Russian state actors target SATCOM network providers and customers
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Russian cyber actors are targeting U.S. and international satellite communications networks; CISA and FBI advise enhanced monitoring and authentication.
The U.S. government attributes ongoing threat activity against satellite communications (SATCOM) networks to Russian state-sponsored cyber actors. Successful intrusions into SATCOM infrastructure could compromise both network providers and their customers, creating cascading risk across critical infrastructure. CISA and FBI released this joint advisory under the Shields Up initiative, urging all organizations to lower their reporting threshold for suspected malicious cyber activity given the geopolitical context.
The advisory does not detail specific exploits, malware samples, or indicators of compromise, but rather provides defensive guidance for both SATCOM providers and their customers. Key threats include unauthorized remote access via insecure protocols (Telnet, FTP, SSH, SCP, VNC), unexpected terminal-to-terminal traffic, brute-force login attempts, and compromise of trust relationships between providers and customers. The advisory emphasizes that threat actors routinely exploit these trust relationships to pivot from provider infrastructure into customer networks.
Defenders should implement multi-factor authentication, enforce least privilege, review and audit trust relationships with service providers, implement end-to-end encryption independent of SATCOM provider infrastructure, conduct rigorous patching and configuration management, and significantly enhance logging and monitoring across SATCOM network segments, ingress/egress points, and systems behind SATCOM terminals.
Mentioned in this report
Detection guidance
PuTTY Link or PSCP Executed With Inline Password
Detects plink.exe, pscp.exe or psftp.exe run with the -pw password argument, which is typical of scripted SSH/SCP remote access and password guessing with valid or default credentials. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PuTTY Link or PSCP Executed With Inline Password
id: edfea039-9093-58dc-8f00-d7d78ba1595c
status: experimental
description: Detects PuTTY command-line tools (plink, pscp, psftp) run with an inline
password (-pw). This pattern is used for scripted SSH/SCP remote access, lateral
movement into trusted provider or customer networks, and password guessing with
default or valid credentials.
tags:
- attack.lateral-movement
- attack.t1021.004
- attack.t1078.001
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- \plink.exe
- \pscp.exe
- \psftp.exe
selection_pw:
CommandLine|contains: ' -pw '
condition: selection_img and selection_pw
falsepositives:
- Administrators running automated backup or file transfer scripts that use plink
or pscp with a stored password
- Network engineers scripting device configuration pulls
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-076a
Failed Network or RDP Logon Against Default Account Names
Detects failed network or RDP logons (4625) targeting common default account names. A single hit is low signal, so alert when many occur from one source over a short window (for example 10 or more in 5 minutes), which is a brute-force or password-guessing pattern. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Failed Network or RDP Logon Against Default Account Names
id: e888e440-b302-5dce-8dde-884065a05857
status: experimental
description: Detects failed logons (EventID 4625) over network (type 3) or RemoteInteractive/RDP
(type 10) against common default account names such as administrator, admin, guest,
root or user. Intended to be aggregated downstream by source address (for example
10 or more failures within 5 minutes) to identify password guessing against exposed
remote services.
tags:
- attack.credential-access
- attack.t1110.001
- attack.initial-access
- attack.t1078.001
- attack.lateral-movement
- attack.t1021.001
logsource:
product: windows
service: security
detection:
selection:
EventID: 4625
LogonType:
- 3
- 10
TargetUserName:
- administrator
- admin
- guest
- root
- user
- test
condition: selection
falsepositives:
- Users or legacy scripts mistyping the local administrator password
- Internal vulnerability scanners performing authenticated checks with default account
names
level: low
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-076a
VNC Server or Viewer Process Execution
Detects execution of common VNC server or viewer binaries, which may indicate unauthorized remote access over VNC between provider and customer terminals. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: VNC Server or Viewer Process Execution
id: eb899f87-5c9b-5a08-a48b-ede895af2f62
status: experimental
description: Detects execution of common VNC server and viewer binaries. Unexpected
VNC on SATCOM terminals, provider-managed hosts or systems behind them can indicate
unauthorized remote access and terminal-to-terminal pivoting.
tags:
- attack.lateral-movement
- attack.t1021.005
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- \winvnc.exe
- \vncviewer.exe
- \tvnserver.exe
- \tvnviewer.exe
- \vncserver.exe
- \x11vnc.exe
condition: selection
falsepositives:
- Sanctioned IT helpdesk remote support using VNC
- Provider-managed remote maintenance of terminals that use VNC
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-076a
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-076a
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs