Russia downed satellite internet in Ukraine: Western officials

Russia was behind a massive cyberattack against a satellite internet network which took tens of thousands of modems offline at the onset of Russia-Ukraine war, the United States, Britain, Canada and the European Union said on Tuesday.

The digital assault against Viasat's KA-SAT network in late February took place just as Russian armour pushed into Ukraine. US Secretary of State AntonyBlinken said the cyberattack was intended "to disrupt Ukrainian command and control during the invasion, and those actions had spillover impacts into other European countries."

British Foreign Secretary Liz Truss called the satellite internet hack "deliberate and malicious" and the Council of the EU said it caused "indiscriminate communication outages" in Ukraine and several EU member states.

The Viasat outage remains the most publicly visible cyberattack carried out since Russia's invasion of Ukraine, in part because the hack had immediate knock-on consequences for satellite internet users across Europe and because the crippled modems often had to be replaced manually.

"After those modems were knocked offline it wasn't like you unplug them and plug them back in and reboot and they come back," the US National Security Agency's Director of Cybersecurity Rob Joyce told Reuters on the sidelines of a cybersecurity conference on Tuesday.

"They were down and down hard; they had to go back to the factory to be swapped out."

The precise consequences of the hack on the Ukrainian battlefield have not been made public, but government contracts reviewed by Reuters show that KA-SAT has provided internet connectivity to Ukrainian military and police units.

The satellite modem sabotage caused a "huge loss in communications in the very beginning of war," Ukrainian cybersecurity official Victor Zhora said in March.

The Russian Embassy in Washington did not immediately return a message seeking comment. Moscow routinely denies it carries out offensive cyber operations.

Viasat did not immediately return a message. A Viasat official told Reuters in late March that the hackers involved in the initial sabotage effort were still trying to interfere with the company's operations, although to limited effect.

The satellite modem-wrecking cyberattack remains the most visible hack of the war, but many others have taken place since and not all of them have been made public.

"That was the biggest single event," said Joyce. "It certainly had new and novel tradecraft, but there have been multiple attacks."