{"id":3247,"date":"2026-01-13T15:48:56","date_gmt":"2026-01-13T14:48:56","guid":{"rendered":"https:\/\/www.spacesecurity.info\/mapping-the-thales-satellite-hacking-demo-using-sparta-ttps-and-pwnsat-attck-flow-builder-fork\/"},"modified":"2026-01-15T18:47:16","modified_gmt":"2026-01-15T17:47:16","slug":"mapping-the-thales-satellite-hacking-demo-using-sparta-ttps-and-pwnsat-attck-flow-builder-fork","status":"publish","type":"post","link":"https:\/\/www.spacesecurity.info\/en\/mapping-the-thales-satellite-hacking-demo-using-sparta-ttps-and-pwnsat-attck-flow-builder-fork\/","title":{"rendered":"Mapping the Thales Satellite Hacking Demo using SPARTA TTPs and PWNSAT ATT&CK Flow Builder fork"},"content":{"rendered":"

In 2023, during the CYSAT conference, Thales presented a live demonstration of a satellite hacking scenario, a milestone event that shed light on the cybersecurity challenges of modern space systems. Since then, various experts have analyzed this simulation to better understand how cyberattacks could target satellite architectures and mission operations.<\/p>\n

Context and Background<\/strong><\/p>\n

As part of this effort, Brandon Bailey<\/strong> and Brad Roeher<\/strong> from the SPARTA team<\/strong> conducted a detailed analysis of the Thales demonstration using the SPARTA<\/strong> (Space Attack Research and Tactic Analysis) Framework. Their work, which I describe in this article<\/a>, identified the key Tactics, Techniques, and Procedures (TTPs) involved across the attack lifecycle, creating a foundation for understanding adversarial behavior in space environments.<\/p>\n

In parallel, Kevin Jahaziel Leon Morales<\/strong> and Romel Marin<\/strong> from the PWNSAT team<\/strong> extended the MITRE ATT&CK Flow Builder<\/strong> tool to natively integrate the SPARTA framework. This enhancement allows researchers to automatically generate and visualize space-specific attack flows, a breakthrough for modeling realistic cyberattack scenarios targeting satellites and related ground segments.<\/p>\n

My Objective and Methodology<\/strong><\/p>\n

Building on these complementary works, I set out to reconstruct the entire attack flow of the Thales satellite hacking demo using this upgraded ATT&CK Flow Builder. My goal was to combine the analytical rigor of SPARTA TTPs identified by the SPARTA team with the visual modeling capabilities of the MITRE ATT&CK Flow Builder modified by the PWNSAT team.<\/p>\n

I already conducted a such work by modeling Viasat Cyber Attack\u00a0but with the real MITRE Attack Flow Builder. You can check this work in this article<\/a> in which I also explain what is the Attack Flow Builder Tool designed by MITRE Engenuity\u2019s Center for Threat-Informed Defense (CTID).<\/p>\n

How I achieved this work<\/strong><\/p>\n

The methodology described below is showing the building process that I used to achieve this work :<\/p>\n

    \n
  1. I collected the TTPs identified by the SPARTA team (Bailey and Roeher) during their analysis of the Thales demonstration.<\/li>\n
  2. I used the pwnsat-modified ATT&CK Flow Builder, which supports direct integration with SPARTA taxonomy.<\/li>\n
  3. I constructed a visual diagram mapping the complete sequence of attacker actions, from initial access through payload manipulation to mission impact.<\/li>\n
  4. I validated the consistency of each mapped step with the SPARTA methodology to maintain analytical accuracy.<\/li>\n<\/ol>\n

    The resulting diagram captures not only the technical flow of the attack but also the relationships between threat actions, affected assets, and tactical objectives.<\/p>\n

    Result of my work<\/strong><\/p>\n

    The diagram below is showing the result of my work. Original file in big format can be found below.<\/p>\n

    \"\"<\/a><\/p>\n

    Text inside the grouping action box are from SPARTA.<\/p>\n

    The format used for creating and editing in the Attack Flow Builder is the AFB builder\u00a0 format (.afb). The AFB file below can be used to open the project for further editing in the future.<\/p>\n

    The PNG format is used to save the flow. This format is\u00a0great for visualizing, using in presentations, sharing with others, etc..<\/p>\n