Space cybersecurity: Why there is a hidden threat to satellites and global infrastructure

The Center for Security Studies at ETH Zurich just released a study identifying 407 cyber operations targeting the space sector in 2025. The incidents affected at least 183 space-related organizations and involved 139 distinct threat actors.

Hacktivist groups accounted for most identified actors, and distributed denial-of-service (DDoS) attacks were the most frequently observed form of malicious activity.

Ransomware, data leaks and credential theft also affected space companies, agencies and research institutions, with a clear correlation to major geopolitical crises.

This is not a niche problem. Identified attacks have disabled satellite communications on oil tankers in Iran, global navigation satellite system (GNSS) antennas for seismic monitoring systems in Italy, and weather services in South Africa.

The figures are striking, and reflect a rising threat level. However, none of the 407 identified operations targeted a satellite in orbit. Instead, they all affected IT environments at space companies, ground stations and user modems on Earth.

That may read as reassuring evidence that satellites remain relatively secure. However, the absence of documented attacks against satellites more worryingly reflects the fact that the space sector lacks the ability to see them.

Computers and networks on Earth are surrounded by security tools. Detection sensors, logs and monitoring systems generate evidence when suspicious activity occurs.

Analysts examine that telemetry, identify indicators of compromise, reconstruct attackers' tactics and techniques, and feed that knowledge back into security systems.

Over time, a virtuous cycle emerges. Better detection reveals more attacks; those attacks produce more cyber threat intelligence, and that intelligence improves detection.

The space industry has long overlooked cybersecurity, however, and has not developed the same cycle. Most satellites lack dedicated onboard capabilities to detect malicious cyber activity. Without sensors, there may be little or no cyber telemetry to analyse.

And without that evidence, defenders cannot reliably build satellite-specific indicators of compromise, or learn how adversaries behave. The result is a vicious circle. What cannot be detected cannot become intelligence, and what never becomes intelligence cannot improve detection.

That blind spot changes our understanding of the 407 incidents; they are not a census of everything that happened to the space sector in 2025, just simply what we could see via open-source information.

The public threat landscape results from several filters: what can be detected, what victims disclose, what attackers claim, what researchers can access, and what can ultimately be verified.

Even the definition of the space sector changes the count. Should every attack on Boeing qualify? What about attacks against drones, which rely on satellite communications and navigation? Public visibility is further constrained by industry underreporting and the structure of the cyber threat intelligence market.

Most cybersecurity sensors monitor terrestrial IT environments, while few products are designed specifically to observe threats against spacecraft. On top of this, the most capable threat actors do not self-attribute the most sophisticated attacks.

The problem has deep roots. For much of the 20th century, the space industry operated under a security-by-obscurity paradigm. Governments and defence contractors controlled highly specialized systems.

Hardware and software were proprietary, protocols and system features were not publicly documented, technical information was closely guarded, and the physical inaccessibility of satellites was treated as a form of protection.

That model disappeared, as the rise of new space brought commercialization, private investment, digitalization, open-source software, global supply chains and widespread use of commercial, off-the-shelf components.

Companies now communicate more openly about technologies and partnerships. Meanwhile threat actors can buy components to find vulnerabilities.

This transparency has created a new form of insecurity. Potential attackers have access to growing amounts of information about space technologies that can provide key enabling information, while defenders still lack cyber threat intelligence – and do not benefit from systematic information sharing.

There is no credible route back to security by obscurity – the alternative is security by transparency. That does not mean publicly disclosing every incident; much of this threat intelligence will rightly remain within trusted communities.

However, it does mean using this transparency to better understand offensive capabilities and threat actors’ activities with cyber threat intelligence, and ensuring satellite operators can detect incidents, learn from them, and share information with like-minded partners.

The industry has begun adapting traditional cyber threat intelligence tools to the constraints of space systems. As those efforts mature, they may reveal just how incomplete today's public-threat picture really is.

They could also create the conditions for a space cyber threat intelligence market to emerge, by giving operators and agencies access to curated intelligence on past, current and emerging space threats – instead of forcing each space organization to build that capability alone.

To gain a clearer picture of the threat landscape affecting them, space companies should join Information Sharing and Analysis Centers – non-profit organizations that collect, analyse and share actionable cyber and physical threat intelligence among operators of critical infrastructure and government agencies.

They should also improve their understanding of the threat landscape across the entire lifecycle of their space systems, and develop on-board detection sensors to close the detection gap.

Read more about this in the newest publication Space Cyber Threat Intelligence: Threat Landscape Report 2025