A cyberdefense researcher at the Center for Security Studies (CSS) at ETH Zurich has identified gaps in satellite cybersecurity monitoring that could leave space systems vulnerable to malicious activity. Clémence Poirier highlighted this in a World Economic Forum (WEF) story, citing a study that identified 407 cyber operations targeting the space sector in 2025, affecting at least 183 space-related organizations and involving 139 distinct threat actors. Hacktivist groups accounted for most identified actors, while distributed denial-of-service attacks were the most frequently observed activity. Other incidents involved ransomware, data leaks and credential theft, with cyber operations showing a correlation with major geopolitical crises.
Poirier noted that absence of documented cyberattacks against satellites in orbit does not establish that space systems are secure, noting that all 407 identified operations affected terrestrial IT environments at space companies, ground stations and user modems. Most satellites lack dedicated onboard capabilities to detect malicious cyber activity, limiting the telemetry available to analysts and their ability to identify attacker behavior and develop satellite-specific indicators of compromise.
She further called for greater transparency and intelligence sharing across the space sector, recommending that organizations participate in information-sharing and analysis centers, assess threats throughout the lifecycle of space systems and develop onboard detection sensors to address cybersecurity gaps.
“Hacktivist groups accounted for most identified actors, and distributed denial-of-service (DDoS) attacks were the most frequently observed form of malicious activity,” Poirier wrote. “Ransomware, data leaks and credential theft also affected space companies, agencies and research institutions, with a clear correlation to major geopolitical crises. This is not a niche problem. Identified attacks have disabled satellite communications on oil tankers in Iran, global navigation satellite system (GNSS) antennas for seismic monitoring systems in Italy, and weather services in South Africa.”
She observes that the space industry has long overlooked cybersecurity, however, and has not developed the same cycle. Most satellites lack dedicated onboard capabilities to detect malicious cyber activity. Without sensors, there may be little or no cyber telemetry to analyse.
“And without that evidence, defenders cannot reliably build satellite-specific indicators of compromise, or learn how adversaries behave. The result is a vicious circle,” Poirier pointed out. “What cannot be detected cannot become intelligence, and what never becomes intelligence cannot improve detection. That blind spot changes our understanding of the 407 incidents; they are not a census of everything that happened to the space sector in 2025, just simply what we could see via open-source information.”
Space security once relied on obscurity, but new space, COTS, digitalisation, and big data disrupted that model. The result is greater availability of information about satellite systems, limited CTI, and lower barriers to attack, which creates insecurity-by-transparency. Needed response is better and more CTI, information sharing, and tools adapted to space, with the goal of reaching security by transparency.
Poirier identified why space cybersecurity requires greater transparency and collaboration. For much of the 20th century, the space industry relied on security by obscurity. Governments and defence contractors controlled highly specialized systems; hardware and software were proprietary; protocols were undocumented, and technical information was closely guarded. The physical inaccessibility of satellites was itself treated as protection.
That model has disappeared. New space brought commercialization, private investment, digitalization, open-source software, global supply chains, and widespread use of commercial off-the-shelf components. Companies now communicate more openly about their technologies and partnerships, and threat actors can buy components to find vulnerabilities. Attackers have growing access to enabling information about space technologies, while defenders still lack cyber threat intelligence and systematic information sharing.
There is no credible route back to security by obscurity; the alternative is security by transparency. That does not mean publicly disclosing every incident, as much of this intelligence will rightly remain within trusted communities. It means using transparency to better understand offensive capabilities and threat actors’ activities, and ensuring satellite operators can detect incidents, learn from them, and share information with like-minded partners.
Poirier said the space industry has begun adapting traditional cyber threat intelligence tools to the constraints of space systems. As these efforts mature, they could expose gaps in the current public threat picture and lay the groundwork for a space cyber threat intelligence market, giving operators and agencies access to curated intelligence on past, current and emerging threats rather than requiring each organization to develop these capabilities independently.
“To gain a clearer picture of the threat landscape affecting them, space companies should join Information Sharing and Analysis Centers – non-profit organizations that collect, analyse and share actionable cyber and physical threat intelligence among operators of critical infrastructure and government agencies,” she wrote. “They should also improve their understanding of the threat landscape across the entire lifecycle of their space systems, and develop on-board detection sensors to close the detection gap.”
In August, the U.S. Government Accountability Office urged NASA to strengthen cybersecurity risk management for spacecraft and space systems, warning that growing cyber threats could disrupt missions. GAO found that NASA had yet to implement a priority recommendation to conduct a documented, organization-wide cybersecurity risk assessment to identify and mitigate its highest-priority threats and vulnerabilities. The watchdog also highlighted gaps in continuous monitoring strategies and integration of cybersecurity controls into spacecraft acquisition policies and standards.
