Around an hour before Russian forces invaded Ukraine, a cyber attack on Viasat‘s KA-SAT satellite broadband network disabled tens of thousands of customer modems in Ukraine and across Europe. In May 2022 the UK, US, and EU formally attributed the attack to Russia.
What happened
- Attackers reportedly gained access through a misconfigured VPN appliance and pushed destructive commands to modems, overwriting their memory.
- Security researchers identified wiper malware, dubbed AcidRain, that they linked to the attack.
- The disruption spread well beyond Ukraine; in Germany, remote monitoring of thousands of wind turbines was reported lost.
- On 10 May 2022 the UK’s NCSC, the US, and the EU publicly blamed Russia, saying the aim was to disrupt Ukrainian command and control.
Why it mattered
The attack showed how a cyber operation aimed at one country can spill over into allied states and critical infrastructure, and it became a defining example of cyber activity accompanying conventional war.
Lessons for organisations
Organisations should understand dependencies on third-party communications providers and plan for their loss. Hardening and patching remote access appliances, and testing continuity plans for connectivity outages, are core controls.
Sources: CyberScoop, Euronews
Part of our Top stories archive of headline-making events in information security, privacy, and AI. If you would like help applying the lessons to your organisation, contact us.
