Loading story…
A Flare study identified 437 distinct Hughes Multimedia VSAT terminals exposed through SNMP across 15 countries, along with five publicly discoverable satellite network-management servers running end-of-life enterprise Linux. The findings indicate that SNMP banners tied to confirmed device instances provide a substantially more reliable means of identifying exposed satellite ground-segment infrastructure than generic vendor-name searches over HTTP.
HTTP-based searches produced more than 5,000 results across 11 queries but yielded only about nine genuine devices; most results were replicated cloud-hosted static content, marketing platforms, demonstrations, or laboratory systems. Organizations operating satellite infrastructure should validate internet-exposure findings using unique identity fields, response-body comparison, network context, and plausible service exposure, and should restrict public SNMP access while remediating unsupported management-server operating systems.
Map this exposure pattern across your cloud, code, and identities.
5 events from the most recent confirmed update back to the earliest known activity.
The subsequent enterprise Linux major release later observed on three exposed satellite network-management servers reached end of life. The servers were reported to have kernels dated from 2016 through 2019.
An enterprise Linux release later observed on two publicly discoverable satellite network-management servers reached end of life. The servers were reported to have kernels built in 2013.
Across 11 HTTP queries, more than 5,000 results yielded roughly nine genuine devices; one mission-control product query returned 1,776 records, all but 18 sharing an identical cloud-hosted response body. The study concluded these results largely represented replicated web assets rather than deployed satellite systems.
The study passively identified five publicly discoverable satellite network-management servers, characterized as control-plane systems capable of operating remote terminals. Two ran an enterprise Linux release end-of-life since March 2017 and three ran a release end-of-life since November 2020.
A passive internet-exposure study identified 437 distinct Hughes Network Systems Multimedia VSAT terminals responding on UDP port 161. The terminals had distinct IP addresses and system-name identifiers and were associated with 13 networks, 28 organizations, and 15 countries.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A security researcher publicly disclosed **20+ vulnerabilities** in the **International Data Casting (IDC) SFX2100 satellite receiver**, a device reported as deployed across **U.S. Department of Defense**, **European Space Agency**, and other critical infrastructure environments, after the vendor allegedly failed to respond to repeated disclosure attempts over several months. Reported issues span common embedded-device failure modes including **hardcoded credentials**, **unauthenticated remote code execution**, **OS command injection**, **path traversal**, and overly permissive filesystem configurations, with CVEs assigned across **CVE-2026-28769 through CVE-2026-29128**. One highlighted high-impact issue, **CVE-2026-28775**, reportedly enables **unauthenticated command execution as `root`** by abusing **SNMP** management functionality combined with a default read-write community string of `private`. Additional detail on the credential exposure risk is captured in **CVE-2026-29128**, which describes **world-readable routing daemon configuration files** (e.g., `zebra.conf`, `bgpd.conf`, `ospfd.conf`, `ripd.conf`) that are root-owned but readable by all users and contain **plaintext/hardcoded passwords** (including privileged “enable” credentials). This condition can enable credential reuse and lateral movement, potentially helping an attacker establish or deepen access within networks where the SFX2100 is deployed, and it compounds other reported weaknesses such as undocumented default accounts (e.g., `admin`, `monitor`, `user`, `xd`) allegedly sharing a weak password (`12345`).
Jun 29, 2026
Researchers reported that internet-facing devices tied to **Salt Typhoon**, a Chinese state-sponsored threat actor linked to intrusions in telecommunications and government environments, remain widely exposed even after a modest overall decline in attack surface. Tracking six months of exposure data for **Sophos Firewall**, **Cisco IOS XE Web UI**, **Ivanti Connect Secure**, and **Fortinet FortiClient EMS** showed a combined **25% reduction**, driven largely by a sharp drop in Sophos Firewall exposure, while Ivanti and Fortinet changed little and a substantial number of systems remained reachable from the internet. The reporting also found that **Cisco IOS XE** was the only monitored platform to post a net increase in exposure, underscoring continued risk around internet-facing edge infrastructure that can provide direct access into internal networks. Analysts cautioned that attribution remains difficult and confirmed Salt Typhoon indicators are limited, but said the affected technologies should remain high-priority because the group has been associated not only with vulnerability exploitation but also with the use of **stolen credentials** in some Cisco-related incidents; most observed exposures were concentrated in the **United States**, while Sophos Firewall exposure was concentrated in **Germany**.
Aug 15, 2026
Kaspersky researchers reported that internet-exposed Global Navigation Satellite System (GNSS) receivers remain accessible worldwide, creating a direct security risk to organizations that rely on precise positioning, navigation, and timing data. The exposed devices can often be reached remotely through web interfaces and management services, raising the possibility of unauthorized access, configuration changes, service disruption, or manipulation of timing and location data used by critical infrastructure, telecommunications, transportation, and industrial environments. The findings indicate that weak exposure controls and poor hardening leave GNSS receivers vulnerable to compromise at scale, with potentially significant downstream effects for dependent systems. Security teams were urged to identify publicly reachable receivers, restrict management access, segment these assets from broader networks, and review authentication and monitoring controls to reduce the risk of tampering with systems that depend on trusted satellite-derived data.
Jul 12, 2026