ENISA Report Warns of Rising Cyber Risks to Orbital Infrastructure

Editor’s Note: Cyber threats are no longer confined to terrestrial networks. This timely ENISA-backed report surfaces a stark warning: satellites—the silent backbone of global connectivity—are now front-line targets in the escalating cyber conflict. From space-based navigation to emergency services and military coordination, orbital assets are deeply interwoven into our daily lives and national security. Yet, they often run on legacy systems, rely on vulnerable supply chains, and are challenging to monitor or update.

For cybersecurity professionals, this piece is more than a technical overview—it’s a wake-up call. The evolving threat landscape in orbit poses real and rising risks to the continuity, reliability, and safety of critical services. The report’s emphasis on resilience-by-design, zero-trust principles, and global collaboration makes it essential reading for anyone charged with protecting systems that stretch beyond the clouds—but whose impact is felt right here on Earth.

Industry News – Cybersecurity Beat

ENISA Report Warns of Rising Cyber Risks to Orbital Infrastructure

ComplexDiscovery Staff

The stars aren’t the only frontier. The threats facing commercial satellite systems are growing fast, and they’re coming from Earth.

As global reliance on satellites intensifies, from GPS navigation to real-time financial transactions and military coordination, the infrastructure quietly orbiting the planet is emerging as a high-value target in the global cyber threat landscape. A new report released in March 2025 by the European Union Agency for Cybersecurity (ENISA) warns that this unseen yet indispensable architecture is increasingly vulnerable to attacks, with consequences that ripple far beyond the stratosphere.

“Previous years have witnessed several notable cyber-attacks aimed at the space industry, including large-scale satellite systems, with consequences being not only visible, but also potentially harmful for societies at large,” the report states.

The Silent Vulnerabilities of Orbit

Unlike terrestrial infrastructure, space assets like satellites are isolated, difficult to monitor in real time, and often built on legacy hardware and software. According to the ENISA “Space Threat Landscape Report,” this combination creates an appealing target for adversaries ranging from cybercriminals to state-backed advanced persistent threat (APT) groups.

Commercial satellites often incorporate commercial off-the-shelf (COTS) components. These components reduce costs and simplify integration, but they frequently carry well-documented vulnerabilities. For instance, details of some components are publicly available in open-source materials, which could be used by malicious actors to familiarize themselves with the targeted infrastructure. The report cites a growing concern over the need for “additional hardening of COTS” to safeguard space systems.

Adding to this is the use of legacy systems. Many orbital platforms rely on software and hardware that “have been designed without the security considerations needed to foresee or mitigate some of the present-day cyber challenges.” These assets’ remote nature adds complexity, making necessary updates difficult and, in some instances, impossible, “leaving vulnerabilities that render satellite systems susceptible to cyberattacks.”

A particularly concerning case involved the 2022 Viasat hack, which targeted satellite modems across Europe, “shutting down tens of thousands of modems across Europe and disrupting not only economic activities of several European countries but also lifeline functions such as emergency services.” The attack occurred just hours before the Russian invasion of Ukraine and underscored how satellite vulnerabilities can become instruments of geopolitical disruption.

Threats Not in Theory—But in Play

The ENISA report identifies a catalog of real-world attack techniques. These include jamming to disrupt communications, man-in-the-middle attacks where threat actors intercept and alter data in transit, and spoofing aimed at deceiving receivers by transmitting erroneous data via what appears to be a legitimate signal. Firmware corruption and malicious software updates—especially in systems without strong validation protocols—represent additional routes for exploitation.

One of the most alarming assessments is that adversaries can breach satellite networks by first attacking connected ground stations or service providers. This indirect path bypasses the physical inaccessibility of space and enables lateral movement across mission-critical components.

“Supply Chain Risk” is identified as a key challenge, with the space sector “heavily dependent on vast global supply chains, introducing potential vulnerabilities that adversaries could exploit to compromise critical systems.”

People as Points of Failure

Cybersecurity experts often say that the weakest point in any system is the human. In satellite operations, human error continues to be a recurring source of breach vectors. “With space systems having a high degree of human interaction, there are increased risks of unintentional data leaks, system misconfigurations, and insider threats,” the ENISA report warns. And in space, the margin for error is thinner: reconfiguring or rebooting compromised systems from the ground can take hours—if it’s even possible.

