# Russian state actors target SATCOM network providers and customers

Published: 2025-06-20 · Severity: routine · Sectors: defense, government-national, infrastructure, telecommunications, transportation, energy
Canonical: https://vorant.io/reports/01e55f27-eacb-5476-9059-8e844fd2da14/russian-state-actors-target-satcom-network-providers-and-customers

> Russian cyber actors are targeting U.S. and international satellite communications networks; CISA and FBI advise enhanced monitoring and authentication.

The U.S. government attributes ongoing threat activity against satellite communications (SATCOM) networks to Russian state-sponsored cyber actors. Successful intrusions into SATCOM infrastructure could compromise both network providers and their customers, creating cascading risk across critical infrastructure. CISA and FBI released this joint advisory under the Shields Up initiative, urging all organizations to lower their reporting threshold for suspected malicious cyber activity given the geopolitical context.

The advisory does not detail specific exploits, malware samples, or indicators of compromise, but rather provides defensive guidance for both SATCOM providers and their customers. Key threats include unauthorized remote access via insecure protocols (Telnet, FTP, SSH, SCP, VNC), unexpected terminal-to-terminal traffic, brute-force login attempts, and compromise of trust relationships between providers and customers. The advisory emphasizes that threat actors routinely exploit these trust relationships to pivot from provider infrastructure into customer networks.

Defenders should implement multi-factor authentication, enforce least privilege, review and audit trust relationships with service providers, implement end-to-end encryption independent of SATCOM provider infrastructure, conduct rigorous patching and configuration management, and significantly enhance logging and monitoring across SATCOM network segments, ingress/egress points, and systems behind SATCOM terminals.

## Mentioned in this report

- Threat actors: Russian Federation

## Detection guidance (public sample)

### PuTTY Link or PSCP Executed With Inline Password

ATT&CK: T1021.004

Detects plink.exe, pscp.exe or psftp.exe run with the -pw password argument, which is typical of scripted SSH/SCP remote access and password guessing with valid or default credentials. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: PuTTY Link or PSCP Executed With Inline Password
id: edfea039-9093-58dc-8f00-d7d78ba1595c
status: experimental
description: Detects PuTTY command-line tools (plink, pscp, psftp) run with an inline
  password (-pw). This pattern is used for scripted SSH/SCP remote access, lateral
  movement into trusted provider or customer networks, and password guessing with
  default or valid credentials.
tags:
- attack.lateral-movement
- attack.t1021.004
- attack.t1078.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \plink.exe
    - \pscp.exe
    - \psftp.exe
  selection_pw:
    CommandLine|contains: ' -pw '
  condition: selection_img and selection_pw
falsepositives:
- Administrators running automated backup or file transfer scripts that use plink
  or pscp with a stored password
- Network engineers scripting device configuration pulls
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-076a
```

### Failed Network or RDP Logon Against Default Account Names

ATT&CK: T1110.001

Detects failed network or RDP logons (4625) targeting common default account names. A single hit is low signal, so alert when many occur from one source over a short window (for example 10 or more in 5 minutes), which is a brute-force or password-guessing pattern. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Failed Network or RDP Logon Against Default Account Names
id: e888e440-b302-5dce-8dde-884065a05857
status: experimental
description: Detects failed logons (EventID 4625) over network (type 3) or RemoteInteractive/RDP
  (type 10) against common default account names such as administrator, admin, guest,
  root or user. Intended to be aggregated downstream by source address (for example
  10 or more failures within 5 minutes) to identify password guessing against exposed
  remote services.
tags:
- attack.credential-access
- attack.t1110.001
- attack.initial-access
- attack.t1078.001
- attack.lateral-movement
- attack.t1021.001
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4625
    LogonType:
    - 3
    - 10
    TargetUserName:
    - administrator
    - admin
    - guest
    - root
    - user
    - test
  condition: selection
falsepositives:
- Users or legacy scripts mistyping the local administrator password
- Internal vulnerability scanners performing authenticated checks with default account
  names
level: low
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-076a
```

### VNC Server or Viewer Process Execution

ATT&CK: T1021.005

Detects execution of common VNC server or viewer binaries, which may indicate unauthorized remote access over VNC between provider and customer terminals. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: VNC Server or Viewer Process Execution
id: eb899f87-5c9b-5a08-a48b-ede895af2f62
status: experimental
description: Detects execution of common VNC server and viewer binaries. Unexpected
  VNC on SATCOM terminals, provider-managed hosts or systems behind them can indicate
  unauthorized remote access and terminal-to-terminal pivoting.
tags:
- attack.lateral-movement
- attack.t1021.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
    - \winvnc.exe
    - \vncviewer.exe
    - \tvnserver.exe
    - \tvnviewer.exe
    - \vncserver.exe
    - \x11vnc.exe
  condition: selection
falsepositives:
- Sanctioned IT helpdesk remote support using VNC
- Provider-managed remote maintenance of terminals that use VNC
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-076a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-076a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/01e55f27-eacb-5476-9059-8e844fd2da14/russian-state-actors-target-satcom-network-providers-and-customers.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup