The terrible, horrible, no good, very bad day
Essential information
- Published
- 13/11/2025 23:20
- Modified
- 14/11/2025 11:44
- Tags
- 2025-11-13 acidrain cyberattack infrastructure ka-sat satellite ukraine vpn vulnerability vpnfilter wiper
- Related entities
- 6 observables, 9 techniques (mitre), 2 malware, 4 others
Description
On February 24, 2022, a cyberattack targeted Viasat's KA-SAT satellite network, exploiting a VPN vulnerability to access management systems. The attackers deployed AcidRain wiper malware, disrupting satellite communications for thousands of users in Ukraine and affecting 5,800 wind turbines in Germany. The attack, occurring just before Russia's invasion of Ukraine, showed similarities to the VPNFilter malware. While destructive, it was relatively minor compared to other infrastructure attacks on Ukraine. The incident highlights the ongoing challenges in satellite cybersecurity and the importance of robust defenses against evolving threats.