Issue 156 | October 27, 2026
The integrity flash
Analysis of Developments in the Space Domain
Cosmos 2612 v ICEYE-X36: A Review & Look Forward
Up, over, back down, in close, and out again: a consolidated look at the Cosmos 2612 / ICEYE-X36 episode, April through 23 October 2026, and what to watch for next with ICEYE-X37.
Plane changes in low Earth orbit are rare, because they are expensive. That single fact is the key to reading Cosmos 2612 story, and it is why the decisive signal in this episode appeared months before the close approach that drew headlines.
In October, Russia maneuvered Cosmos 2612 (68762) into the orbital plane of ICEYE-X36 (59103), a commercial Synthetic Aperture Radar (SAR) satellite that supports Ukraine, closed to within a few hundred meters on 17–18 October, backed away, and on 20 October parked itself in X36’s orbit roughly 400 kilometers behind it (watch COMSPOC Video). Meanwhile, two of its siblings, Cosmos 2613 and 2611, are drifting toward the orbital plane of a second ICEYE satellite, X37, with crossings around 5 and 14 November. 2612’s maneuvering was deliberate, efficient, and observable. What Russia intends to do from that position is not observable at all. Holding those two statements apart is the entire discipline of this kind of analysis, so this piece is organized around it: what the data shows, what we can reasonably assess, what remains merely possible, and what the evidence does not support.
What we observed in May
Russia launched Cosmos 2609 through 2614 on 17 April 2026, using a Soyuz 2.1b with a Volga upper stage. Between roughly 13 and 21 May, Russia raised the inclination of five of those satellites, Cosmos 2610 through 2614, by about 0.8 degrees, bringing them to 97.8 degrees and nearly co-planar with ICEYE-X36.
The significant word is co-planar. Each of those inclination changes cost on the order of 106 meters per second of delta-v. That figure is spacecraft agnostic, and it is large for small LEO satellites. A satellite built only for routine earth observation, signal collection, or communications does not typically carry the propulsion budget to make that kind of move, let alone make it five times across a cluster. The expenditure itself was evidence that these satellites were built to maneuver aggressively.
Over the same window the cross-track range between Cosmos 2612 and ICEYE-X36 fell from roughly 100 kilometers to under 5 kilometers. By 29 May, Cosmos 2614 was the closest of the group, passing ICEYE-X36 four times inside 20 kilometers over a two and a half hour span, with the lighting geometry favoring the Russian satellite on two of those passes.
Our read at the time, documented in Issue 146 of The Integrity Flash and in our companion analysis, was stated carefully: we did not know Russia’s intentions or the specific capabilities of those satellites, but maneuvering into a co-planar orbit is alarming, because plane matching is the first and most fuel-expensive step toward Rendezvous and Proximity Operations (RPO). In Issue 152 (23 August) we noted the five were stacked 0.6–5.2 km above X36, slowly phasing through the plane, and none had maneuvered to stay plane-matched. Cosmos 2612 was the closest, just 0.6 km above X36.
The setup: up, over and back down
Sitting slightly above X36 through the summer, Cosmos 2612’s plane precessed a little slower than X36’s. By 30 September its RAAN had drifted about 0.24° from X36’s, roughly 28 km of maximum cross-track separation. Fixing that directly would have taken a ~31 m/sec cross-track burn. Russia chose a different route, and in hindsight the next two weeks were one deliberate sequence:
- 30 Sep climb (~25 m/sec): Raising 2612 ~46.5 km to ~590 km slowed its precession enough that J2 walked its plane back toward X36’s at ~0.02°/day. The higher orbit also increased 2612's orbital period and, as a result, X36 would pass 2612 about once every 7 days.
- 7 Oct trim (~4 m/sec): A small inclination increase (97.870° → 97.901°) fine-tuned the precession rate, most likely timing the plane crossing to the planned descent window.
- 12 Oct descent (27.9 m/sec, 0217Z): With the planes aligned, 2612 dropped its period 59.5 seconds and trimmed its inclination ~0.05° to 97.85°. In a single maneuver it nearly matched X36’s altitude (555 vs 556 km), inclination, and orbital plane, trailing by ~475 km. Because both now sat at nearly the same altitude, their RAAN values changed at the same daily rate and the planes stay matched without further maneuvering.
