Figurines with computers and smartphones are seen in front of the words "Cyber Attack", binary codes and the Ukrainian flag, in this illustration taken February 15, 2022.
Figurines with computers and smartphones are seen in front of the words "Cyber Attack", binary codes and the Ukrainian flag, in this illustration taken February 15, 2022. Reuters / DADO RUVIC

Russia was behind a massive cyberattack against a satellite internet network that took tens of thousands of modems offline at the onset of Russia-Ukraine war, the United States, Britain, Canada, Estonia and the European Union said on Tuesday.

The digital assault against Viasat's KA-SAT network in late February took place just as Russian armour pushed into Ukraine. U.S. Secretary of State Antony Blinken said the cyberattack was intended "to disrupt Ukrainian command and control during the invasion, and those actions had spillover impacts into other European countries".

British Foreign Secretary Liz Truss called the satellite internet hack "deliberate and malicious" and the Council of the EU said it caused "indiscriminate communication outages" in Ukraine and several EU member states.

The Viasat outage remains the most publicly visible cyberattack carried out since Russia's invasion of Ukraine, in part because the hack had immediate knock-on consequences for satellite internet users across Europe and because the crippled modems often had to be replaced manually.

"After those modems were knocked offline it wasn't like you unplug them and plug them back in and reboot and they come back," the U.S. National Security Agency's Director of Cybersecurity Rob Joyce told Reuters on the sidelines of a cybersecurity conference on Tuesday.

"They were down and down hard; they had to go back to the factory to be swapped out."

The precise consequences of the hack on the Ukrainian battlefield have not been made public, but government contracts reviewed by Reuters show that KA-SAT has provided internet connectivity to Ukrainian military and police units.

The satellite modem sabotage caused a "huge loss in communications in the very beginning of war", Ukrainian cybersecurity official Victor Zhora said in March.

In a statement, Ukraine's State Service of Special Communications and Information Protection said that Russia "is an aggressor country attacking Ukraine not only on our land, but in cyberspace too".

The Russian Embassy in Washington did not immediately return a message seeking comment. Russia routinely denies it carries out offensive cyber operations.

Viasat said in a statement that it "recognised" the announcement and would continue to work with government officials to investigate the hack. The company did not provide an update on a Viasat official's comments to Reuters in late March that the hackers were still trying to interfere with the company's operations, albeit to limited effect. [L2N2VW2XC]

The satellite modem-wrecking cyberattack remains the most visible hack of the war, but many others have taken place since and not all of them have been made public.

"That was the biggest single event," said Joyce. "It certainly had new and novel tradecraft, but there have been multiple attacks."

SpaceX billionaire Elon Musk said his company's Starlink satellite broadband service, which is available in Ukraine, had resisted Russian cyberwar jamming and hacking attempts, though adding in a post on Twitter: "They're ramping up their efforts".