View source for Viasat hack

{{Short description|Cyber attack on US communications company Viasat}}
{{Infobox military conflict
| conflict          = Viasat Hack; KA-Sat Attack
| place             = Geostationary Earth Orbit and Ukraine
| partof            = Russian invasion of Ukraine
| combatant1        = {{Tree list}}
*{{flag|Russia}}
** {{flagicon image|Флаг Главного разведывательного управления ГШ ВС РФ.png}} GRU
{{tree list/end}}
| combatant2        = {{tree list}}
*{{flag|Ukraine}}
**{{flagicon image|Flag of the State Special Communications Service of Ukraine.svg}} SSSCIP
*{{flagicon image|Transiting Exoplanet Survey Satellite artist concept (transparent background).png}} [[Company:Viasat (American company)|Viasat]]
**{{flagicon image|Transiting Exoplanet Survey Satellite artist concept (transparent background).png}} [[Company:Eutelsat|Eutelsat]]
*{{flagicon image|Flag of the U.S. National Security Agency.svg}} [[Organization:National Security Agency|NSA]]
*{{flagicon|UK}} [[Organization:GCHQ|GCHQ]]
{{tree list/end}}
| image             = {{Multiple image 
| perrow = 2/2/2
| total_width = 300
| border = infobox
| image1 =Viasat-2-satellite.jpg
| image2 =KA-SAT spot beams coverage.jpg
| image3 =UK-MOD-Ukraine-2022-03-24.jpg
| image4 = 
| image5 = 
| image6 =
}}
| result            = 
| notes             = {{Infobox malware
| child = yes
|technical_name=AcidRain
|author=[[Organization:Fancy Bear|Fancy Bear]], [[Organization:Sandworm (hacker group)|Sandworm]]
|date=23-24 February 2022
|target= {{flagicon|Italy}} [[Company:Eutelsat|Eutelsat]]
|suspect= {{flagicon|Russia}} 5.188.159.169
|package=Standalone ELF binary
|type=[[Wiper (malware)|Wiper malware]]
|subtype=[[Modem]] / [[Engineering:Router (computing)|Router]] [[Firmware|firmware]] [[Flash memory]] eraser
|classification=[[Cyberwarfare]] [[Cyberattack|cyberattack]]
|family=VPNFilter|isolation_date=15 March 2022
|version=AcidRain (SentinelOne / “ukrop” sample) — ELF 32-bit MIPS binary
|platform=*Modem firmware / KA-SAT
*[[MIPS architecture]]
*SurfBeam2
|file_type=ELF 32-bit MIPS executable
|exploit=Viasat/Skylogic management network
|language=Compiled C/C/C++}}
| action            = [[Russo-Ukrainian cyberwarfare]]
| map_alt           = 
| image_size        = 300
| mapframe          = yes
| commander2        = {{ubl
|{{flagicon image|Flag of the State Special Communications Service of Ukraine.svg}} Yuriy Shchyhol
|{{flagicon image|Flag of the State Special Communications Service of Ukraine.svg}} Victor Zhora
}}
}}