Commercial space domain awareness providers supporting the Joint Commercial Operations (JCO) Cell flagged the 12 October burn as a possible RPO initiation, and we reported it the same day in Issue 155 of The Integrity Flash. The two-week round trip cost ~57 m/sec. A direct plane fix would have cost about half as much but done nothing for phasing; Russia bought both a corrected plane and a new in-track position. This was a precisely timed and economical setup and demonstrated (at least to me) a clear threat to X36.
Cosmos 2612 SMA minus ICEYE X36 SMA, 12–21 Oct 2026: close, hold, withdraw, park (based on data from celestrak.org).
Plane matched, shape nearly matched
The first step in setting up an RPO is plane matching (inclination and RAAN). The second is shape matching (eccentricity and argument of perigee). After 12 October both satellites had eccentricities of about 0.002, with arguments of perigee about 4° apart, a difference worth an estimated 0.25 m/sec. The expensive part was done. Closing an in-track gap with plane and shape already matched takes only small changes in altitude (SMA), and the closure rate is Russia’s to choose. X36, a ~90 kg smallsat whose last detectable maneuver was a ~0.6 km SMA reduction on 25–27 June, had unknown propellant and limited ability to evade.
Russia waited 3 days to close the gap.
- 15 Oct, close: 2612 dropped its SMA about 2.3 km below X36’s. A lower orbit is a faster orbit, so it began eating into the ~475 km in-track gap quickly.
- 16 Oct, stop: It raised its SMA by about the same amount, back to X36’s altitude, arresting the closure in the satellite’s vicinity.
- 17–18 Oct, hold: Small trims of roughly 0.1–0.15 km, consistent with the repeated station-keeping LeoLabs described while 2612 sat within hundreds of meters. Most of these maneuvers are so small that they do not show up in orbital tracking data.
On 17 October Vantor was able to capture an image of both satellites separated by just over 1km.
Cosmos 2612 in trail position about 1km from ICEYE X36 (axios.com & @TomNovelly via X)
According to LeoLabs vice president of technical solutions Adam Marsh, between 17-18 October Cosmos 2612 had closed to within a couple hundred meters of ICEYE-X36 and was maneuvering repeatedly to hold that position. ICEYE-X36 did not maneuver to open the distance. COMSPOC_OPS presented similar analysis, “From 16–18 October they (2612 & X36) spent ~24 hours within 2 km of each other and ~12 hours within 1 km…Closest pass in our solution was ~60 m (max uncertainty ~950 m) near 14:18 UTC (17 Oct).”
COMSPOC Visualization of ~60m Close Approach (note 950m max uncertainty) (@COMSPOC_OPS via X)
Test Complete?
Then Cosmos 2612 backed off. Late on Sunday, 18 October, it raised into a slightly higher orbit, which slowed it relative to ICEYE-X36. By Monday afternoon the separation was reported at ~400 km and growing by roughly 16 km per hour.
- Late 18 Oct, withdraw: A ~2.3 km raise put 2612 above X36. A higher orbit is a slower orbit, and the gap opened at roughly 15 km per hour.
- 20 Oct, park: Between 2018Z on 19 October and 0727Z on 20 October, 2612 lowered its SMA ~2.5 km, back to within about 20 meters of X36’s. That stopped the drift. It now trails X36 by roughly 480 km and, with the two at essentially the same altitude, that gap is holding nearly constant.
The two satellites remain plane-matched. Through 21 October the RAAN difference is <0.004° and inclinations agree to within 0.001°. X36 has still not maneuvered, and none of 2612’s four siblings have maneuvered since 12 October.
For me, the last burn is perhaps the most telling. Russia did not withdraw Cosmos 2612 to a parking orbit of its own or rejoin its siblings. It backed out a few hundred kilometers and then deliberately re-matched X36’s orbit. From where it sits, a ~2 km drop in SMA would bring it back alongside X36 in roughly a day.
Planning an RPO while remaining passively safe a few hundred meters from an uncooperative target (with unknown maneuver capability) requires continuous, deliberate control, which is exactly what the repeated maneuvers Marsh described indicate. This was not a drift-by. It was a position, actively maintained.
Estimates of the closest point vary with the limits of tracking. LeoLabs told Ars Technica that Cosmos 2612 came within 500 meters and likely much closer, and a US official at the UN suggested it may have closed to roughly 100 feet (~30 m). As noted previously, COMPSOC noted a possible 60m close approach…in any case the conclusion is the same: Russia deliberately maneuvered to within 1km of ICEYE X36.
Bringing Cosmos 2612 within 1km of a satellite noted for supporting Russia's adversary is most likely to support a kinetic attack. Imaging the satellite or collecting/disrupting its signals can be done from much greater distances and more effectively. Russia did everything necessary to engage X36 save pull the trigger. Engage with what is a fair question…we don’t know the 2612's payload. Nets, harpoons, sub-satellites/projectiles are all possibilities. The advantage of having a co-orbital weapon is the much lower relative velocity which enables the attacker to destroy its target without generating a massive debris field. We covered this with Jack Anthony years ago. COMSPOC estimated a differential velocity of “0.15–0.9 m/s, walking pace or slower.” Compare this with a direct ascent anti-satellite (DA-ASAT) missile which strikes its target in speeds measured in km/sec. I’ll guess at Russia’s intent later, but I’m confident they did not conduct this RPO to collect intelligence on a commercial radar imaging satellite.
Fuel accounting
Through the 20 October parking burn, Cosmos 2612 has expended roughly 180 m/sec since launch, about 65 m/sec more than any of its four siblings. Russia spent ~57 m/sec in two weeks on the setup, then only ~5 m/sec on the entire close, hold, withdraw and park sequence of 15–20 October. The other four, at ~112–114 m/sec each, have not maneuvered since July.
Next in line: ICEYE-X37
Cosmos 2612 is not the only satellite from the April launch with a commercial radar satellite in its sights. Since the May plane changes, the slow, uneven J2 drift we tracked against X36 has been carrying the other four siblings toward and through the planes of another nearby ICEYE spacecraft. Two of them are now approaching ICEYE-X37 (59102): Cosmos 2613 (68763) first, around 5 November, then Cosmos 2611 (68759), around 14 November. Neither has maneuvered since July, and the projected crossing dates hold to within a day across every data window from September through 21 October.
RAAN offset of Cosmos 2610, 2611, 2613 and 2614 from ICEYE-X37, Aug–21 Oct 2026, with no-maneuver projections (GP element data, celestrak.org).
What we would see if Russia goes after X37
Cosmos 2612 gave us a template, and each step of it is observable. If Russia intends a second close approach on an ICEYE satellite, the first indication will be a plane match maneuver.
- A burn that freezes the plane, near the crossing: The decisive signal. For 2613, a small descent toward X37’s altitude (~2.9 km) combined with an inclination trim (~0.05°) within a few days of 5 November. For 2611, a ~0.8 km drop and ~0.02° trim any time from late October through November. Once a sibling sits at X37’s altitude and inclination, J2 precesses both planes at the same rate and the alignment holds without further cross-track burns. This is the equivalent of 2612’s 12 October burn, and JCO providers would likely flag it as a possible RPO initiation.
- Alternatively, a J2 timing move: If Russia needs more time or a different crossing date, it may repeat 2612’s 30 September approach: raise or lower the orbit to change the precession rate and walk the plane into place, possibly with a small inclination trim like 2612’s 7 October burn.
Editor’s Comments
Like the Uncle who offers to help clean the dishes as you’re drying the last piece of silverware, US official responses arrived on 21 October at the UN General Assembly’s First Committee. As reported by Ars Technica, State Department official Brian Hardesty told the committee that Cosmos 2612 had shown threatening behavior and that its actions “appear consistent with an on-orbit weapons operation,” calling the decision deliberately reckless and a violation of long-established safety thresholds in LEO. Under Secretary of State Thomas DiNanno echoed the message on X. Jessup Taylor, the US Deputy Permanent Representative to the Conference on Disarmament, suggested Cosmos 2612 may ultimately have closed to roughly 100 feet, noted that Russia never explained why a military satellite moved within tens of meters of another country’s commercial satellite, and summed it up neatly: what you do in orbit speaks louder than what you say on the ground. These were the first US government statements since the approach.
