← back to portfolio
Network Forensics
Orbit Breach: Satellite Ground Station Compromise
Executive Summary
A single packet capture from Cairo Ground Station's HoneySat-NET-01 was reconstructed end to end.
Three concurrent VPN logins were observed, one legitimate and two malicious. One of the malicious
sessions belonged to the attacker, who beaconed to external C2 infrastructure over TLS, then pivoted
via SSH into the satellite TT&C environment using an anomalous service account. From there, a full
satellite command sequence was executed — ending in disabled transmission authentication,
exfiltration of a 249,856-byte navigation data bundle, and anti-forensics cleanup. The second malicious
session was identified as a fully separate decoy chain targeting a decoy satellite asset, distinguished
from the real intrusion by its JA3 TLS fingerprint.
Scenario
Night shift at Cairo Ground Station was supposed to be routine. By dawn, operators reported irregular
behavior on orbital support systems, while automated monitoring insisted most traffic was normal.
A single network capture from HoneySat-NET-01 was provided for investigation — containing
telemetry chatter, operator access, scheduled sync jobs, and unknown external activity woven into the
same timeline. The objective was to reconstruct what actually happened directly from packet evidence.
Evidence Collected
| Artifact | Value | Why It Mattered |
|---|
| VPN Logins Observed | 3 concurrent sessions (udp/1194) | Required separating legitimate from malicious activity before further analysis |
| Legitimate Login | 198.18.5.44 | Confirmed benign, ruled out early |
| Attacker VPN Source | 185.193.88.31 | Identified as the malicious source behind the primary intrusion |
| Attacker VPN Session | SES-VPN771A | Session ID used to trace the attacker's activity through the capture |
| C2 Endpoint | 45.9.148.77:443 (SNI: api.orbit-sync.com) | External infrastructure contacted from the VPN host |
| TT&C Pivot Host | 172.21.1.9 | Internal satellite control host reached via SSH from the VPN host |
| TT&C Session | SES-5700 (ops-backup / svc-ephem) | Session executing the satellite command sequence |
| Command Sequence | TC_OBDH_GET_STATUS … TC_OBDH_LOG_ROTATE_NOW | Full sequence of TT&C commands issued during the intrusion |
| Exfiltration Destination | 104.244.77.12:9443 | External destination for the exported navigation bundle |
| Exfiltrated Volume | 249,856 bytes (3 chunks) | Confirmed successful transfer of the navigation data bundle |
| Decoy VPN Session | SES-VPN-882B (146.70.19.33) | Parallel session later confirmed to be a decoy chain |
| JA3 Fingerprints | 72a589d... (real) / 6734f37... (decoy) | Distinguished the real C2 channel from the decoy channel |
Timeline
| Sequence | Event | Source |
|---|
| Start | Three VPN logins observed on udp.port == 1194: 198.18.5.44 (legitimate), 185.193.88.31 (attacker), 146.70.19.33 (later confirmed decoy) | udp.port == 1194 |
| Next | Attacker session SES-VPN771A identified from 185.193.88.31 as the malicious session requiring further tracing | VPN session log |
| Shortly after | C2 beacon from VPN host 10.77.0.5 to 45.9.148.77:443 (api.orbit-sync.com) | tcp.port == 443 |
| Next | SSH pivot from 10.77.0.5 to TT&C uplink host 172.21.1.9 (ops-backup); anomalous svc-ephem authentication observed | SSH session log |
| Next | TC_OBDH_GET_STATUS accepted | SES-5700 TCP stream |
| Next | TC_PROP_THRUSTER_PULSE_TEST rejected by safety interlock | SES-5700 TCP stream |
| Next | TC_ADCS_SET_MODE_SAFE accepted; HSAT-LEO-07 forced into safe mode | SES-5700 TCP stream |
| Next | TC_FDIR_SET_AUDIT_SINK_NULL — audit destination set to NULL | SES-5700 TCP stream |
| Next | TC_COMMS_DISABLE_TX_AUTH — transmission authentication removed | SES-5700 TCP stream |
| Next | TC_FDS_EXPORT_NAV_BUNDLE executed; 3 chunks (86,016 / 122,880 / 40,960 bytes) sent to 104.244.77.12:9443 | Data-transfer packets |
| Next | TC_FDIR_CLEAR_ALERT_QUEUE and TC_OBDH_LOG_ROTATE_NOW executed (anti-forensics) | SES-5700 TCP stream |
| 2026-02-14 02:28:16 UTC | Session SES-5700 terminated | Session log |
| 2026-02-14 03:00:14 UTC | Unrelated large transfer to internal host 10.88.9.20 (ruled out) | PCAP |
| 2026-02-14 03:50:59 UTC | Final SYN to port 8022 from 77.91.124.165, post-session (unrelated) | PCAP |
Key Findings
- Three concurrent VPN logins were observed; one legitimate (198.18.5.44) was ruled out early, leaving two to investigate further — the attacker session (185.193.88.31, SES-VPN771A) and what was later confirmed as a decoy session.