The '''Viasat hack''' was a [[Cyberattack|cyberattack]] against the [[Engineering:Satellite internet constellation|satellite internet]] system of American communications company [[Company:Viasat (American company)|Viasat]] which affected their [[Engineering:KA-SAT|KA-SAT]] network. The hack happened on the day of Russia's invasion of Ukraine.<ref name="pc-mag-nsa-investigates-viasat-hack2">{{Cite news |last=Mott |first=Nathaniel |date=2022-03-12 |title=Report: NSA Investigates Viasat Hack That Coincided With Ukraine Invasion |url=https://www.pcmag.com/news/report-nsa-investigates-viasat-hack-that-coincided-with-ukraine-invasion |url-status=live |archive-url=https://web.archive.org/web/20230407225056/https://www.pcmag.com/news/report-nsa-investigates-viasat-hack-that-coincided-with-ukraine-invasion |archive-date=2023-04-07 |access-date=2023-04-07 |work=PCMag}}</ref> This was a hack in three stages and two events; gaining entry into a facility, uploading a malware to a satellite, and then having that satellite beam that signal back down to Earth, targeted at internet modems throughout Ukraine.<ref>{{Cite web |last=Vasquez |first=Christian |date=2023-08-10 |title=Satellite hack on eve of Ukraine war was a coordinated, multi-pronged assault |url=https://cyberscoop.com/viasat-ka-sat-hack-black-hat/ |access-date=2025-12-12 |website=CyberScoop |language=en-US}}</ref><ref>{{Cite web |last=Quiquet |first=François |date=2023-10-10 |title=An analysis of the Viasat cyber attack with the MITRE ATT&CK® framework |url=https://www.spacesecurity.info/an-analysis-of-the-viasat-cyber-attack-with-the-mitre-attck-framework/ |access-date=2025-12-12 |website=Space & Cybersecurity Info |language=fr-FR}}</ref><ref>{{Cite web |last=Poireault |first=Kevin |date=2023-05-09 |title=Five Takeaways From the Russian Cyber-Attack on Viasat’s Satellites |url=https://www.infosecurity-magazine.com/news/takeaways-russian-cyberattack/ |access-date=2025-12-12 |website=Infosecurity Magazine |language=en-gb}}</ref> Collateral spillover did leak outside of the borders of Ukraine, impacting internet modems in Germany, [[Place:Scandinavia|Scandinavia]], the United Kingdom, and elsewhere throughout Europe.
==Events==
On February 23, 2022, hackers targeted a [[Virtual private network|VPN]] installation, in a [[Place:Turin|Turin]] management center managed by [[Company:Eutelsat|Eutelsat]], which provided network access to administrators and operators. The hackers gained access to management [[Server (computing)|servers]] that gave them access to information about company’s [[Modem|modems]]. After a few hours, the hackers gained access to another server that delivered software updates to the modems which allowed them to deliver the novel [[Wiper (malware)|wiper]] malware AcidRain.<ref>{{Cite web |last=Greig |first=Jonathan |date=11 August 2023 |title=NSA, Viasat say 2022 hack was two incidents; Russian sanctions resulted from investigation |url=https://therecord.media/viasat-hack-was-two-incidents-and-resulted-in-sanctions |access-date=2024-03-06 |website=therecord.media |language=en}}</ref> Wiper malwares are designed to render their targets completely useless.

On 24 February, 2022, the day Russia invaded Ukraine, thousands of Viasat modems went offline.<ref>{{Cite magazine |last=Burgess |first=Matt |date=23 March 2022 |title=A Mysterious Satellite Hack Has Victims Far Beyond Ukraine |url=https://www.wired.com/story/viasat-internet-hack-ukraine-russia/ |archive-url=https://web.archive.org/web/20240127184124/https://www.wired.com/story/viasat-internet-hack-ukraine-russia/ |archive-date=2024-01-27 |access-date=2024-07-17 |magazine=Wired |language=en-US |issn=1059-1028}}</ref> The attack also caused the malfunction in the remote control of 5,800 [[Company:Enercon|Enercon]] wind turbines in Germany and disruptions to thousands of organizations across Europe.<ref>{{Cite news |last1=Sheahan |first1=Maria |last2=Steitz |first2=Christoph |last3=Rinke |first3=Andreas |name-list-style=and |date=2022-02-28 |editor-last=Murray |editor-first=Miranda |editor-last2=Baum |editor-first2=Bernadette |title=Satellite outage knocks out thousands of Enercon's wind turbines |url=https://www.reuters.com/business/energy/satellite-outage-knocks-out-control-enercon-wind-turbines-2022-02-28/ |url-status=live |archive-url=https://web.archive.org/web/20230408013103/https://www.reuters.com/business/energy/satellite-outage-knocks-out-control-enercon-wind-turbines-2022-02-28/ |archive-date=2023-04-08 |access-date=2023-04-07 |work=Reuters}}</ref>