Russia’s Konstantin Vorontsov, (yes, the same diplomat who in 2022 called commercial satellites supporting Ukraine potential “legitimate” targets for retaliation) offered vapid reassurances. Voronstsov described US & European concerns as unfounded “loudspeaker diplomacy” and insisted that all Russian space activity, specifically including Cosmos 2612, is “purely peaceful in character.” Color me skeptical.
I had the opportunity to talk through this event with Kari Bingen and Clayton Swope on the CSIS channel, and I’d encourage readers to watch the full interview. We spent a good part of the conversation on the question I can’t yet answer: what is Russia actually trying to accomplish?
The military logic of going after X36 itself is thin. In the past two months alone ICEYE has launched eight additional SAR satellites, bringing its constellation to more than 60 operational spacecraft. Destroying or disabling one of them would not be insignificant, and it would certainly be a dangerous precedent, but it would not appreciably affect the imagery Ukraine receives. If Russia was attempting to deter either Ukraine or ICEYE, this seems to have failed.
One reader (thank you Thomas), writing after the CSIS discussion, offered the explanation that makes the most sense to me: that this RPO is about testing whether NATO’s Article 5 would hold, and dividing the alliance in the process. That fits a pattern we see in other domains. Thomas noted, “At the 2021 Brussels Summit, NATO stated that attacks to, from, or within space could lead to the invocation of Article 5, to be decided case by case. That deliberate ambiguity is exactly what makes it testable.” Russia used a military satellite to threaten an asset owned by NATO members and probe the line of what would trigger Article 5. It was a probe of where the line sits, and if the alliance says nothing, the line moves a little.
China Launches 3rd Yaogan-50
23 Oct 2026: China added a third satellite to its retrograde Yaogan-50 family with the launch of Yaogan-50 03 (101149). The first element set for the new satellite, dated 23 October, puts it in the same 142° retrograde inclination as Yaogan-50 01 (67433), launched 13 Jan 2026, and Yaogan-50 02 (68196), launched 15 Mar 2026. Like its two predecessors, YG-50 03 rode a Long March-6A out of the Taiyuan Satellite Launch Center, making it three-for-three on the same rocket and launch site. SAST has now built two of the YG-50 satellites (01 & 03) while CAST built YG-50 02. China described both earlier missions with its standard imagery language: “national land surveys, crop yield estimation, and disaster prevention and mitigation.” The Yaogan family of satellites is also believed to support the Chinese military. Launch Video.
As we have noted previously, a 142° inclination is unusual. It gives the satellites coverage from 38°N to 38°S, and because they travel east-to-west, against Earth’s rotation, they cross the ground faster than a prograde satellite at the same altitude. At ~952 km, a YG-50 satellite crossing the equator moves ~6.8 km/s relative to the ground below, versus ~6.1 km/s for a prograde satellite at 38° inclination, or roughly 12% faster. Higher relative velocity benefits Synthetic Aperture Radar (SAR) imaging, which is why we continue to assess YG-50 as a SAR constellation.
YG-50 03’s Initial Orbit: A Near Copy of YG-50 01
YG-50 03’s initial orbit is almost a carbon copy of YG-50 01’s initial orbit. The two first element sets match to within 0.2 km of SMA (823.2 vs 823.1 km), 0.0001 in eccentricity and less than 1° in argument of perigee (110.7° vs 110.0°). YG-50 02 was the outlier, injected ~15 km higher (838.7 km) with a lower eccentricity and a different argument of perigee (128.5°).
All three were released into a slightly elliptical orbit just below the ~952 km operating altitude which means we now have another LM-6A upperstage in LEO for centuries. YG-50 01 maneuvered into its operational orbit with a ~133 km SMA raise and was on station within a week. YG-50 02 took five smaller burns over ~10 days. I suspect YG-50 03 to follow YG-50 01’s profile.
