A new analysis reveals a sharp increase in cyberattacks targeting space infrastructure, with more than 237 distinct operations recorded between January 2023 and July 2025. The findings suggest that orbital systems are rapidly becoming a consistent battleground in modern armed conflicts.
The report, published by the Center for Security Studies (CSS) at ETH Zürich, documents a significant escalation in digital threats against satellites and ground-based communication systems, linking the trend directly to ongoing geopolitical tensions, including the conflict in Gaza.
Key Takeaways
- A new report identified 237 cyber operations targeting the space sector between January 2023 and July 2025.
- A major surge occurred in June 2025, with 72 attacks recorded in a single month during heightened Israel-Iran tensions.
- Over 70% of the attacks were Denial-of-Service (DDoS) operations, which are relatively easy to execute.
- Hacktivist groups, primarily pro-Palestinian, were identified as the main perpetrators of the publicly documented attacks.
- International agencies like NASA were targeted alongside Israeli defense and space organizations.
A New Battlefield in Orbit
Space, once the exclusive domain of superpowers, is now an active front in global cyber warfare. The comprehensive study from ETH Zürich details how digital attacks on space assets have become a standard feature of modern conflict, mirroring patterns previously observed during the war in Ukraine.
Researchers compiled data from open sources, including news articles, social media, and cybercrime forums, to identify the 237 incidents over a 30-month period. The author of the report, Clémence Poirier, noted that this figure likely represents only a fraction of the total activity. "The fact that so many incidents could be identified through manual open-source research suggests that the actual scale of activity against the space sector is likely considerably larger," the study concludes.
What is a Hacktivist?
A 'hacktivist' is an individual or group who uses hacking techniques to promote a political agenda or social change. Unlike traditional cybercriminals motivated by financial gain, hacktivists aim to disrupt services, leak information, or spread a message related to a specific cause or conflict.
The report highlights that the barrier to entry for these kinds of attacks is lowering, making critical space infrastructure more vulnerable than ever before.
Conflict Drives Digital Escalation
The analysis draws a direct line between ground conflicts and hostile actions in the digital space. The period following the Hamas incursion on October 7, 2023, saw an immediate, though initially small, wave of attacks. Ten cyber operations were recorded that month against high-profile targets.
Among the most frequently targeted entities were:
- The Israel Space Agency (ISA)
- Rafael Advanced Defense Systems
- Elbit Systems, an Israeli military technology company
However, the attacks were not limited to Israeli organizations. International bodies, including the United States’ National Aeronautics and Space Administration (NASA), were also among the 77 different space-related organizations targeted. The report suggests many aerospace and defense firms were targeted due to their role in manufacturing military hardware rather than their specific actions in space.
A Record-Breaking Month
June 2025 saw an unprecedented spike in activity, with 72 separate cyberattacks targeting the space sector. This surge, accounting for nearly a third of all incidents in the study, coincided with a 12-day period of direct military exchanges between Israel and Iran.
During this peak, pro-Palestinian and pro-Iranian hacktivist groups appeared to coordinate their efforts, targeting Israeli assets simultaneously. "The two wars influenced each other politically, militarily, and rhetorically, and threat actors active in one arena often engaged in operations relevant to the other," the report states.
The Anatomy of an Orbital Attack
The most common method of attack was the Distributed Denial-of-Service (DDoS) operation, accounting for more than 70% of all incidents. A DDoS attack floods a website or network with overwhelming amounts of traffic, causing it to crash and become inaccessible to legitimate users.
"Cyber operations against the space sector are now part of a general trend during armed conflicts."
According to the report, DDoS attacks are favored by hacktivist groups because they do not require deep technical expertise, can be launched quickly, and serve as effective disruptions. They can also be used as a smokescreen to distract security teams while more sophisticated intrusions are attempted.
Other methods included data leaks, network intrusions, and data breaches. Some groups claimed to be selling sensitive information, with the timing of these alleged leaks often coinciding with significant events in the conflict. However, the report cautions that verifying the authenticity of such claims is difficult, as they could be fabricated for propaganda purposes.
Tactics and Future Threats
A notable trend identified in the study is the cross-pollination of tactics between different conflicts. Hacktivist groups are learning from each other and adapting successful methods for their own campaigns. For example, a 2023 DDoS attack by a group calling itself the “Cyber Army of Palestine” on the ISA reportedly used code similar to that developed by the IT Army of Ukraine, a volunteer cyber group.
While most of the documented attacks caused limited physical or operational damage, the report warns against complacency. The consistent pattern of activity points toward a future where cyberattacks against space assets are an expected component of any major conflict.
The study concludes with a call for the development of dedicated, space-focused cybersecurity strategies. As nations and private companies become more reliant on satellites for communication, navigation, and intelligence, protecting these orbital assets from digital threats is becoming a critical aspect of national and international security.