On 31 March, 2022, [[Company:SentinelOne|SentinelOne]] researchers Juan Andres Guerrero-Saade and Max van Amerongen announced the discovery of a new [[Wiper (malware)|wiper]] malware codenamed AcidRain designed to permanently disable routers.<ref>{{cite web |last=Goodin |first=Dan |date=31 March 2022 |title=Mystery solved in destructive attack that knocked out >10k Viasat modems |url=https://arstechnica.com/information-technology/2022/03/mystery-solved-in-destructive-attack-that-knocked-out-10k-viasat-modems |url-status=live |archive-url=https://web.archive.org/web/20230326154110/https://arstechnica.com/information-technology/2022/03/mystery-solved-in-destructive-attack-that-knocked-out-10k-viasat-modems/ |archive-date=26 March 2023 |access-date=7 April 2023 |publisher=Ars Technica}}</ref> Viasat later confirmed that the AcidRain malware was used during the 'cyber event'.<ref>{{cite web |author=Guerrero-Saade, Juan Andres |title=AcidRain: A Modem Wiper Rains Down on Europe |date=31 March 2022 |url=https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ |url-status=live |archive-url=https://web.archive.org/web/20240115022507/https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ |archive-date=2024-01-15 |access-date=2023-04-07 |publisher=SentinelLabs}}</ref> AcidRain shares code with VPNFilter, a 2018 cyber operation against routers attributed to the Russian military by the FBI.<ref>{{cite web |date=23 May 2018 |title=Justice Department Announces Actions to Disrupt Advanced Persistent Threat 28 Botnet of Infected Routers and Network Storage Devices |url=https://www.justice.gov/opa/pr/justice-department-announces-actions-disrupt-advanced-persistent-threat-28-botnet-infected |url-status=live |archive-url=https://web.archive.org/web/20230419085350/https://www.justice.gov/opa/pr/justice-department-announces-actions-disrupt-advanced-persistent-threat-28-botnet-infected |archive-date=19 April 2023 |access-date=7 April 2023 |publisher=U.S. Department Of Justice}}</ref>

On 10 May, 2022, the [[Social:European Union|European Union]], the [[United States]], and the United Kingdom condemned the attack targeting Viasat's KA-SAT network as a Russian operation.<ref>{{cite web |date=10 May 2022 |title=Russian cyber operations against Ukraine: Declaration by the High Representative on behalf of the European Union |url=https://www.consilium.europa.eu/en/press/press-releases/2022/05/10/russian-cyber-operations-against-ukraine-declaration-by-the-high-representative-on-behalf-of-the-european-union/ |url-status=live |archive-url=https://web.archive.org/web/20240128214344/https://www.consilium.europa.eu/en/press/press-releases/2022/05/10/russian-cyber-operations-against-ukraine-declaration-by-the-high-representative-on-behalf-of-the-european-union/ |archive-date=2024-01-28 |access-date=2023-04-07 |publisher=Council of the EU}}</ref><ref>{{Cite web |title=Attribution of Russia's Malicious Cyber Activity Against Ukraine |url=https://www.state.gov/attribution-of-russias-malicious-cyber-activity-against-ukraine/ |access-date=2024-09-02 |website=United States Department of State |language=en}}</ref><ref>{{Cite web |title=Russia behind cyber-attack with Europe-wide impact an hour before Ukraine invasion |url=https://www.gov.uk/government/news/russia-behind-cyber-attack-with-europe-wide-impact-an-hour-before-ukraine-invasion |access-date=2024-09-02 |website=GOV.UK |language=en}}</ref>

==See also==
*[[Social:Cyberwarfare by Russia|Cyberwarfare by Russia]]
*Russian sabotage operations in Europe

==References==
<references responsive="1"></references>

==External links==

* [https://news.viasat.com/blog/corporate/ka-sat-network-cyber-attack-overview KA-SAT Network cyber attack overview] - from Viasat

[[Category:Cyberattacks]]
{{Hacking in the 2020s|collapsed}}

{{Sourceattribution|Viasat hack}}