YG-50 02: Still Flying After July Shedding Event
In Issue 153 we reported 43 pieces of debris cataloged from YG-50 02, and in Issue 154 we passed along Jim Shell’s analysis that the event was low-energy and that the satellite appeared to survive. Latest orbital data continues to support the “not dead yet” assessment. YG-50 02 has now maneuvered twice since the event: an orbit raise of ~45 m on 10–11 September and another of ~36 m on 24 October. Both are consistent with its pre-event station-keeping pattern (22 April and 1 July). YG-50 02’s SMA shows no disturbance at the ~20 July event date, and it continues to hold ~952.3 km with near-zero eccentricity. The bus is clearly still controllable. Whether the payload is healthy remains unknown.
Constellation Observations
- YG-50 01 makes a small orbit raise (~30–50 m) every 28–42 days (37-day average), while YG-50 02 has used a longer 44–71 day cycle. Both satellites maneuvered on 23–24 October, within a day of YG-50 03’s first element set; the timing may simply reflect each satellite’s normal schedule.
- Hints at an Architecture? YG-50 03 has a nearly 180° RAAN offset with YG-50 01. For SAR imaging satellites having opposing pairs spreads target coverage 12 hours apart rather than being grouped together. If YG-50 02/03 are the first pair then we can expect China to launch YG-50 04 directly opposite YG-50 01 to create four planes with two balanced pairs.
- YG-50 03’s plane is not yet final. While YG-50 03 is lower it precesses ~0.3°/day faster, so a 7–10 day climb would narrow its gap with YG-50 01 by ~2–3°, to roughly 66–67°.
China Launched YG-50 03 (SAST) Into An Orbit with 180° RAAN Offset with YG-50 02 (CAST). Expect YG-50 04 to be built by CAST and launch into a 180° RAAN Offset Orbit with YG-50 01 (Based on data from celestrak.org).
China Launches 2nd Set of Yaogan-53 & Yaogan-56 Triplets
23 Oct 2026: China launched a second Long March-4B from Jiuquan carrying six more Yaogan-53/56 satellites, six weeks after the first batch went up on 10 September. Seven objects have been cataloged (101151-101157); we expect six are payloads and one is the rocket body. As with the first group (100651-100155), it is not yet known which objects are YG-53 and which are YG-56. According to official sources, the satellites entered the preset orbits successfully and will be “primarily used for scientific experiments, land and resources surveys, crop yield estimation and disaster prevention and reduction”. Launch Video.
As of 26 October orbital data on the second group remains sparse. Only 101151 and 101157 have element sets so far, but both show a near-identical orbits to the first group: ~518 km circular orbit and a 45.0° inclination. RAAN values are different, so we know enough to say the two groups are not co-planar. On 24 October, Group 2’s RAAN was 304.6°, about 72° east of Group 1 (~232.7°). Both groups share the same altitude and inclination, so both drift westward at the same ~5.4°/day and maintain the ~72° separation.
It is still too early to predict China’s constellation plan. Two planes do not reveal the final design. A ~72° separation would fit five evenly spaced planes (360° ÷ 5), but it could just as easily reflect the launch date and time rather than a planned spacing. If there’s a third launch and we see another 72° RAAN offset that will increase confidence.
23 Oct 2026: LM-4B Lift Off from Jiuquan (with Launch Patch). (nasaspaceflight.com)
YG-53/56 Group 2 has 72° East RAAN Offset from Group 1. Suggests Constellation of 5 Orbital Planes. (based on data from Celestrak.org)
Group 1 Update
In Issue 153 we reported the 10 September launch of Group 1. In Issue 154 we reported that all six had begun maneuvering and spreading out within their shared plane. Six more weeks of data show that spreading has continued, and the two satellites that moved furthest from the rest of the group have now stopped drifting.
- Object B (100652): after its ~4.1 km raise on 17–21 September, which slowed it relative to the others, B stepped back down in several burns between 14 and 25 October to ~518.7 km, close to the rest of the group. That stops its drift.
- Object E (100655): did the mirror image. After lowering ~1.7 km in mid-September to speed up relative to the others, it climbed back to ~518.7 km between 30 September and 25 October, which also stopped its drift.
