Viasat KA-SAT Cyber Attack and Enercon Wind Turbines (2022)
Volume 2Energy edition2022Last verified 14 sources, 10 primaryAttributed to Russia by EU, UK and US
On 24 February 2022 an attack on a satellite network cut the remote link to about 5,800 Enercon wind turbines across central Europe. Nobody could see or steer them from afar. They kept generating anyway.
Many entries in this book are about a process that stopped. This one is about a process that did not. An attack on Viasat’s KA-SAT network wiped tens of thousands of modems across Europe, and about 5,800 Enercon turbines lost the link that let anyone see or steer them from afar. Nothing in the record describes anything reaching their controllers. They ran in automatic mode and kept generating.
Somebody built the turbine to run without its operator, and that held. What did not hold was everything around it. One outside network carried the eyes and the hands for thousands of machines, and its management side trusted whoever reached it. Recovery was not a patch but a new modem or mobile link, one wind farm at a time. The link that went dark carried control as well as monitoring. That an attacker holding it could send commands rather than silence is BlastWave’s analysis, not a disclosed fact.
What is not known: How the attacker got through the VPN appliance is not public: Viasat named a misconfiguration but never the device or the flaw, and its security chief said in 2023, as reported, that initial access was still unknown. The EU, UK and US attributed the attack to Russia without publishing their evidence, and none named a unit; Viasat has never attributed it. Nobody has disclosed a cost, whether any output was curtailed while the turbines ran unwatched, or when the last turbine regained remote control.
Recommendation
Take the path away from management Nothing reachable from outside, a VPN edge included, should reach the segment that can command a fleet. A turbine’s satellite terminal sits outside the OT boundary.
Remove standing fleet-wide authority Legitimate management commands wiped tens of thousands of modems at once. Bulk and destructive commands need a named identity and a scoped, logged window.
Make monitoring read one way Monitoring leaves the site one way and nothing on the far side can send a command back, so losing the link costs visibility and never control.
Sources: Viasat, KA-SAT Network cyber attack overview, 30 Mar 2022; Enercon statements, 28 Feb and 28 Mar 2022; SentinelLabs, AcidRain, 31 Mar 2022; EU, UK and US attribution statements, 10 May 2022; CISA/FBI AA22-076A. Full list with links.
Soft Spots: The one-network root cause and “commands rather than silence” are BlastWave’s analysis. “Nothing reached a turbine controller” describes the record, not a forensic finding. AcidRain’s lineage is SentinelOne’s medium-confidence view.
The full record
Every claim numbered to its source. Last updated .
A satellite network attacked, thousands of wind turbines left unwatched, and every one still generating. What is verified, what is only reported, and what is still unknown.
Summary
On 24 February 2022, an attack on Viasat's KA-SAT satellite network wiped tens of thousands of modems across Europe, and about 5,800 Enercon wind turbines lost remote monitoring and control. They kept generating in automatic mode; nothing in the record describes anything reaching their controllers. The EU, UK and US attributed the attack to Russia, naming no unit.1,2,5,6,7
Timeline of the Viasat KA-SAT attack and the Enercon outage
Every date is tied to a source. Press reporting appears only as evidence of what was said.
The VPN is targeted, according to a 2023 conference account of Viasat's investigation.4
Viasat detects malicious traffic on the KA-SAT network.1
Modems across much of Europe leave the network over roughly 45 minutes, including a majority of the previously active modems in Ukraine.1
Enercon says about 5,800 of its turbines in central Europe, about 11 GW, have lost remote monitoring and control and continue to operate in automatic mode; it has informed the BSI. The same day a Reuters headline says the outage "knocks out" thousands of Enercon's turbines; the body of the story carries Enercon's automatic-mode statement.2,10
CISA and the FBI publish advisory AA22-076A on strengthening the cybersecurity of satellite communications network providers and customers.11
677 affected wind farms are back online and 618 are still disrupted, as Enercon later reports.3
Enercon calls the disruption "collateral damage" and writes: "There is no risk to the WECs and never has been." Recovery is by satellite modem replacement or a switch to LTE.3
Viasat publishes its account: a misconfigured VPN appliance, the trusted management segment, and legitimate management commands sent to a large number of modems at once.1
SentinelOne publishes its analysis of a modem wiper it names AcidRain. Viasat responds the same day that the analysis is "consistent with the facts in our report."8,9
The EU, the UK and the US attribute the attack to Russia; none names a unit for it. Canada issues its own statement. AA22-076A is updated with attribution to "Russian state-sponsored cyber actors."5,6,7,11,12
Viasat's security chief, speaking at Black Hat with an NSA official, says as reported that how the attacker gained initial access to the VPN is still not known.4
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Question
What the record says
Status
What was attacked?
