05. Threat Hunting Space and Digital Energy

Paul Coggin from Huntsville, Alabama presents an innovative threat-hunting framework for space systems and digital energy infrastructure. Inspired by contemplating sophisticated attacks like those depicted in Transformers and the Stuxnet incident against Iran's nuclear centrifuges, Coggin argues that conventional IT security monitoring overlooks critical physics-based data sources. Drawing from his background in networking, telecommunications, and SCADA systems, he advocates moving beyond traditional log correlation to monitor low-level electrical and mechanical signals.

**Key Topics:**

Physics-Based Monitoring: The core premise is that threat hunters must monitor operational technology and physical systems at the lowest possible levels—electrical signals, vibration sensors, current draw harmonics, and acoustic monitoring—rather than relying solely on traditional network logs. Monitoring electrical signal harmonics may even detect unknown malware running outside configuration management.

Critical Infrastructure Vulnerabilities: Power grids depend critically on synchronized timing via GPS and NTP; spoofing or jamming these sources can cause widespread outages. Power transformers emit harmonic signatures that could reveal attacks or maintenance issues. Monitoring must extend to synchronization protocols and backup timing sources like cesium and rubidium oscillators.

Maritime and Navigation Security: Satellite communication links into ship navigation systems are prime targets. The Wakashio incident illustrates how multiple monitoring systems provided conflicting data for four days before the ship ran aground on a pristine reef. Echo sounders, wind sensors (anemometers), gyroscopes, and accelerometers on vessels require dedicated threat hunting. Cyber Owl Consulting reports seeing at least one ship attack per day through satellite communication and navigational control system compromises.

Space Systems and Satellites: At least 23 different space operating systems exist, with modern systems converging on hardened Linux kernels (SpaceX uses custom Linux). Command languages include CCSDS standards and ECSS protocols. Confirmed satellite hacking incidents include Landsat 7, NOAA satellites, and UK Skynet. The Slingshot satellite (Aerospace Corporation, September 2022) incorporates intrusion prevention system capabilities with machine learning-based anomaly detection. A European satellite (July 2021) uses software-defined radio to defend against jamming by dynamically reprogramming frequencies.

Telecommunications Network Security: MPLS VPN networks are often treated as secure black boxes but can be compromised by insiders or nation-state actors. BGP hijacking remains persistent. Timing/latency baselines can reveal unauthorized traffic redirection. One organization discovered adversary-added entries in their MPLS VPN by detecting outbound traffic to unexpected international IP addresses.

Emerging IoT and Military: New technologies (LoRa, LoRaWAN, 5G/6G, SpaceX Swarm satellites in very low earth orbit) create novel threat-hunting challenges. Low-speed ham radio protocols could be exploited for command-and-control. Military and emergency responder devices with specialized sensors require new forensic and incident response capabilities.

**Technical Framework:** Coggin references the MITRE ATT&CK framework (39 data sources) and Purdue Model for ICS hierarchies, noting that Level 0/Level 1 devices in industrial control systems have minimal authentication. He advocates creating a 'voyage data recorder' concept—an independent, pristine log collection system for threat hunters monitoring spacecraft and critical infrastructure, separate from operator-maintained systems that may be compromised. Timing serves as a 'truth' indicator; baseline latency across global network paths can reveal anomalous rerouting even without encryption visibility.

**Emerging Tools and Frameworks:** MITRE ATT&CK and MITRE Atlas (for adversarial machine learning attacks), ESA Shield (European Space Agency), Sparta (Aerospace Corporation), Dr. Jacob Oakley's TRICKS framework, and Mitre Caldera for automating red/blue team testing.

**Takeaways:** Threat hunters must expand beyond network monitoring to include physics-based sensors and timing validation. Organizations managing spacecraft, power grids, and maritime systems should establish baselines of electrical, mechanical, and timing signals. As IoT and 5G proliferate, monitoring must include satellite-based communications and emerging protocols.