Introduction February 24th, 2022, just an hour before Russian invaders crossed the Ukrainian Border, a large-scale cyberattack started disabling tens of thousands of satellite-connected internet modems across Europe 1. The target was Viasat’s KA-SAT broadband network, used by government agencies, civilians, and most importantly, the Ukrainian military. At the time of the attack, over 100,000 modems across Europe were served by the KA-SAT network 2. Within hours of the attack beginning, 45,000 SurfBeam2 modems had been permanently disabled by malware later dubbed AcidRain 3. This was not just a single attack; Viasat’s own investigators later revealed in a talk at DEFCON 31 that the incident was the culmination of high-level coordination involving two simultaneous attacks. These sophisticated attacks were designed to knock terminals offline and used a destructive wiper to permanently brick them. ...