Viasat's KA-SAT satellite network: its management segment and tens of thousands of customer modems1
Were the Enercon wind turbines hacked or knocked out?
No. The turbines lost their remote link, not their ability to run, and nothing in the record describes anything reaching a turbine controller. On 28 February 2022 Enercon said about 5,800 of its turbines in central Europe, about 11 GW, had lost remote monitoring and control and were continuing to operate in automatic mode.2 A month later it called the disruption "collateral damage" and wrote:
"There is no risk to the WECs and never has been."
The same release said grid operators kept "unrestricted access" to control the turbines' behavior in the grid, and asked operators and owners to report faults directly to their service contacts.3 What was damaged at the wind farms was the satellite modem, the radio that carried the remote link. Enercon replaced those modems or moved sites to LTE; as of 22 March 2022, 677 wind farms were back online and 618 were still disrupted.3
The statement that nothing reached a controller rests on Enercon's account (automatic operation, no risk, grid access unaffected, modems replaced) and on the absence of any account to the contrary. No document says it in those words, so this page says what the record describes rather than claiming a forensic finding.2,3 Whether any output was curtailed while the turbines ran unwatched has not been disclosed.
How did the attackers get into the KA-SAT network?
Through a misconfigured VPN appliance, according to Viasat, and from there into the network's trusted management segment. Viasat's 30 March 2022 account says the attacker gained remote access to that segment, moved laterally, and then used the network's own management functions:
"legitimate, targeted management commands"
Those commands went to a large number of residential modems at once and overwrote key data in their flash memory. The modems could no longer reach the network, but Viasat says they were "not permanently unusable." Viasat shipped nearly 30,000 replacement modems to distributors and said it had no evidence that the satellite itself or its ground infrastructure was compromised.1
Viasat never named the appliance or the misconfiguration. At Black Hat in 2023, as reported by The Record, Viasat's security chief said the company still could not say how the attacker gained initial access to the VPN; the same account says the VPN was targeted on 23 February.4 That is reporting of a conference talk, not a published Viasat finding.
What malware was used in the Viasat attack, and is it linked to VPNFilter?
A modem wiper that SentinelOne named AcidRain; the link to VPNFilter is SentinelOne's medium-confidence assessment, not an established fact. SentinelLabs published its analysis on 31 March 2022:8
"We assess with medium-confidence that there are developmental similarities between AcidRain and a VPNFilter stage 3 destructive plugin"
The authors also said they "cannot definitively tie" the two, and offered a supply-chain route for delivering the wiper as a hypothesis.8 Viasat's response the same day said the analysis is "consistent with the facts in our report" and that SentinelLabs identifies "the destructive executable that was run on the modems using a legitimate management command."9 That confirms the wiper was used on the modems. It does not confirm the VPNFilter lineage.
Viasat separately said it had "no evidence that standard modem software or firmware distribution or update processes" were used or compromised, which sits awkwardly beside the supply-chain hypothesis.9 Both statements are on the record; neither is resolved. Viasat's own 30 March account names no malware.1
Who was behind the Viasat KA-SAT attack?
The EU, the UK and the US attributed it to Russia on 10 May 2022, without publishing their evidence, and none named a unit for this attack. The EU's declaration names "the Russian Federation" and says the attack "took place one hour before" Russia's invasion of Ukraine.5 The US statement says Russia "launched cyber attacks in late February against commercial satellite communications networks."7 The UK release says "it is almost certain Russia was responsible."6
The UK release does name Russian Military Intelligence, but in a sentence about different activity: the 13 January defacements and WhisperGate. It does not carry that name onto the Viasat attack, and neither does this page.6 Canada, in its own statement the same day, named "the Russian military."12 CISA and the FBI updated advisory AA22-076A on 10 May 2022 with attribution to "Russian state-sponsored cyber actors."11
Viasat has never attributed the attack, in its 30 March account or since, in any record we could read as of September 2026.1 There has been no indictment and no court finding. On timing, Viasat's own account gives detection at about 03:02 UTC and the mass modem drop from about 04:15 UTC; this page does not try to reconcile those times with the governments' "one hour before."1,5
Was the Deutsche Windtechnik attack part of the Viasat incident?
No. It was a separate attack on a separate company, seven weeks later, and no link between the two has ever been established. Deutsche Windtechnik, which services wind turbines, disclosed a targeted cyberattack of 11 April 2022 and said it switched off remote monitoring for about two days. It was reported as affecting about 2,000 turbines.13 It appears here only so that it is not confused with this entry.
