Documented incidents

79 documented incidents affecting space systems, each read against the SPARTA technique catalogue. Open one to see which techniques it evidences, which were considered and refused, and the sources behind both.

Each record is a reading of published accounts, not an investigation. It says what the sources support, how confident that reading is, and where it stops.

Year	Incident	Type	Segment	Techniques	Sources
2024 ~	Russian GPS jamming of Norwegian aviation over Finnmark, registered on 44 days by February 2024	RF jamming	user	2 mapped techniques	2 sources
2023 ~	Hack-A-Sat satellite capture-the-flag series (2020-2023), including the on-orbit finals against Moonlighter	security research	space	9 mapped techniques	4 sources
2023 ~	OPS-SAT in-orbit cybersecurity demonstration (Thales Alenia Space, CYSAT 2023)	security research	space	7 mapped techniques	3 sources
2023 ~	LockBit claim against SpaceX supplier Maximum Industries (2023)	supply chain compromise	supply chain	2 mapped techniques	2 sources
2022	ARSAT corporate-systems compromise and Play ransomware leak (Argentina, 2022)	ransomware	No primary segment recorded	1 mapped technique	4 sources
2022	Jamming of two Eutelsat satellites from within Iran during the Mahsa Amini protests (September-October 2022)	RF jamming	link	6 mapped techniques	3 sources
2022 ~	Starlink user-terminal voltage fault-injection (Wouters, 2022)	firmware exploitation	user	5 mapped techniques	3 sources
2022 ~	Starlink user-terminal RF jamming in Ukraine (2022)	RF jamming	link	5 mapped techniques	3 sources
2022	Viasat KA-SAT modem wiper (AcidRain), February 2022	malware deployment	ground	8 mapped techniques	5 sources
2022 ~	GNSS jamming and spoofing affecting European aviation (2022 onward)	RF jamming	user	3 mapped techniques	4 sources
2022 ~	APT28 intrusion at a US satellite communications provider (disclosed 2022)	network intrusion	ground	3 mapped techniques	1 source
2021 ~	FortiGate SSL-VPN credential disclosure via CVE-2018-13379 (2021)	data exposure	No primary segment recorded	4 mapped techniques	2 sources
2021 ~	SANSA data-leak claim and South African Department of Justice attack (2021)	data exposure	No primary segment recorded	No mapped techniques	3 sources
2021 ~	North Korea-linked intrusion at Korea Aerospace Industries, the KSLV-2 stage developer (2021)	cyber espionage	supply chain	1 mapped technique	2 sources
2020	Operation SignSight: trojanised Vietnam Government Certification Authority signing toolkit (2020)	supply chain compromise	supply chain	3 mapped techniques	1 source
2020 ~	DoppelPaymer ransomware at Digital Management Inc., a former NASA IT contractor, June 2020	ransomware	supply chain	1 mapped technique	2 sources
2020 ~	SolarWinds Orion build-process compromise and SUNBURST backdoor (2020)	supply chain compromise	supply chain	4 mapped techniques	2 sources
2019 ~	Space Pirates intrusions at Russian aerospace enterprises (disclosed 2022)	cyber espionage	supply chain	1 mapped technique	2 sources
2019	India's Mission Shakti direct-ascent ASAT test against Microsat-R (2019)	kinetic ASAT test	space	3 mapped techniques	2 sources
2018 ~	NASA employee PII server compromise disclosed by internal memo, December 2018	data exposure	No primary segment recorded	No mapped techniques	2 sources
2018 ~	JPL mission-network intrusion via an unauthorised Raspberry Pi (NASA OIG IG-19-022), April 2018	network intrusion	ground	5 mapped techniques	2 sources
2018	ISRO ISTRAC malware report and refutation (2018)	malware deployment	ground	No mapped techniques	2 sources
2018 ~	Thrip espionage campaign against a satellite communications operator, telecoms and defence targets (2018)	cyber espionage	ground	5 mapped techniques	2 sources
2017	GPS jamming of Wideroe and SAS aircraft over Finnmark during Zapad-2017 (September 2017)	RF jamming	user	2 mapped techniques	3 sources
2017 ~	GPS jammer left running in a car at Nantes Atlantique Airport delays flights (2017)	RF jamming	user	2 mapped techniques	2 sources
2017 ~	Reported Gaddafist hijack of a Libyan television signal (5 March 2017, single-source claim)	signal hijacking	link	1 mapped technique	1 source
