Loading story…
Kaspersky researchers reported that internet-exposed Global Navigation Satellite System (GNSS) receivers remain accessible worldwide, creating a direct security risk to organizations that rely on precise positioning, navigation, and timing data. The exposed devices can often be reached remotely through web interfaces and management services, raising the possibility of unauthorized access, configuration changes, service disruption, or manipulation of timing and location data used by critical infrastructure, telecommunications, transportation, and industrial environments.
The findings indicate that weak exposure controls and poor hardening leave GNSS receivers vulnerable to compromise at scale, with potentially significant downstream effects for dependent systems. Security teams were urged to identify publicly reachable receivers, restrict management access, segment these assets from broader networks, and review authentication and monitoring controls to reduce the risk of tampering with systems that depend on trusted satellite-derived data.
Map this exposure pattern across your cloud, code, and identities.
1 event from the most recent confirmed update back to the earliest known activity.
Securelist published a report describing the global security threat posed by internet-exposed GNSS receivers. No additional dated real-world events are provided in the reference content.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers from the University of Maryland and the University of California, San Diego have demonstrated that sensitive data transmitted via geostationary satellites can be intercepted using inexpensive, commercially available equipment. By passively scanning 39 satellites across 25 longitudinal points over a period of several months, the research teams were able to collect a significant amount of unencrypted data, including communications from the U.S. military, major telecommunications firms, and large businesses. The equipment used for these experiments cost as little as $600 to $800, making the attack vector accessible to individuals without significant resources or technical expertise. The intercepted data included thousands of T-Mobile users’ calls and text messages, as well as communications from airline passengers using in-flight Wi-Fi. Additionally, the researchers were able to access data related to critical infrastructure, such as electric utilities and offshore oil platforms, highlighting the broad scope of the vulnerability. The study revealed that roughly half of all geostationary satellite signals are transmitted without encryption, leaving them open to eavesdropping by anyone with the right equipment and knowledge. The researchers’ findings challenge the assumption that satellite communications are inherently secure or protected by default. The vulnerability is not limited to consumer data; military and corporate communications were also found to be at risk, raising concerns about national security and corporate espionage. The researchers emphasized that their work was conducted passively, without any active interference or exploitation of the satellites themselves, underscoring the ease with which such data can be collected. The study’s results have significant implications for the cybersecurity industry, telecom providers, and government agencies, as they expose a critical gap in the protection of sensitive information transmitted via satellite. The findings are expected to prompt urgent reviews of satellite communication security practices and may lead to calls for mandatory encryption of all satellite-borne data. The research also demonstrates that the threat is not theoretical; real-world data was collected and analyzed, proving the feasibility of large-scale interception. The exposure of unencrypted satellite communications could facilitate a range of malicious activities, from identity theft to the compromise of critical infrastructure. The study serves as a wake-up call for organizations relying on satellite links for sensitive communications, urging them to implement robust encryption and review their security postures. The ease and affordability of the attack method mean that not only nation-state actors but also criminal groups and hobbyists could exploit these vulnerabilities. The research has already sparked discussions within the cybersecurity community about the need for industry-wide standards and regulatory oversight to address the risks associated with unencrypted satellite transmissions.
Jun 29, 2026
A security researcher publicly disclosed **20+ vulnerabilities** in the **International Data Casting (IDC) SFX2100 satellite receiver**, a device reported as deployed across **U.S. Department of Defense**, **European Space Agency**, and other critical infrastructure environments, after the vendor allegedly failed to respond to repeated disclosure attempts over several months. Reported issues span common embedded-device failure modes including **hardcoded credentials**, **unauthenticated remote code execution**, **OS command injection**, **path traversal**, and overly permissive filesystem configurations, with CVEs assigned across **CVE-2026-28769 through CVE-2026-29128**. One highlighted high-impact issue, **CVE-2026-28775**, reportedly enables **unauthenticated command execution as `root`** by abusing **SNMP** management functionality combined with a default read-write community string of `private`. Additional detail on the credential exposure risk is captured in **CVE-2026-29128**, which describes **world-readable routing daemon configuration files** (e.g., `zebra.conf`, `bgpd.conf`, `ospfd.conf`, `ripd.conf`) that are root-owned but readable by all users and contain **plaintext/hardcoded passwords** (including privileged “enable” credentials). This condition can enable credential reuse and lateral movement, potentially helping an attacker establish or deepen access within networks where the SFX2100 is deployed, and it compounds other reported weaknesses such as undocumented default accounts (e.g., `admin`, `monitor`, `user`, `xd`) allegedly sharing a weak password (`12345`).
Jun 29, 2026
A Flare study identified **437 distinct Hughes Multimedia VSAT terminals** exposed through SNMP across 15 countries, along with five publicly discoverable satellite network-management servers running end-of-life enterprise Linux. The findings indicate that SNMP banners tied to confirmed device instances provide a substantially more reliable means of identifying exposed satellite ground-segment infrastructure than generic vendor-name searches over HTTP. HTTP-based searches produced more than 5,000 results across 11 queries but yielded only about nine genuine devices; most results were replicated cloud-hosted static content, marketing platforms, demonstrations, or laboratory systems. Organizations operating satellite infrastructure should validate internet-exposure findings using unique identity fields, response-body comparison, network context, and plausible service exposure, and should restrict public SNMP access while remediating unsupported management-server operating systems.
Aug 31, 2026