In late February 2022, about an hour before Russia's invasion of Ukraine began, an attack hit Viasat's KA-SAT satellite network and disabled the modems of tens of thousands of European customers. On 10 May 2022 the US, the EU and the UK attributed it to Russia. Viasat confirmed that wiper malware, which researchers labeled AcidRain, was used, and said it shipped roughly 30,000 new routers to customers.
The effects reached physical equipment far from the battlefield. The Record reported that remote access to about 5,800 wind turbines in Germany that relied on Viasat routers was cut. Safeguard does not operate satellites, modems or turbines. This post is about the software and credential hygiene that CISA asked operators to check.
What's affected
CISA's advisory AA22-076A, "Strengthening Cybersecurity of SATCOM Network Providers and Customers," was first published on 17 March 2022 and last revised on 10 May 2022. It is archived, so check CISA's current guidance too. It speaks to any organization that runs or depends on a satellite communications link: providers, and customers such as utilities, shipping, aviation and remote industrial sites.
The point for equipment owners is that a terminal on your site is a computer on your network, run by someone else, with firmware you did not write.
How to check if you're exposed
Work through CISA's list for your own sites.
- List every SATCOM terminal, modem and router, who manages it, and which firmware version it runs.
- Look for insecure remote access tools talking to terminals: Telnet, FTP, SSH and VNC are the ones CISA names.
- Look for brute force login attempts over SATCOM network segments.
- Check whether any account that administers the terminals uses default credentials or weak passwords.
- Read the contract. CISA asks you to review trust relationships with IT service providers and make sure contracts address security, monitoring and incident notification.
What to do now
- Turn on multifactor authentication "where possible" for accounts that access or administer SATCOM networks.
- Remove default credentials, weak passwords and accounts for people who have left.
- Apply least privilege and audit it regularly.
- Add independent encryption across links you lease from your SATCOM provider, so the link is not the only protection.
- Patch operating systems, software and firmware after testing, and prioritize entries on CISA's Known Exploited Vulnerabilities catalog.
- Monitor logs for suspicious activity, baseline normal SATCOM traffic, and watch for traffic leaving SATCOM networks toward unexpected segments.
- Write, keep and exercise an incident response plan, a resilience plan and a continuity of operations plan.
How this could have been avoided
Public sources do not give the full technical path of the KA-SAT attack, so this section sticks to controls the advisory itself names. A provider side attack on a management network is blunted by MFA and least privilege on administrative accounts. Monitoring ingress and egress points looks for the anomalous traffic that precedes destructive actions. Independent encryption means a compromised link does not expose your data. A tested recovery plan, including spare hardware, shortens the outage when a terminal fleet must be replaced.
Why it matters
A modem is a small, boring, remote device. When thousands stop working at once, equipment that depends on them loses remote visibility and control. Dependency maps that stop at your own network miss this.
Your own software inventory helps in the same way for components you operate. A software bill of materials for management software and gateways, scanned against known exploited vulnerabilities, tells you quickly which of your assets share a flaw. The free scan at gold.safeguard.sh/scan runs in your browser, and the KEV list on Gold shows exploited entries.
Quick check
Which remote access tools does CISA tell SATCOM operators to look for?
Insecure ones such as Telnet, FTP, SSH and VNC that communicate with SATCOM terminals.
