military connect. However, when Russian troops entered Ukraine in the early hours of February 24, satellite internet connections were disrupted. A mysterious cyberattack on the satellite’s ground infrastructure – not the satellite itself – has plunged tens of thousands into internet darkness.
Among them were parts of the defenses of Ukraine. “It was a really huge loss in communications at the very beginning of the war,” said Viktor Zhora, a senior official with Ukraine’s cybersecurity agency, the State Services for Special Protection of Communications and Information. (SSSCIP). would have said two weeks later. He did not provide further details, and SSSCIP did not respond to WIRED’s request for comment. But the attack on the satellite internet system, owned by US company Viasat since last year, has had even wider ramifications. People using satellite internet connections have been knocked offline across Europe, from Poland to France.
Nearly a month after the attack, the disturbances continue. Thousands of people still remain offline across Europe – around 2,000 wind turbines are still disconnected in Germany – and companies are racing to replace faulty modems or repair connections with updates. Several intelligence agencies, including those in the United States and Europe, are also investigating the attack. The Viasat hack is arguably the largest publicly known cyberattack since Russia’s invasion of Ukraine, and it stands out for its impact beyond Ukraine’s borders. But questions remain over the details of the attack, its purpose and who carried it out, although experts have their suspicions.
Satellite Internet connections are often used in areas with poor cable coverage and are used by ordinary citizens, as well as official organizations. The setup is different from your typical home or work Wi-Fi network, which relies primarily on wired broadband connections. “Satellite communications are made up of three main components,” explains Laetitia Cesari Zarkan, consultant at the United Nations Disarmament Research Institute and doctoral student at the University of Luxembourg. First, there is the spacecraft that is in orbit, which is used to send “spot beams” to Earth; these beams provide internet coverage to specific areas on the ground. These beams are then captured by a parabolic antenna on the ground. They can be fixed on the sides of buildings but also in planes and power Wi-Fi in flight. And finally, there are terrestrial networks, which communicate with and can configure people’s systems. “The ground network is a collection of ground stations connected to the Internet by fiber optic cables,” says Zarkan.
Aside from Zhora’s comment, the Ukrainian government has remained tight-lipped about the attack. However, satellite communications, also known as SATCOM, seems to be used frequently in the country. Ukraine has the world’s most transparent system for tracking public spending, and several government contracts show that SSSCIP and the police bought the technology. For example, during the 2012 elections in Ukraine, more than 12,000 satellite internet hotspots were used to monitor voting, according to official documents spotted by European cybersecurity firm SEKOIA.IO.
“To disrupt satellite communications, most people – myself included – would watch the signal in space, because it’s exposed,” says Peter Lemme, an aviation specialist who also writes about satellite communications. “You can transmit signals to the satellite that would effectively interfere with its ability to receive signals from legitimate modems.” Elon Musk has claims that the Starlink satellite systems it sent to Ukraine faced jamming attacks.