- Objects A, C, D (100651, 100653, 100654): made only small adjustments (0.4–0.85 km) and remain closely grouped.
- Object F (100656): has not maneuvered since 21 September and is now the lowest of the group (~516.9 km), so it is still drifting forward relative to the others at ~2°/day. Its position is not yet settled.
Taking Shape? YG-53/56 Group 1 has 3 satellites (C,D & A) nearly equal distance from one another. Unclear what final form of B,E & F will be. (saberastro.com)
Maneuver History for YG-53/56 Group 1 (based on data from Celestrak.org)
The latest separations suggest Group 1 may be splitting into two triplets rather than spreading evenly around the orbit. That is an early read based on six weeks of data, and the picture could change as the satellites keep maneuvering.
- Triplet 1: A, C and D (100651, 100653, 100654). These three are nearly evenly spaced: ~1,834 km from C to D and ~1,935 km from D to A. All three have made only small, similar-sized adjustments, which also fits a planned arrangement.
- Triplet 2: B, E and F (100652, 100655, 100656)? These may form a second, wider group, but all continue to change relative position. As of 25 October, B leads E by ~11,492 km (~95°) and E leads F by ~7,306 km (~61°), far from uniform. B and E now have equal SMA and are have stopped drifting relative to one another. F has not maneuvered since 21 September and is still moving forward relative to the others. If F is headed for a slot that evens out the spacing, a second formation becomes more convincing. If F stops where it is, the uneven gaps would argue against it.
B and E look most deliberate. Each used the textbook phasing move (change altitude to drift, then match altitude to stop), and both reversed course within days of each other in late October. That kind of coordination points to a plan, even if we can’t yet tell what the final layout is. Two other explanations remain possible:
- Still deploying. All six could keep phasing until they are spread more evenly around the orbit, and the current triplets would just be an intermediate step.
- One formation with leaders and trailers. A, C and D could be the core formation, with B, E and F acting as separate leading and trailing satellites rather than a second formation.
Group 2 may help settle this. If its six satellites also break into two triplets, especially one tight and evenly spaced and one wider, the two-formation design would look much more likely. We will keep watching both groups.
China Launches Guowang Group 28
25 Oct 2026: China launched a Long March-8A from Wenchang with Group 28 of the Guowang (China SatNet LEO) constellation. According to official sources, the 9 satellites (101185-101193) entered the preset orbit successfully. As with other Wenchang launches, China placed the satellites into an 50.0° inclined orbit. The LM-8A delivered its payload into 1,049km orbits, slightly lower than the previous 2 improved LM-8A launches (Groups 23 & 26 were inserted ~1,100km). From here the Group 28 satellites will slowly increase their altitudes to reach the desired 1,149km. Watch Group 28 Launch Video.
DEPLOYMENT UPDATE: Guowang Groups 25 (1,005km) and 27 (935km) satellites continue to raise their orbits to reach the operating altitude of 1,149. Group 24 completed their orbit raising on ~22 Oct 2026, 67 days after launch. Group 26 satellites completed their orbit raising on ~12 October, only 18 days after launch. This is the fastest deployment of Guowang satellites to date. Group 23 also used the LM-8A and completed deployment in just 28 days. Using the improved LM-8A reduces deployment time from 2+ months to 2-4 weeks.
CONSTELLATION OVERVIEW: There are now 231 operational Guowang satellites in LEO (there are also 3 GEO satellites associated with Guowang). As of 24 Oct 2026, 25 of 28 Guowang groups have reached their operational altitudes. With a stated goal of reaching 310 satellites on orbit by 2027, China will need to launch 79 satellites in the next 2 months.
LM-8A Takes flight from Wenchang with China SatNet Group 28 (nasaspaceflight.com)
Constellation Overview Graphics: The Following Graphics are based on data from Celestrak.org.
Cyber Series Part 4 - Inside the Satellite: Cyber Threats to Spacecraft Subsystems
By Dr. Larissa Beavers
Satellites depend on more than ground stations and communications networks to operate. Once a command reaches a spacecraft, onboard computers and supporting systems must process the instructions and carry out the requested functions. These systems control everything from spacecraft orientation and electrical power to communications and payload operations. A problem affecting one subsystem can interfere with others, even when the spacecraft remains otherwise functional.