What is still not known about Viasat KA-SAT / Enercon
Which VPN appliance was misconfigured, what the misconfiguration was, and how the attacker first reached it. Viasat's security chief said in 2023, as reported, that initial access was still unknown.1,4
The evidence behind the EU, UK and US attributions, none of which has been published, and which unit, if any, carried out the attack.5,6,7
Any cost to Enercon, its customers or Viasat.
Whether any wind output was curtailed while the turbines ran without remote monitoring.
When the last affected turbine regained remote control.
Where the UK release's quotation of Viasat, saying terminals "cannot be repaired," came from.6
Claims about Viasat KA-SAT / Enercon the record does not support
Widely repeated claim
What the record says
"Satellite outage knocks out thousands of Enercon's wind turbines."
The turbines lost remote monitoring and control and kept running in automatic mode. The body of the same story carried Enercon's statement saying so.2,3,10
AcidRain "shares code with VPNFilter."
SentinelOne assessed "developmental similarities" with medium confidence and said it "cannot definitively tie" the two. Viasat confirmed the wiper's use, not its lineage.8,9,14
AcidRain was a wiper built to "permanently" disable routers.
Viasat says the modems could not reach the network but were "not permanently unusable."1,14
"Tens of thousands of terminals have been damaged, made inoperable and cannot be repaired."
The UK release attributes this to Viasat. Viasat's own published account says "not permanently unusable." The quotation's origin has not been found; both are printed here and neither is chosen.1,6
BlastWave analysis: the turbines were the good news
Analysis, not a disclosed fact
Many entries in Hackopedia are about a process that stopped. This one is about a process that did not. It sits on one rung of the consequence ladder: loss of supervisory control with the process continuing. Somebody built the turbine to run without its operator, and that held.2,3 What did not hold was everything around it. In BlastWave's reading of Enercon's statements, one outside network carried the eyes and the hands for thousands of machines, and its management side trusted whoever reached it. Per Viasat, the attacker reached it through a misconfigured VPN appliance and then used legitimate management commands.1 Recovery was not a patch. It was a new modem or a new mobile link, one wind farm at a time.3
The link that went dark carried control as well as monitoring. That an attacker holding such a link could send commands rather than silence is BlastWave's analysis, not a disclosed fact, and it is why this entry is in the book. The argument is about architecture, not competence: Enercon's turbines did what they were built to do, and Viasat published a technical account within five weeks, more than most victims in Hackopedia ever do.
Podcast: “The Deep Space Probe” (9:14). Joe Baxter and Cam Cullen on why the turbines were the good news and the shared link was the problem.
Video: Viasat KA-SAT / Enercon Short (60 to 90 seconds).
Frequently asked questions
What happened in the Viasat KA-SAT attack?
On 24 February 2022, an attacker reached the management segment of Viasat's KA-SAT satellite network through a misconfigured VPN appliance, Viasat said on 30 March 2022, and used legitimate management commands to overwrite data on tens of thousands of customer modems across Europe. About 5,800 Enercon wind turbines in central Europe used those modems for remote monitoring and control and lost that link, though they kept generating.
Were Enercon's wind turbines hacked or shut down?
No turbine shutdown is on the record. Enercon said on 28 February 2022 that about 5,800 turbines had lost remote monitoring and control and continued to operate in automatic mode, and on 28 March 2022 it wrote that there is no risk to the turbines and never has been. Nothing in the record describes anything reaching a turbine controller; what was damaged was the satellite modem.
How did the attackers get into Viasat's network?
Viasat said on 30 March 2022 that the attacker exploited a misconfiguration in a VPN appliance to reach the network's trusted management segment. It has never named the device or the flaw. At Black Hat in August 2023, Viasat's security chief said, as reported by The Record, that the company still did not know how the attacker gained initial access to the VPN.
Who was behind the Viasat satellite attack?
The European Union, the United Kingdom and the United States attributed the attack to Russia on 10 May 2022, without publishing their evidence. None of the three named a unit for this attack; the UK release names Russian military intelligence only for different activity in January. Viasat itself has never attributed the attack, and there has been no indictment.
What is AcidRain, and is it related to VPNFilter?
AcidRain is the name SentinelOne gave, on 31 March 2022, to a wiper used against the KA-SAT modems. Viasat said the same day that the analysis was consistent with its own report and identified the executable run on its modems. SentinelOne assessed developmental similarities with VPNFilter only at medium confidence and said it could not definitively tie the two.
How long did it take to restore remote control of the Enercon turbines?
