safemode.space
← All techniques
EXF-0006
ST0008Exfiltration

Modify Communications Configuration

Description

The adversary alters radio/optical link configuration so the spacecraft emits mission data over paths the program does not monitor or control. Levers include retuning carriers, adding sidebands or subcarriers, changing modulation/coding profiles, remapping virtual channels/APIDs, editing beacon content, or redirecting routing tables in regenerative payloads. Data can be embedded steganographically (idle fields, padding, frame counters, pilot tones) or carried on a covert auxiliary downlink/crosslink pointed at attacker-owned apertures. Because these emissions conform to plausible waveforms and scheduler behavior, they appear as ordinary link activity while quietly conveying payload products, housekeeping, or file fragments to non-mission receivers.

Mappings

EU regulation articles

  • craAnnex I, Part I, (2)(d)
    mitigates
    moderate
    direct

    Communications-config changes should require authenticated commands and access controls; (2)(d)'s authentication and access-management obligation mitigates this attack at the config-change boundary.

  • craAnnex I, Part I, (2)(f)
    addresses
    high
    direct

    Retuning carriers, editing modulation/coding profiles, remapping virtual channels/APIDs, and editing routing tables are unauthorized modifications of communications configuration — the integrity-of-configuration scope (2)(f) covers, including the corruption-reporting requirement.

  • craAnnex I, Part I, (2)(l)
    addresses
    moderate
    direct

    Covert auxiliary downlinks pointed at attacker-owned apertures evade mission monitoring; (2)(l)'s record-and-monitor obligation applies to RF emissions configuration as security-relevant internal activity.

  • eu-space-actArt. 81(3)
    addresses
    moderate
    direct

    Communications-link configuration is a critical-function setting under 81(3)(b)'s scope — only restricted entities should be able to edit transponder routing or modulation profiles.

  • eu-space-actArt. 83(1)
    addresses
    moderate
    direct

    Covert auxiliary downlinks pointed at attacker-owned apertures evade mission monitoring; 83(1)'s continuous monitoring extends to RF emissions configuration as security-relevant internal activity.

  • eu-space-actArt. 84(2)
    addresses
    high
    direct

    Retuning carriers, editing modulation/coding profiles, and remapping virtual channels are unauthorized modifications of network-and-information-system communications configuration — within 84(2)'s Annex VII point 5.1 integrity scope.

  • nis2Art. 21(2)(b)
    addresses
    moderate
    derived

    Spacecraft emissions on configurations the program does not expect — covert sidebands, off-pointed auxiliary downlinks, redirected virtual channels — are detectable incidents Art. 21(2)(b)'s incident-handling capability must surface via spectrum monitoring and configuration-integrity baselines.

  • nis2Art. 21(2)(h)
    addresses
    moderate
    inferred

    Art. 21(2)(h) crypto policy does not interdict a covert downlink created by link reconfiguration or steganographic embedding; the operative control is emission monitoring and egress control. Addresses (domain relevance).

  • nis2Art. 21(2)(i)
    addresses
    moderate
    direct

    Radio/optical configuration commands, virtual-channel/APID remappings, beacon content edits, and regenerative-payload routing tables are access-controlled assets; Art. 21(2)(i)'s access-control + asset-management obligation governs which roles can issue them and how their use is audited.

  • nis2-implAnnex 11.3.1
    addresses
    high
    derived

    Authority to alter communications configuration is privileged-account authority; the privileged-account policy bounds the population that can issue such modifications and applies the review obligations that detect malicious reconfiguration.

  • nis2-implAnnex 3.2.1
    addresses
    moderate
    derived

    Monitoring-and-logging procedures must surface link-configuration changes, anomalous sidebands and unexpected emissions toward non-mission receivers, which are the observable signatures of communications-config exfiltration.

  • nis2-implAnnex 6.4.1
    addresses
    moderate
    derived

    Communications-configuration alterations (carrier retuning, sidebands, modulation/coding profiles, virtual-channel/APID remaps, beacon content, regenerative-payload routing tables) are change-management events that must follow documented procedures with review and rollback paths.

ENISA controls

  • ENISA-STL-2025-03-sD.21-i01
    addresses
    high

    Configuration management of radio/optical link configuration — carriers, modulation/coding profiles, virtual channels, beacon content, regenerative routing tables — directly defeats EXF-0006 unauthorised modifications.

  • ENISA-STL-2025-03-sD.21-i08
    addresses
    moderate

    Documented change-management procedures govern the authorised-change process over communications configuration (transponder routing, SDR profiles), the domain EXF-0006 targets. The relationship is governance-level relevance, not active detection or prevention of an unauthorised modification.

  • ENISA-STL-2025-03-sD.25-i10
    addresses
    high

    Integrity checking on programmable logic and firmware including SDR DSP chains, FEC framing, and routing tables surfaces unauthorised modifications to communications configuration.

  • ENISA-STL-2025-03-sD.29-i06
    addresses
    moderate

    Critical-telemetry-points monitoring covers carrier configuration and modulation parameters as defined points where unauthorised changes are flagged.

Cross-reference controls

SPARTA countermeasures

Cite as SafeMode Space, EXF-0006 (SPARTA v3.2).

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.