- A C2 beacon to api.orbit-sync.com was identified via TLS SNI on the legitimate vendor VPN's outbound path.
- The attacker pivoted via SSH into the TT&C uplink host and authenticated as svc-ephem from an IP inconsistent with that account's legitimate usage pattern.
- A full satellite command sequence was reconstructed: status check → rejected thruster test → forced safe mode → audit sink nulled → transmission auth disabled → navigation bundle exported.
- 249,856 bytes of navigation data were confirmed transferred to 104.244.77.12:9443 across three packet chunks.
- Anti-forensics commands (alert queue clear, log rotation) were executed immediately after exfiltration completed.
- A second, parallel VPN session was traced to a fully separate decoy chain targeting a decoy satellite asset, confirmed distinct via JA3 fingerprint comparison.
- Two additional artifacts — a large internal-destination transfer and a late external SYN — were investigated and ruled out as unrelated to the primary intrusion.
Attack Chain
Initial Access
Attacker VPN login from 185.193.88.31 (session SES-VPN771A) identified among three concurrent logins by ruling out the legitimate session first.
Command & Control
Beacon from VPN host 10.77.0.5 to api.orbit-sync.com over TLS (443).
Lateral Movement
SSH pivot to internal TT&C uplink host 172.21.1.9; anomalous svc-ephem authentication.
Execution (ICS)
Satellite command sequence issued: status check, forced safe mode, audit sink nulled, TX auth disabled.
Exfiltration
Navigation bundle exported and transferred (249,856 bytes) to 104.244.77.12:9443.
Anti-Forensics
Alert queue cleared, logs rotated, session terminated.
Decoy Session Analysis
A second malicious VPN session running alongside the attacker's session was investigated to determine
whether it was related activity. Its traffic led through a separate internal pivot host (10.77.0.7) to
a different TT&C target host (172.21.9.9), reaching a decoy satellite asset entirely — not the
real target of the intrusion.
Real Intrusion Chain
- VPN Session
- SES-VPN771A (185.193.88.31)
- Internal Host
- 10.77.0.5 → 172.21.1.9
- TT&C Session
- SES-5700 → HSAT-LEO-07
- C2 / Exfil
- 45.9.148.77 · 104.244.77.12:9443 (249,856 bytes)
- JA3 Fingerprint
- 72a589da586844d7f0818ce684948eea
Decoy Chain
- VPN Session
- SES-VPN-882B (146.70.19.33)
- Internal Host
- 10.77.0.7 → 172.21.9.9
- TT&C Session
- SES-5711 → HSAT-LEO-07-DECOY
- C2 / Exfil
- 198.51.100.250 · 203.0.113.200 (32,768 bytes)
- JA3 Fingerprint
- 6734f37431670b3ab4292b8f60f29984
Overlapping C2 channels initially appeared related; comparing JA3 TLS fingerprints was the deciding
factor in confirming these were two independent chains rather than one.
Analyst Notes
Started by filtering udp.port == 1194 and found three concurrent VPN logins; ruled out the legitimate one first, then had two remaining sessions to trace independently.
Filtered on the VPN host's IP and tcp.port == 443 to identify the outbound C2 beacon and its TLS SNI.
Followed the SSH session into the TT&C environment and cross-referenced the authenticating account against known legitimate svc-ephem usage to flag it as anomalous.
Reconstructed the full command sequence by following the SES-5700 TCP stream end to end, rather than relying on isolated packets.
Verified actual data transfer volume against the export command by tracing the subsequent data-transfer packets, rather than assuming export success.
Investigated two additional artifacts (a large internal transfer and a late external SYN) and ruled both out based on destination and timing rather than dismissing or including them without verification.
Compared JA3 fingerprints between the two parallel C2 channels to confirm the second session was an unrelated decoy chain, not a second stage of the same intrusion.