Lessons Learned from the KA-SAT Cyberattack: Response, Mitigation and Information Sharing
No ratings
Presented at BlackHat USA 2023 by
In February 2022, the Viasat owned KA-SAT network experienced a significant cyberattack that resulted in a partial outage of services for thousands of users in Ukraine and tens of thousands of users in other parts of Europe. This presentation will provide the most detailed public presentation of the KA-SAT event, which involved the deployment of malware against terminals on the network, as well as several distinct network-based attacks that appeared focused on further denying connectivity to KA-SAT users. These network-based attacks needed to be characterized and responded to by Viasat's operational teams in real-time, and the attacks continued with intensity for many weeks after the original malware incident. Viasat will share the story of how it responded and performed a rapid forensic on several impacted terminals to determine within 36 hours that the terminal flash memory had been overwritten with a distinctive pattern in the attack. This presentation will explain details around the forensic analysis that have not previously been publicly shared by Viasat, as well as the process of reverse engineering the malicious toolkit to verify it would produce the observed flash memory effects. Part of Viasat's response protocol included the integration and sharing of information with government agencies, the intelligence community and law enforcement agencies. The National Security Agency's Cybersecurity Collaboration Center (NSA CCC) had an established relationship with Viasat and was engaged in the early hours after the attack, working with the Viasat team to discuss new information and analysis as it came in, and assisting with interagency communications to ensure this information was known more broadly. In its own capacity, the NSA then leveraged the analysis and data provided – both at the time and in the months that followed – to conduct their own analysis, correlate connections to actors it tracks, and gain a deeper understanding of the cyber adversary threats and their behaviors to share additional mitigation guidance with the broader community. Both Viasat and NSA will offer their lessons learned from the cyberattack and advise on how commercial and government organizations can follow this model to partner both in response to and preparation for future attacks.