If your business depends on a satellite link, treat it as part of your network, not as a service that sits outside it. CISA and the FBI advisory AA22-076A lists mitigations for providers and customers: strong authentication, least privilege, independent encryption, patching, monitoring and tested continuity plans.
Why the advisory exists
CISA and the FBI first published AA22-076A on 17 March 2022 and revised it on 10 May 2022. It is addressed to SATCOM network providers and their customers, especially critical infrastructure organisations. Its core warning is that successful intrusions into SATCOM networks could create risk in the customer environments behind them.
The 10 May update added attribution, stating that the US government attributes the threat activity to Russian state-sponsored malicious cyber actors. The advisory itself does not name specific victims or incidents, so this post does not either.
The checklist for customers
Work through these in order. Each maps to a recommendation in the advisory.
- Authentication. Use multifactor authentication where possible, follow current NIST password guidance, avoid default or weak credentials, and remove accounts you do not need.
- Least privilege. Limit privileges for people and for non-person accounts, and audit them on a schedule.
- Trust relationships. Review your relationships with IT service providers, drop the ones you do not need, and make sure contracts cover security, monitoring and incident notification.
- Independent encryption. Apply your own encryption across communication links you lease from or get through the SATCOM provider. Do not rely on the provider's protection alone.
- Patching and configuration. Patch promptly, put known exploited vulnerabilities first, and audit configurations regularly.
- Monitoring. Bring SATCOM traffic into your normal network monitoring, send logs to a SIEM, deploy endpoint detection where possible, and baseline normal traffic so deviations stand out.
- Resilience. Write, maintain and test incident response and continuity plans so critical functions continue if SATCOM or other systems are disrupted.
What providers are asked to add
For providers, the advisory adds monitoring at ingress and egress points to SATCOM equipment. It names examples of anomalies to look for: insecure remote access tools such as Telnet, FTP, SSH, SCP and VNC, unauthorised local or backup accounts, unexpected terminal to terminal traffic, and brute force login attempts. As a customer, you can ask your provider whether it watches for these.
Turning it into questions for your provider
- Who can administer the terminals at our sites, and how do they authenticate?
- Is our traffic encrypted end to end by us, or only by the link?
- How will you tell us about an incident, and how fast?
- What is the fallback if the link is down for a day?
Write the answers down. If the provider cannot answer, that is a finding.
The unglamorous part
Most items are basic hygiene. That is the point of the advisory. Shared accounts on a remote terminal, an unpatched management interface and an untested fallback plan are ordinary problems that matter more when the equipment sits on a roof in a remote place.
Quick check
Does the advisory ask customers to encrypt their own traffic?
Yes. It recommends independent encryption across all communications links leased from or provided by the SATCOM provider.
Sources
Last reviewed: 19 October 2026.