Part 3 explored how cyberattacks on ground infrastructure can disrupt satellite services. Part 4 shifts the focus onboard, examining how unauthorized commands or compromised software could affect spacecraft subsystems and their operations.
Inside the Spacecraft
A satellite consists of multiple subsystems, that work together to support its mission, as illustrated in Figure 1. In many spacecraft, the Onboard Computer (OBC) serves as a central hub, processing commands, managing data, and coordinating communications among systems. Although space architectures vary, the OBC often performs key Command and Data Handling (C&DH) functions, while some rely on dedicated controllers. Telemetry, Tracking, and Command (TT&C) functions support communications between the spacecraft and ground operators. Communications equipment receives commands and transmits telemetry, allowing operators to monitor spacecraft health and performance. (C&DH) processes and routes commands, manages onboard information, and supports communication among spacecraft components. Some spacecraft use centralized flight computers, while others distribute processing and control among several devices.
Figure 1: On-board Computer is the central hub that links all spacecraft functions together Linkedin
The Electrical Power System (EPS), Figure 2, generates, stores, and distributes electricity to onboard equipment. Attitude Determination and Control (ADCS) uses sensors and control mechanisms to determine and maintain the spacecraft's orientation. This is essential for pointing antennas toward ground stations, directing instruments toward targets, and positioning solar arrays. Thermal control maintains equipment within acceptable operating temperatures, while propulsion systems support orbital maneuvers and, on some spacecraft, attitude control.
Figure 2: Dragonfly Aerospace’s EPS-LP SatSearch
The payload performs the satellite's primary mission, whether that involves collecting imagery, providing communications, or conducting scientific observations. Unlike the supporting spacecraft bus, the payload's design and functions depend heavily on the mission.
These subsystems are closely related. Consider an Earth-observation satellite preparing to collect imagery. Its attitude control system must point the instrument toward the intended location, the power system must supply sufficient electricity, and onboard computers must manage the observation and store the collected data. A failure affecting any of these functions could interrupt the collection without necessarily disabling the imaging instrument.
The same relationships are relevant to cybersecurity. Access to a payload computer does not automatically provide control over propulsion or power systems. The consequences of unauthorized access depend on the spacecraft's internal architecture, the interfaces between components, and the authority assigned to the affected software or equipment.
When Software Access Changes Spacecraft Behavior
In 2023, the European Space Agency (ESA) supervised a cybersecurity demonstration involving OPS-SAT (Figure 3), an experimental satellite designed to test new technologies and operating procedures. Researchers from Thales Alenia Space uploaded software that introduced a vulnerability, which they later exploited to access a normally restricted spacecraft control layer.
After gaining access (Figure 4), the researchers demonstrated two effects. They replaced an image captured by the satellite’s camera and changed the spacecraft’s orientation, or attitude. The first affected the integrity of mission data, while the second demonstrated the ability to influence a physical spacecraft function.
The experiment was conducted under controlled conditions. OPS-SAT was designed to accommodate experimental software, and the researchers had detailed knowledge of the spacecraft. Their approach was tested on a ground-based copy before being used in orbit. ESA supervised the activity and retained control throughout.
The experiment also demonstrated the importance of recovery. The activity was conducted entirely within the spacecraft's random-access memory (RAM). Following the test, ESA reset the affected memory and restored the satellite to a previously established safe software state. The spacecraft sustained no damage. OPS-SAT was not representative of every operational satellite. Its experimental architecture and the access granted to researchers were central to the demonstration. Nevertheless, the test showed that access to onboard software could affect both the information a satellite produces and its physical behavior.
Different Subsystems, Different Consequences
A cyber intrusion affecting one spacecraft subsystem may produce very different results from an intrusion affecting another. Interference with communications or TT&C functions could prevent operators from receiving telemetry or transmitting commands. Spacecraft rely on uplink communications to receive instructions from ground operators and downlink communications to return telemetry and mission data. For example, NASA's James Webb Telescope uses the Deep Space Network to receive commands and transmit spacecraft telemetry and scientific data, as illustrated in Figure 5. Interference with these communications could disrupt operations, while manipulation of onboard data could affect the accuracy of information returned to Earth. Neither outcome necessarily requires control over the spacecraft's orientation, propulsion, or other critical functions.
