Loading story…
Researchers from the University of Maryland and the University of California, San Diego have demonstrated that sensitive data transmitted via geostationary satellites can be intercepted using inexpensive, commercially available equipment. By passively scanning 39 satellites across 25 longitudinal points over a period of several months, the research teams were able to collect a significant amount of unencrypted data, including communications from the U.S. military, major telecommunications firms, and large businesses. The equipment used for these experiments cost as little as $600 to $800, making the attack vector accessible to individuals without significant resources or technical expertise. The intercepted data included thousands of T-Mobile users’ calls and text messages, as well as communications from airline passengers using in-flight Wi-Fi. Additionally, the researchers were able to access data related to critical infrastructure, such as electric utilities and offshore oil platforms, highlighting the broad scope of the vulnerability. The study revealed that roughly half of all geostationary satellite signals are transmitted without encryption, leaving them open to eavesdropping by anyone with the right equipment and knowledge. The researchers’ findings challenge the assumption that satellite communications are inherently secure or protected by default. The vulnerability is not limited to consumer data; military and corporate communications were also found to be at risk, raising concerns about national security and corporate espionage. The researchers emphasized that their work was conducted passively, without any active interference or exploitation of the satellites themselves, underscoring the ease with which such data can be collected. The study’s results have significant implications for the cybersecurity industry, telecom providers, and government agencies, as they expose a critical gap in the protection of sensitive information transmitted via satellite. The findings are expected to prompt urgent reviews of satellite communication security practices and may lead to calls for mandatory encryption of all satellite-borne data. The research also demonstrates that the threat is not theoretical; real-world data was collected and analyzed, proving the feasibility of large-scale interception. The exposure of unencrypted satellite communications could facilitate a range of malicious activities, from identity theft to the compromise of critical infrastructure. The study serves as a wake-up call for organizations relying on satellite links for sensitive communications, urging them to implement robust encryption and review their security postures. The ease and affordability of the attack method mean that not only nation-state actors but also criminal groups and hobbyists could exploit these vulnerabilities. The research has already sparked discussions within the cybersecurity community about the need for industry-wide standards and regulatory oversight to address the risks associated with unencrypted satellite transmissions.
See the actors and campaigns active against you right now.
5 events from the most recent confirmed update back to the earliest known activity.
The team publicly reported that a significant share of geostationary satellite communications remained unencrypted and vulnerable to passive interception, and they presented their paper, "Don't Look Up," at an ACM conference in Taiwan. They also said they planned to release an open-source tool to help interpret satellite data.
The researchers' disclosure discussions with affected organizations continued through July 2025, covering multiple telecom, aviation-connectivity, satellite, and military-related entities. This marked the end of the notification window described in the reporting.
After being notified by the researchers, T-Mobile and AT&T said they moved quickly to remediate the exposed communications observed in the study. At the time of reporting, some critical-infrastructure operators still had not encrypted their traffic.
Using low-cost commercial equipment costing roughly $600 to $800, the researchers spent about seven months scanning 39 geostationary satellites and 411 Ku-band transponders. They collected plaintext and metadata tied to telecom, airline, industrial, law-enforcement, and military communications, showing that passive interception was feasible at low cost.
Researchers from UC San Diego and the University of Maryland started notifying affected organizations about unencrypted geostationary satellite traffic exposures. CyberScoop reports disclosure discussions with multiple entities, including the U.S. military and telecom and satellite providers, began in December 2024.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
4 references tracked. Mallory keeps watching after this page renders.
schneier.com
Open sourcesecurityaffairs.com
Open sourcecyberscoop.com
Open sourcewired.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky researchers reported that internet-exposed Global Navigation Satellite System (GNSS) receivers remain accessible worldwide, creating a direct security risk to organizations that rely on precise positioning, navigation, and timing data. The exposed devices can often be reached remotely through web interfaces and management services, raising the possibility of unauthorized access, configuration changes, service disruption, or manipulation of timing and location data used by critical infrastructure, telecommunications, transportation, and industrial environments. The findings indicate that weak exposure controls and poor hardening leave GNSS receivers vulnerable to compromise at scale, with potentially significant downstream effects for dependent systems. Security teams were urged to identify publicly reachable receivers, restrict management access, segment these assets from broader networks, and review authentication and monitoring controls to reduce the risk of tampering with systems that depend on trusted satellite-derived data.
Jul 12, 2026
U.S. policymakers and researchers have highlighted the **Salt Typhoon** compromises of telecommunications providers as a major counterintelligence and cybersecurity concern, with implications extending beyond immediate network intrusion to long-term interception of sensitive communications. A Congressional Research Service brief describes the hacks as significant breaches of telecom infrastructure that could affect government, commercial, and private-sector communications, underscoring the federal response and the strategic risk posed when adversaries gain access to core communications environments. Related research argues that the most dangerous follow-on activity may be **passive collection** of encrypted traffic that victims cannot reliably detect from inside their own networks. The analysis says so-called “harvest now, decrypt later” operations leave no endpoint, network, or logging artifacts when collection occurs off-path over fiber, cellular, radio, or satellite links, meaning conventional tools such as IDS, EDR, SIEM, and DLP cannot confirm such surveillance; instead, organizations with long-lived sensitive data are urged to prioritize **post-quantum cryptography migration**, including `ML-KEM` and hybrid key-establishment approaches, rather than rely on claims of HNDL detection.
Jul 14, 2026
Citizen Lab reported two covert surveillance campaigns that exploited weaknesses in global mobile signalling infrastructure to track targets’ locations across borders. The operations, labeled **STA1** and **STA2**, abused legacy `SS7` and newer `Diameter` protocols, with one campaign also using **SIMjacker-style zero-click binary SMS** and malicious SIM Toolkit commands to try to turn a handset into a covert beacon. Researchers said the activity marks the first time real-world attack traffic has been directly linked to mobile operator signalling systems, showing attackers impersonating operators, rotating identities across countries, manipulating routing paths, and evading signalling firewalls while exploiting weak authentication and trusted telecom interconnect relationships. The campaigns were observed using operator identifiers and infrastructure tied to networks in Europe, Africa, the Middle East, and Asia, including telecoms cited as transit or entry points such as **019Mobile**, **Tango Networks U.K.**, and **Airtel Jersey**. Citizen Lab said the activity is consistent with commercial surveillance platforms serving government intelligence customers, and one campaign may have links to an Israeli geo-intelligence provider, though no vendor or operator was conclusively attributed. The researchers warned that abuse of leased or intermediary signalling access, combined with long-standing flaws in roaming trust models, has enabled large volumes of hard-to-detect location tracking that may persist for years across 3G, 4G, and 5G-connected environments.
Aug 24, 2026