Technical Frameworks and Defenses

The ENISA report is grounded in several advanced cybersecurity frameworks, including the ESA’s SPACE-SHIELD architecture and ENISA’s own threat taxonomy, which maps known cyberattack patterns to specific satellite segments (space, ground, user, and human resources). The report presents a comprehensive threat taxonomy featuring nine high-level threat categories: Nefarious Activity/Abuse, Eavesdropping/Interception/Hijacking, Physical Attacks, Unintentional Damage, Failures or Malfunctions, Outages, Disasters, Legal issues, and Legacy Infrastructure challenges.

The taxonomy enables precise threat identification and prioritization across all layers of satellite infrastructure. It categorizes attacks by method and maps them to potential impacts on confidentiality, integrity, and availability (CIA).

Resilience Through Design, Not Response

Rather than reacting to threats, the report urges a proactive, resilience-first strategy. It calls for implementing “security by default and by design” principles, integrating defense mechanisms during the earliest phases of satellite architecture and engineering. Strong encryption for all communications, validated firmware update mechanisms, and robust authentication across access points are foundational elements of this approach.

The adoption of zero-trust architecture is also strongly recommended. This involves “a multi-layered approach to access control, with access granted via continuous verification of users, devices, applications, and services, and on a need-to-know basis.”

Global Collaboration is Not Optional

While ENISA underscores the importance of coordination, it also highlights current challenges in aligning cybersecurity standards across nations and sectors. There is a “relative lack of detailed, sector-specific cybersecurity guidelines for commercial satellite operators,” with satellite operators “generally governed by national rules and regulations prescribed by the country of their establishment, despite their operations having a wider reach and, often, a global impact.”

However, examples of progress do exist. The report references NASA’s Best Practice Guide published in January 2024, the Security in space systems lifecycles standard published by the European Cooperation for Space Standardization (ECSS) in July 2024, and various technical standards that can support the resilience of satellite components and processes.

There’s also recognition of the EU Space Information Sharing Centre (ISAC), which is “expected to encourage more proactive information and knowledge sharing about security-related information, incidents, cyber trends, vulnerabilities, and threats among commercial space operators.”

Strategic Consequences

Satellite vulnerabilities are not an abstract concern—they pose material risks to global systems. According to ENISA, the potential consequences of successful cyberattacks on commercial satellites include physical risks such as “potential misalignment of satellite orbits, increasing the risk of collision with other space objects”; economic risks including “immediate and significant financial losses for businesses relying on uninterrupted communications and data transmission”; and societal impacts where “disruptions to essential services dependent on space systems… may generate loss of human life and catastrophic consequences.”

For professionals in cybersecurity, information governance, and eDiscovery, this means that protecting satellite infrastructure isn’t just about operational continuity—it’s also about preserving evidence integrity, legal traceability, and data reliability.

Eyes on the Stars—and on Defense

The call to action is clear: satellite cybersecurity must be integrated, comprehensive, and globally harmonized. Security gaps in orbit can cascade into global consequences in seconds.

ENISA’s key recommendations include “robust segmentation measures” to compartmentalize sensitive components and data, “regular patching” despite challenges with legacy and remote systems, and adopting “appropriate cybersecurity hygiene practices” to empower the human segment of the satellite ecosystem and reduce risks stemming from human error.

And as we launch more systems into space, the risk footprint expands. Because the next time your GPS glitches or your satellite feed cuts out, it might not be a technical hiccup—it could be the start of a very terrestrial cyberattack.

In orbit, the silence hides more than stars—it may be hiding your attackers.

News Sources

• ENISA Space Threat Landscape 2025 (ENISA)
• From Cyber to Outer Space: A Guide to Securing Commercial Satellite Operations (ENISA)

Assisted by GAI and LLM Technologies

Additional Reading

• Oracle’s Alleged Breach and the Rise of Cybersecurity Concerns in Corporate Cloud Environments
• Jaguar Land Rover Breached: The Persistent Threat of Ransomware in the Automotive Industry

Source: ComplexDiscovery OÜ