2016 ~	Hijacking of Israeli television satellite broadcasting with muezzin audio (November 2016)	signal hijacking	link	1 mapped technique	1 source
2016 ~	APT28 Komplex macOS trojan delivered with a Russian space-programme decoy (2016)	cyber espionage	supply chain	1 mapped technique	2 sources
2016 ~	Kobe Steel and Pasco defence-contractor breaches (Japan, disclosed 2020)	supply chain compromise	supply chain	2 mapped techniques	2 sources
2016	North Korean GPS jamming of South Korean aviation, shipping and telecommunications (2016)	RF jamming	user	2 mapped techniques	3 sources
2016 ~	Maritime GNSS spoofing campaign attributed to the Russian Federation (2016-2018)	signal spoofing	user	2 mapped techniques	3 sources
2016 ~	JAXA and ~200 Japanese organisations targeted by Tick (2016-2017, attributed 2021)	cyber espionage	No primary segment recorded	1 mapped technique	3 sources
2015 ~	ESA subdomain credential and collaborator-directory leak (2015)	data exposure	No primary segment recorded	1 mapped technique	2 sources
2015 ~	Iridium pager-network interception demonstrated at Chaos Communication Camp 2015	signal interception	link	2 mapped techniques	3 sources
2014 ~	NOAA NESDIS satellite ground-system intrusion, September-October 2014	network intrusion	ground	3 mapped techniques	3 sources
2014 ~	Hamas takeover of Israel's Channel 10 satellite feed (July 2014)	signal hijacking	link	1 mapped technique	3 sources
2014 ~	Uplink jamming of Arabsat and Eutelsat transponders geolocated to Ethiopia (May-June 2014)	RF jamming	link	7 mapped techniques	3 sources
2014	Jamming of MBC Masr during broadcasts of El-Bernameg (February-March 2014)	RF jamming	link	4 mapped techniques	2 sources
2014 ~	Russian accusation of a Ukrainian electronic attack on a relay satellite (2014, claim)	RF jamming	link	3 mapped techniques	1 source
2013 ~	Mobile-uplink jamming of Thaicom transponders during the Thai political crisis (November 2013 to January 2014)	RF jamming	link	7 mapped techniques	2 sources
2013	Jamming of Al Jazeera's Egyptian satellite services geolocated near Cairo (July 2013 onward)	RF jamming	link	7 mapped techniques	2 sources
2013 ~	UT Austin GPS spoofing experiment against the superyacht White Rose of Drachs (2013)	signal spoofing	user	3 mapped techniques	3 sources
2013 ~	AnonSec claimed NASA breach and data leak (OpNasaDrones), January-February 2016	network intrusion	No primary segment recorded	2 mapped techniques	3 sources
2012 ~	JAXA launch-vehicle data theft by malware (2011-2012)	data exfiltration	No primary segment recorded	4 mapped techniques	5 sources
2012	Consumer GPS jammer interfering with the Newark Liberty ground-based augmentation system (2012)	RF jamming	ground	2 mapped techniques	3 sources
2012 ~	Actel/Microsemi ProASIC3 silicon backdoor claim (Skorobogatov and Woods, 2012)	security research	supply chain	4 mapped techniques	3 sources
2012	Simultaneous jamming, phone-line flooding and network denial of service against BBC Persian (March 2012)	RF jamming	No primary segment recorded	3 mapped techniques	3 sources
2011 ~	JPL privileged-account compromise involving Chinese-based IP addresses, November 2011	network intrusion	ground	4 mapped techniques	3 sources
2011 ~	Jamming of LuaLua TV from within Bahrain from its first hours on air (July 2011)	RF jamming	link	5 mapped techniques	3 sources
2011 ~	ESA FTP server compromise and credential disclosure (TinKode, 2011)	data exposure	No primary segment recorded	1 mapped technique	3 sources
2011	Libyan jamming of Al Jazeera, Alhurra, MBC and Thuraya during the 2011 uprising (February-March 2011)	RF jamming	link	5 mapped techniques	4 sources
2010 ~	Alleged Stuxnet involvement in the INSAT-4B transponder failure (2010, claim refuted)	malware deployment	space	No mapped techniques	2 sources
2010 ~	NASA agency-wide network intrusions reported to Congress (Martin testimony, 2012)	network intrusion	ground	5 mapped techniques	3 sources
2009 ~	Iranian jamming of foreign satellite broadcasts, orbital and terrestrial (2009-2012)	RF jamming	link	8 mapped techniques	4 sources
2009 ~	Brazilian hijacking of US Navy FLTSATCOM transponders (Operation Satellite crackdown, 2009)	signal hijacking	link	5 mapped techniques	3 sources
