Space is a Network.
Constellations is Your Connection.
How The Gentlemen ransomware group’s breach of a technology supplier exposed sensitive aerospace and defense data, highlighting the growing cyber risks posed by third-party vendors and interconnected space industry supply chains.
Read more
This research marks a strategic pivot from traditional ground-based interference to adaptive, networked architectures that mirror the design of the networks they target. While currently a simulation, the data points to a future where commercial operators must defend against region-wide, persistent electronic warfare.
The campaign uses convincing recruiter profiles and malicious PDFs to deliver multi-stage malware that steals intellectual property and establishes long-term access. This blending of social engineering with developer-tool compromise raises direct risks for satellite communications firms, component manufacturers, and space-sector integrators.
RedNovember’s campaign emphasizes exploitation of edge devices and supply-chain vendors to establish persistent access. Organizations in defense, aerospace, and space should prioritize patching perimeter devices and hardening remote access to disrupt these espionage operations.
Researchers found hundreds of trojanized packages and a self-replicating worm that steals developer credentials and injects malicious GitHub Actions workflows. Organizations must harden dependency hygiene, enforce strict token and workflow controls, and monitor for anomalous publish activity.
Geopolitical tensions, state-sponsored espionage, and hacktivist campaigns drove a 118 percent surge in space-related cyber incidents between January and August 2025. Simultaneously, GNSS jamming, signal hijacking, and dynamic on-orbit maneuvers reveal how electronic warfare and proximity operations compound vulnerabilities across critical space infrastructure.
Phishing campaigns now deliver LAMEHUG, the first malware that offloads command generation to a large language model in real time. For the space industry, adaptive AI-driven threats can bypass static defenses and tailor exploits to specialized mission-control environments.
Recent campaigns highlight a dangerous vector where threat actors deliberately target IT services and personnel through social engineering. Attacks by groups like Scattered Spider and North Korean IT workers exploit dependencies on help desks and external contractors, posing a significant risk to space organizations.
Expanding beyond traditional battlefields, the Israel-Iran conflict now includes a dramatic surge in cyberattacks and widespread GNSS interference that directly impacts commercial and government space assets. These events show that as geopolitical tensions rise, the space sector is increasingly viewed as a legitimate and strategic target.
On May 13, 2025, the Interlock ransomware group attacked National Defense Corporation (NDC) and its subsidiary AMTEC, potentially exposing sensitive supply chain data. This incident underscores that ransomware is a national security concern with implications for the commercial space sector and the Defense Industrial Base, emphasizing the need for robust cybersecurity across the entire supplier ecosystem.
