INDUSTRY FACT FILE · SPACE, SATELLITE & GEOSPATIAL SERVICES

Threat Landscape: Top Cyber Threats Facing Space and Satellite Businesses

The 18 most relevant cyber threats, attacks and industry challenges for satellite makers and operators, launch start-ups, ground station and teleport operators, satcom providers, earth observation and geospatial platforms and navigation vendors, and the impact each has.

Space and geospatial businesses face attackers with very different aims. State-linked groups seek designs, mission data and access to satellite services that matter in a crisis, and the KA-SAT attack of February 2022 showed that a satellite service can be disabled at the moment it is most needed. Criminal groups use ransomware against manufacturers, launch firms, teleports and platform providers because downtime during integration, a launch campaign or a satellite pass creates pressure to pay. Opportunistic attackers scan the internet for exposed antenna controllers, modems, management interfaces, remote desktop services and storage buckets. Researchers and curious customers find flaws in APIs and terminals, which become public quickly. Insiders and contractors with shared operator or vendor accounts can misuse access to command systems and data, and suppliers deep in the chain can introduce weaknesses without anyone noticing.

Public reporting shows how these risks are moving. On 24 February 2022 attackers used the management network of the KA-SAT service to deliver the AcidRain wiper to modems; Viasat said tens of thousands of terminals were disabled, Enercon reported that about 5,800 wind turbines lost remote monitoring, and the EU, UK and US attributed the attack to Russia in May 2022. CISA and the FBI followed with an advisory to satcom providers and customers. ISRO's chairman said in October 2023 that the agency faces more than 100 cyber attacks a day, and he spoke of building onboard cyber defences for spacecraft. GNSS interference reports near Indian airports in 2025 show that location services cannot assume a clean signal. Regulators are responding: India's Telecom Cyber Security Rules of November 2024 reach satcom licensees, and the proposed EU Space Act would require cyber risk management, testing and incident reporting from space operators, including for ground infrastructure.

The list below is a practical assessment framework, not a statistical ranking. Priority varies by business model, technology exposure and existing controls.

The matrix is a qualitative guide for prioritising the first round of security reviews.

Figure 5: Qualitative threat relevance by space, satellite and geospatial segment (Codec Networks assessment).

4.1 Ground stations and the management plane

Most attacks on space services land on the ground. Antenna controllers, modems, baseband equipment and scheduling systems are often reachable from vendor tunnels or corporate networks, and satcom network management systems and update servers control thousands of terminals. The KA-SAT attack began with a misconfigured VPN into the management network and ended with destructive updates to tens of thousands of modems. Shared teleports and ground-station-as-a-service models add a further risk: one compromised customer or portal can affect others.

• Questions to test: Can anyone reach our antenna control, baseband or NMS from the internet or office network? Is every management and vendor account named and protected with MFA? Are update servers segmented and monitored? Do terminals reject unsigned or downgraded firmware? Are customers isolated from each other?
• Relevant services: ground network and teleport VAPT, NMS and update server assessment, segmentation design, vendor access review and managed SOC monitoring of management planes.

4.2 Command paths and key custody

Whoever can send authenticated commands controls a satellite. Mission control software, TT&C systems, flight dynamics tools and the keys that authenticate and encrypt commands are the crown jewels, yet they are often reached through shared accounts, standing privileges and engineering laptops. Weak custody of keys, or command systems that trust any user on the mission network, can turn a stolen password into a mission-ending event.

• Questions to test: Who can send commands, and how is each command authorised and logged? Where are command and encryption keys held, and who can use them? Are mission networks isolated from corporate IT? Are privileged sessions recorded? Would we notice an unusual command or pass booking?
• Relevant services: mission control and TT&C reviews, privileged access and key custody assessments, segmentation reviews, and SOC use cases for command and scheduling anomalies.

4.3 APIs, cloud platforms and data delivery

Earth observation, geospatial and location businesses sell through cloud platforms and APIs. Broken object-level authorisation, where an API trusts an order or customer identifier sent by the client, is a common and serious flaw, and old API versions, exposed storage and weak tenant isolation can leak imagery of sensitive sites or movement histories of people. Government and enterprise buyers increasingly ask for evidence that these platforms have been tested.

• Questions to test: Does every API check that the caller may see the object requested? Are old API versions retired? Is tenant isolation tested in every release? Is storage private by default with expiring links? Would we notice bulk downloads or enumeration?
• Relevant services: API and multi-tenant VAPT, cloud configuration review, DevSecOps pipeline review, abuse monitoring and DPDP data handling reviews.

4.4 Supply chain and flight software integrity

Satellites integrate components and software from many suppliers, often delivered as finished images that are hard to inspect, and fixing a flaw after launch is difficult or impossible. A breached supplier build server, a malicious open-source library or a counterfeit part can introduce hidden functions that only surface in orbit. Buyers, investors and foreign partners increasingly ask makers to show how they assure what they integrate.

• Questions to test: Do we hold SBOMs for flight and ground software? Do we verify supplier images against hashes or signatures? Are integration test benches isolated and monitored? Do contracts require suppliers to notify us of incidents? Are critical suppliers assessed each year?
• Relevant services: supplier and component assurance, SBOM and software integrity reviews, secure SDLC reviews, test bench segmentation and incident response for supplier compromise.

4.5 Location services and navigation resilience

Navigation receivers, telematics and location apps depend on GNSS and NavIC signals that can be degraded by jamming or falsified by spoofing, and they collect precise location data that reveals where people live, work and travel. Designs need to detect unreliable positions, cross-check other sources and fail safely, and location data needs minimisation, short retention and strong API controls under the DPDP Act.

• Questions to test: Do our receivers and apps detect position jumps or integrity loss? Are fallbacks tested? How long do we keep precise location histories, and who can query them? Are SDKs collecting more than they need? Are location APIs authenticated and monitored?
• Relevant services: location platform and SDK testing, DPDP programmes for location data, authorised resilience testing in controlled environments under the applicable permissions, and API abuse monitoring.

• CERT-In: incidents reported within six hours of noticing them; logs kept for 180 days in India and available for investigation; CERT-In may issue directions and advisories.
• Telecom Cyber Security Rules 2024: telecom entities, including satcom licensees, report security incidents within six hours with details within 24 hours, and the government may order audits or public disclosure.
• IN-SPACe and the Department of Space: incidents affecting authorised space objects or ground systems can raise questions under the terms of authorisation.
• NCIIPC: where a service supports notified protected systems in critical sectors, incidents draw in the protected system owner and NCIIPC.
• DPDP Act: breach intimation and safeguards for personal and location data once provisions commence; SEBI LODR disclosure for listed firms.
• Customers and partners: government buyers, telecom operators and foreign partners can suspend contracts, demand audits or exercise security clauses after incidents.

• If our management network were breached, could it push a malicious update to every terminal?
• Who can reach our antennas, mission control and command keys today, including vendors, and with what authentication?
• Does every API that sells imagery or location data check who is asking, every time?
• Can we verify the integrity of every component and software image we integrate?
• How long do we keep precise location data, and who can query it?
• Could we detect, contain and report a ground segment incident within six hours, including at night?

Note: Threat descriptions and relevance ratings are general guidance, not findings about any specific organisation, satellite or service. Public incident references are summarised from official statements and widely reported events. Interference threats are described only at the level needed to explain defences, and testing is described only as authorised testing in controlled environments, coordinated with the customer and any required licences and permissions.