2008 ~	W32.Gammima.AG worm on International Space Station laptops (2008)	malware deployment	space	2 mapped techniques	4 sources
2008	USA-193 intercept, Operation Burnt Frost (2008)	kinetic ASAT test	space	3 mapped techniques	2 sources
2007 ~	Turla satellite downlink hijacking for command-and-control (2015 disclosure)	signal hijacking	link	3 mapped techniques	2 sources
2007	Landsat-7 and Terra EOS AM-1 interference via a commercial ground station (2007-2008, USCC 2011 report)	network intrusion	ground	4 mapped techniques	3 sources
2007	Chinese direct-ascent ASAT test against Fengyun-1C (2007)	kinetic ASAT test	space	3 mapped techniques	2 sources
2007 ~	Putter Panda (PLA Unit 61486) intrusions against satellite and aerospace industries (disclosed 2014)	cyber espionage	supply chain	1 mapped technique	2 sources
2006 ~	Sustained jamming of Thuraya L-band mobile satellite service from three sites in Libya (2006)	RF jamming	link	5 mapped techniques	1 source
2005	Libyan jamming of a London-based dissident radio uplink, with collateral loss of European broadcast and government services (September-December 2005)	RF jamming	link	7 mapped techniques	2 sources
2005 ~	NASA network intrusions and data exfiltration to Taiwan and Moscow (BusinessWeek, 2008)	data exfiltration	ground	5 mapped techniques	2 sources
2005 ~	LTTE unauthorised use of Intelsat 12 transponder capacity (shut down April 2007)	signal hijacking	link	3 mapped techniques	3 sources
2003 ~	Titan Rain intrusions against US defence, aerospace and NASA networks (2003-2005)	cyber espionage	supply chain	3 mapped techniques	1 source
2003	Uplink jamming of Telstar 12 carrying US and diaspora Persian-language broadcasts into Iran (July 2003)	RF jamming	link	8 mapped techniques	4 sources
2002 ~	Falun Gong hijacking of Sinosat television carriers (June and September 2002)	signal hijacking	link	4 mapped techniques	4 sources
2001 ~	Unencrypted NATO and US Balkans surveillance video receivable from a commercial satellite (disclosed June 2002)	signal interception	link	2 mapped techniques	3 sources
2001 ~	Gary McKinnon intrusions into NASA and US military networks (indicted 2002)	network intrusion	No primary segment recorded	3 mapped techniques	3 sources
2000 ~	GPS jamming during the Greek main battle tank competition at Litokhoro (2000)	RF jamming	user	2 mapped techniques	2 sources
1995 ~	Jamming of MED-TV, the first Kurdish satellite channel (December 1995 to 1999)	RF jamming	link	3 mapped techniques	3 sources
1987	United States v. Haynie: satellite interference from a third-party uplink (September 1987, 940 F.2d 653)	signal hijacking	link	3 mapped techniques	1 source
1986	Captain Midnight hijacking of the HBO transponder on Galaxy 1 (27 April 1986)	signal hijacking	link	3 mapped techniques	3 sources
~	German Aerospace Center (DLR) espionage intrusion (disclosed 2014)	cyber espionage	No primary segment recorded	3 mapped techniques	4 sources
~	GPS jamming affecting Finnish Meteorological Institute weather balloons at Sodankyla (2023)	RF jamming	user	2 mapped techniques	2 sources
~	GNSS spoofing corrupting onboard time on commercial airliners (disclosed 2024)	signal spoofing	user	3 mapped techniques	2 sources
~	Insurgent interception of US drone video feeds in Iraq (disclosed December 2009)	signal interception	link	2 mapped techniques	3 sources
~	Reported US sabotage of Iran's missile and space-launch supply chain (2019, report)	supply chain compromise	supply chain	2 mapped techniques	2 sources

technique index every SPARTA technique, searchable and filterable.
tactic matrix the same techniques arranged by the objective they serve.
tactics the nine adversary objectives, one page each, with what is filed under them.
regulations NIS2, the CRA and the EU Space Act, article by article.
control frameworks NIST 800-53, MITRE ATT&CK, SPACE-SHIELD and the rest.
ENISA controls the Space Threat Landscape's operational measures.
countermeasures SPARTA's own defensive measures.

Corpus 2026.08.24-1, built 2026-08-24 from 226 techniques, 308 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.

›Documented incidents

Documented incidents