Introduction February 24th, 2022, just an hour before Russian invaders crossed the Ukrainian Border, a large-scale cyberattack started disabling tens of thousands of satellite-connected internet modems across Europe 1. The target was Viasat’s KA-SAT broadband network, used by government agencies, civilians, and most importantly, the Ukrainian military. At the time of the attack, over 100,000 modems across Europe were served by the KA-SAT network 2. The attack begins and within hours 45,000 SurfBeam2 modems have been rendered inoperable by malware later dubbed AcidRain 3. This was not just a single attack, but the culmination of high-level coordination involving two attacks simultaneously as Viasat’s own investigators later revealed in a talk at DEFCON 31. ...