In February 2022, the Viasat owned KASAT network experienced a significant cyberattack that resulted in a partial outage of services for thousands of users in Ukraine and tens of thousands of users in other parts of Europe. This presentation will provide detailed background on the attack, which involved the deployment of malware against terminals on the network, as well as several distinct networkbased attacks that appeared focused on further denying connectivity to KASAT users. These networkbased attacks needed to be characterized and responded to by Viasat’s operational teams in realtime, and the attacks continued with intensity for many weeks after the original malware incident.

Viasat will share the story of how it responded and performed a rapid forensic on several impacted terminals to determine within 36 hours that the terminal flash memory had been overwritten with a distinctive pattern in the attack. This presentation will explain details around the forensic analysis as well as the process of reverse engineering the malicious toolkit to verify it would produce the observed flash memory effects. Viasat will also share technical details of overtheair network attacks that were used to attack the KASAT network.