Kaspersky Warns of Cyber Threats Targeting Space Navigation Systems

Kaspersky warned of a rising cyber threat to space systems, noting that over 3,000 GNSS receiver devices are directly exposed to internet attacks, potentially disrupting air, sea and land logistics.

Threat Details

The warning is based on a report by the Industrial Control Systems Cyber Emergency Response Team (ICS CERT) presented at GISEC 2026. The report stresses that protecting space infrastructure now involves not only satellites but also a complex network of ground control stations, communication links and user devices relying on third‑party software.

Public records show more than a hundred cyber incidents targeting space assets from 1957 to the early 2020s. Attackers exploit vulnerabilities in ground equipment and internet‑connected receivers as entry points to critical systems.

Context and Implications

Kaspersky researchers audited GNSS receivers together with 70 global equipment suppliers after a sharp rise in GPS and GNSS signal spoofing in the Black Sea region in 2023. The audit revealed over 3,000 devices had suffered direct internet attacks, prompting calls for stronger authentication and restricted external access.

Advanced Persistent Threat groups such as Turla and Whitebear have leveraged unencrypted satellite data streams to route their servers, while the Thrip group targets satellite operators and geospatial databases. The 2022 KA‑SAT attack on Viasat’s network demonstrated how destructive malware like AcidRain can disable tens of thousands of satellite links, causing a cascade that halted around 5,800 wind turbines across Europe.

Ekateryna Rodina, Kaspersky’s senior security analyst, emphasized that growing reliance on satellite‑based navigation and energy systems demands end‑to‑end encryption and regular firmware updates to prevent espionage and data tampering.

Kaspersky recommends organizations conduct regular audits of ground stations and user devices, and deploy robust endpoint protection to mitigate cyber risks that could spill over to other critical sectors.