INCIDENT REPORT · CP-2022-001

Viasat KA-SAT satellite network attack

L3 · ELEVATEDCONFIRMED

On 24 February 2022, about an hour before Russia's invasion of Ukraine, a cyberattack disrupted Viasat's KA-SAT consumer satellite broadband service. The AcidRain wiper was used against user modems.

Incident ID: CP-2022-001
Incident date: 24 FEB 2022
Detection date: 24 FEB 2022
Affected countries: Ukraine, Germany
Plotted location: Kyiv, Ukraine (Primary affected country (KA-SAT users in Ukraine))
Threat classification: Level 3 — ELEVATED
Classification rationale: Disruption of satellite communications with cross-border spillover to energy infrastructure monitoring.
Attack type: Wiper / Destructive Malware
Nature: Malicious activity
Attack vector: Malicious commands to SurfBeam2/SurfBeam2+ modems leading to deployment of the AcidRain wiper; Viasat cited a VPN misconfiguration as the initial access
Sectors: Telecommunications, Energy, Defense
Critical infrastructure: Yes
Organizations affected: Viasat (KA-SAT network), KA-SAT consumer broadband users in Ukraine and Europe, Enercon (wind turbine remote monitoring)
Operational consequences: Thousands of modems in Ukraine and tens of thousands across Europe were disabled. Remote monitoring links to around 5,800 Enercon wind turbines in Germany were interrupted, though the turbines kept operating.
Estimated financial impact: No reliably documented figure
Attribution (as stated): Attributed by the European Union (10 May 2022), the UK and the US to the Russian Federation

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

Viasat KA-SAT satellite network attack

L3 · ELEVATEDCONFIRMED

On 24 February 2022, about an hour before Russia's invasion of Ukraine, a cyberattack disrupted Viasat's KA-SAT consumer satellite broadband service. The AcidRain wiper was used against user modems.

Incident ID

CP-2022-001

Incident date

24 FEB 2022

Detection date

24 FEB 2022

Affected countries

Ukraine, Germany

Plotted location

Kyiv, Ukraine (Primary affected country (KA-SAT users in Ukraine))

Threat classification

Level 3 — ELEVATED

Classification rationale

Disruption of satellite communications with cross-border spillover to energy infrastructure monitoring.

Attack type

Wiper / Destructive Malware

Nature

Malicious activity

Attack vector

Malicious commands to SurfBeam2/SurfBeam2+ modems leading to deployment of the AcidRain wiper; Viasat cited a VPN misconfiguration as the initial access

Sectors

Telecommunications, Energy, Defense

Critical infrastructure

Yes

Organizations affected

Viasat (KA-SAT network), KA-SAT consumer broadband users in Ukraine and Europe, Enercon (wind turbine remote monitoring)

Operational consequences

Thousands of modems in Ukraine and tens of thousands across Europe were disabled. Remote monitoring links to around 5,800 Enercon wind turbines in Germany were interrupted, though the turbines kept operating.

Estimated financial impact

No reliably documented figure

Attribution (as stated)

Attributed by the European Union (10 May 2022), the UK and the US to the Russian Federation