Recovery meant replacing each site's satellite modem or moving it to an LTE mobile link. Enercon reported on 28 March 2022 that, as of 22 March, 677 wind farms were back online and 618 were still disrupted. When the last turbine regained remote control has not been disclosed. Viasat said it shipped nearly 30,000 replacement modems to distributors.
Was the Deutsche Windtechnik attack part of the Viasat incident?
No. Deutsche Windtechnik, a German turbine service company, disclosed a separate, targeted cyberattack of 11 April 2022, seven weeks after the Viasat attack, and said it switched off remote monitoring for about two days. It is a different company and a different attack, and no link between the two incidents has ever been established.
Primary sources are Viasat's own published account, Enercon's own statements, the researchers' dated publication and the attributing governments' statements. Press is cited only as evidence of what was said.
CompanyViasat, Inc., "KA-SAT Network cyber attack overview," 30 Mar 2022. Detection times, VPN appliance misconfiguration, trusted management segment, legitimate management commands, flash memory overwritten, nearly 30,000 modems shipped, no evidence the satellite or ground infrastructure was compromised. viasat.com
CompanyEnercon statement of 28 Feb 2022, as reported by reNews (1 Mar 2022) and Reuters (28 Feb 2022): about 5,800 turbines in central Europe, about 11 GW, remote monitoring and control lost, turbines continuing in automatic mode, report made to Germany's BSI. renews.biz
CompanyEnercon, "Over 50 per cent of WECs back online following disruption to satellite communication," 28 Mar 2022 (read via the windfair.net republication): "collateral damage"; "no risk to the WECs and never has been"; grid operators' "unrestricted access"; 677 wind farms back online and 618 still disrupted as of 22 Mar 2022; satellite modem replacement and LTE.
PressThe Record, account of the Black Hat 2023 talk by Mark Colaluca (Viasat) and Kristina Walter (NSA), August 2023. Cited as evidence of what was said. therecord.media
GovernmentCouncil of the EU, "Russian cyber operations against Ukraine: Declaration by the High Representative on behalf of the European Union," 10 May 2022. eeas.europa.eu
GovernmentUK Government (Foreign, Commonwealth and Development Office and National Cyber Security Centre), "Russia behind cyber-attack with Europe-wide impact an hour before Ukraine invasion," 10 May 2022. gov.uk · ncsc.gov.uk
FederalUS Department of State, press statement by Secretary Antony J. Blinken, "Attribution of Russia's Malicious Cyber Activity Against Ukraine," 10 May 2022. PDF (archive copy)
ResearcherJuan Andres Guerrero-Saade and Max van Amerongen, SentinelLabs, "AcidRain | A Modem Wiper Rains Down on Europe," 31 Mar 2022. sentinelone.com
CompanyViasat statement on the SentinelLabs report, 31 Mar 2022, as published by The Record and BleepingComputer (1 Apr 2022): "consistent with the facts in our report"; no evidence that standard modem software or firmware distribution or update processes were used or compromised. therecord.media · bleepingcomputer.com
PressReuters, "Satellite outage knocks out thousands of Enercon's wind turbines," 28 Feb 2022 (as carried by MarketScreener). Cited as evidence of what was said. marketscreener.com
FederalCISA and FBI, Joint Cybersecurity Advisory AA22-076A, "Strengthening Cybersecurity of SATCOM Network Providers and Customers," 17 Mar 2022; updated 10 May 2022.
GovernmentGovernment of Canada, "Statement on Russia's malicious cyber activity affecting Europe and Ukraine," 10 May 2022. canada.ca
PressSecurityWeek, report on Deutsche Windtechnik's statement about its 11 April 2022 cyberattack, April 2022. Cited only to show it is a separate incident. securityweek.com
PressWikipedia, "Viasat hack," as read September 2026. Cited as evidence of what is said. wikipedia.org
Cite this page
BlastWave. “Viasat KA-SAT Cyber Attack and Enercon Wind Turbines (2022): What Is Verified.” Hackopedia, Volume 2, FILE 030. Last verified 28 September 2026. https://hackopedia.blastwave.com/energy/viasat-ka-sat-enercon-2022/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 030 in Hackopedia Volume 2, in the Energy edition.
28 Sep 2026
Final review: open items closed at source where possible, and the entry checked for consistency against the related Poland Distributed Energy and Nova Scotia Power entries.
26 Sep 2026
Full validation: every figure, date and quotation checked against Viasat's 30 March 2022 account, Enercon's statements, SentinelLabs' analysis and the three governments' 10 May 2022 statements. This included Viasat's 31 March 2022 statement, which confirms the wiper's use on the modems but not its VPNFilter lineage.
24 Sep 2026
Entry built from primary sources.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
