ALT-40 · Analysis · 23 Oct 2026
Viasat KA-SAT: the hour before the invasion
As Russia invaded Ukraine, a cyberattack wiped tens of thousands of satellite modems across Europe — and left thousands of wind turbines in central Europe without remote monitoring. What is known about how.
- 24 Feb 2022Denial-of-service traffic, then destructive commands sent to modems.
- 30 Mar 2022Viasat publishes an overview of the attack.
- 31 Mar 2022SentinelLabs publishes its analysis of AcidRain.
- 10 May 2022The EU attributes the attack to Russia.
- Enercon wind turbines in central Europe that lost remote monitoring
- ~5,800Enercon, via Reuters / Euronews
The spill-over
The target appears to have been Ukrainian military communications. The damage reached broadband customers across Europe and remote monitoring of wind turbines in central Europe: shared infrastructure meant shared consequences.
Our reading
Analysis — Altumptic's interpretation of the sources below.
- Management networks are the crown jewels of any service provider.
- In a conflict, civilian infrastructure shared with a target is in scope.
- Devices that can be bricked remotely need recovery paths that do not depend on the network.
What to do
- Put management planes behind strong authentication and separate networks.
- Audit VPN appliances for misconfiguration; they are a common first foothold.
- Plan for a mass device-replacement scenario.
Sources
- Viasat — KA-SAT network cyber attack overview
- SentinelLabs — AcidRain: a modem wiper rains down on Europe
- EEAS — Russian cyber operations against Ukraine: declaration on behalf of the EU (10 May 2022)
- Euronews (Reuters) — Satellite outage knocks out control of Enercon wind turbines
Altumptic has no involvement in these incidents and no non-public information about them. Figures are as reported by the sources above on the dates given.
Cite this entry
Altumptic Lab (2026). ALT-40 — Viasat KA-SAT: the hour before the invasion. 23 Oct 2026. altumptic.com/research/viasat-ka-sat-2022