Figure 5: Communications between Webb Telescope and DSP, illustrating the uplink of commands and downlink of spacecraft telemetry and scientific data NASA/STScl
Attitude control presents a different concern. Satellites rely on precise orientation to maintain communications links, position solar arrays, and direct sensors toward their intended targets. Unauthorized changes to pointing commands or control settings could interrupt these activities if an attacker gained sufficient access. The OPS-SAT demonstration provided a controlled example of attitude manipulation, although it did not establish that the same technique would work against other spacecraft.
Figure 6: IAU architecture of TeamIndus lunar lander Medium
Power, thermal, and propulsion systems work together to support spacecraft operations. As shown in Figure 6 and 7, the TeamIndus lunar lander design uses an Integrated Avionics Unit (IAU) to coordinate these functions. Its power management module distributes electricity to onboard systems, thermal control uses sensor readings to regulate heaters, and propulsion control operates the spacecraft's engines and thrusters. Unauthorized changes to these functions could interrupt equipment, affect operating temperatures, or interfere with planned maneuvers. Such effects would require access to the relevant control systems and the ability to overcome existing safeguards.
Figure 7: Major functional components of the Integrated Avionics Unit of TeamIndus lunar lander Medium
The distinction between payload and spacecraft-bus functions is particularly important. Manipulating imagery or interrupting an observation may affect the reliability or availability of mission information while leaving the spacecraft operational. Interference with essential bus functions could have broader consequences because communications, power, and attitude control support multiple onboard activities.
These examples describe potential effects, not a record of successful attacks against every subsystem. The OPS-SAT experiment demonstrated specific capabilities under controlled conditions. Other outcomes depend on spacecraft design, the level of unauthorized access, and the protections separating onboard functions.
Why Onboard Security Is Different
Spacecraft present operational challenges that complicate cybersecurity. Unlike terrestrial systems, satellites generally cannot be brought into a maintenance facility for repairs. Operators must address software problems, equipment failures, and unexpected behavior through available communications links, sometimes with limited contact opportunities or significant communications delays.
Flight software also operates within the spacecraft's processing, memory, and power constraints. Updating it requires careful testing because an unsuccessful change could affect equipment needed to maintain communications or recover the spacecraft.
For these reasons, spacecraft incorporate mechanisms intended to detect faults and preserve essential functions. Depending on the design, these may include redundant equipment, watchdog timers, autonomous fault protection, and safe operating modes. Such mechanisms are primarily designed to address failures and operational anomalies, but they may also help limit the consequences of certain cyber incidents.
They do not replace cybersecurity controls. Command authentication and authorization, software integrity protections, and separation of critical functions remain important because fault-protection systems cannot be assumed to recognize malicious activity.
The OPS-SAT experiment illustrates both sides of this problem. Researchers were able to reach restricted software functions and alter spacecraft behavior, but ESA retained the ability to recover the satellite. The test demonstrated a potential avenue of interference without causing permanent damage.
A compromised payload, communications system, or flight-control function would not necessarily produce the same operational consequences. Evaluating a spacecraft cyber threat requires understanding what the affected subsystem does, which other functions depend on it, and what level of control an attacker would need to influence its operation.
A satellite's interconnected subsystems are essential to its mission, but they also create opportunities for cyber interference. Understanding how these systems operate helps identify where vulnerabilities could affect spacecraft performance.
Coming in Part 5 — Losing the Link: What happens when a satellite loses its connection to Earth? Next, we examine how cyber threats could disrupt spacecraft communications, interfere with command and control, and affect mission operations.
Pics o’ the Fortnight!
Incredible 0.9 cm Resolution from Vantor! Satellite pictured above was launched and manufactured by China but is publicly listed as an Algerian Space Agency Earth Observation satellite. (Vantor Via Linked In)
Martian Moon eXploration (MMX) Flight Profile (MMX launch featured on cover). Amazing Mission JAXA! (https://www.mmx.jaxa.jp/en/mission/)