Orbital Escalation: Modeling Satellite Ransomware Attacks Using Game Theory

1. Problem Statement

While ransomware is a well-documented threat to terrestrial systems, the paper argues that the conditions for such attacks on space-based assets (satellites) already exist, yet no formal framework exists to model or defend against them.

• The Threat: Attackers could compromise Low Earth Orbit (LEO) or Medium Earth Orbit (MEO) satellites via ground-side vectors or on-board vulnerabilities (e.g., NASA's cFS), blocking legitimate operators from accessing spacecraft.
• The Unique Challenge: Unlike terrestrial systems where communication is continuous, satellite operators face constrained communication windows (orbital passes). This creates a time-sensitive, sequential decision-making environment where delays in response (waiting for the next pass) accumulate significant downtime costs and allow ransom demands to escalate.
• The Gap: There is no public policy or mathematical framework guiding satellite owners on whether to pay ransoms, attempt recovery, or accept mission loss under these specific orbital constraints.

2. Methodology: The Orbital Escalation Game

The author proposes a Stackelberg Game (a sequential leader-follower game) called the Orbital Escalation Game. The model assumes perfect information and rational actors.

A. Game Structure

• Players:
  • Attacker (Leader): A ransomware adversary (e.g., state-sponsored APT) who initiates the attack and commits to a ransom policy.
  • Defender (Follower): The satellite operator who observes the ransom and chooses a response strategy.
• Time Horizon: The game unfolds over discrete orbital passes ($k = 1 \dots K$). The game ends if the defender pays, refuses, a restore succeeds, or the maximum horizon $K$ is reached.
• Ransom Escalation: The ransom demand $R_k$ increases linearly with each pass: $R_k = R_0 + (k-1)\Delta R$.

B. Strategies

• Attacker Strategy ($\pi_A$): Defined by the initial ransom ($R_0$) and the escalation increment ($\Delta R$). The attacker incurs a one-time exploit cost ($C_{atk}$) and a holding cost ($c_{hold}$) per pass.
• Defender Strategies: At each pass, the defender chooses one of four actions:
  1. PAY: Transfer ransom $R_k$ (Game ends).
  2. IDLE: Wait for the next pass (Incurring downtime cost $c_{\downarrow}$).
  3. RESTORE $j$: Attempt a specific recovery procedure $j$ (Cost $C_j$, duration $d_j$ passes, success probability $p_j$).
  4. REFUSE: Abandon the satellite (Incurring mission loss $L_{ref}$).

C. Solution Approach

The equilibrium is solved using Dynamic Programming and Backward Induction:

1. Defender's Optimization: The defender minimizes expected cost using the Bellman equation. At each pass, they compare the cost of paying, idling, attempting a restore (factoring in failure probability and future costs), or refusing.
2. Attacker's Optimization: Knowing the defender's optimal response policy ($\mu^*$), the attacker selects $R_0$ and $\Delta R$ to maximize their expected payoff (Ransom received minus exploit and holding costs).
3. Equilibrium: The solution is the Subgame Perfect Nash Equilibrium (SPNE), where the attacker's policy and the defender's response are mutually optimal.

3. Key Contributions

1. First Game-Theoretic Model for Space: This is the first formal model applying game theory to satellite ransomware, specifically accounting for orbital mechanics (passes) and space-specific constraints.
2. Dynamic Framework: Unlike static terrestrial models, this model captures the temporal evolution of ransom demands and the "ticking clock" nature of orbital communication windows.
3. Comprehensive Cost Modeling: Integrates 7 economic factors, including downtime costs, restore procedure costs, success probabilities, and mission loss values.
4. Open-Source Tool: The author provides an open-source analysis tool to implement the model and calculate equilibria.

4. Case Study Results: GPS III Satellite

The model was applied to a fictional ransomware attack on a GPS III satellite (valued at ~$450M in mission loss, with $3M/pass downtime cost).

A. Theoretical Equilibrium (Ideal Conditions)

• Scenario: An attacker (D3FILERZ) demands $112.5M initially, escalating by $6M/pass. The horizon is 4 passes.
• Optimal Defender Strategy: The defender should never pay. Instead, they should prioritize high-probability restore attempts.
  • Passes 1–3: Execute "Safe Mode" (High success rate $p=0.9$, low cost).
  • Pass 4: If Safe Mode fails, execute "Privileged Telecommand" (Lower success rate $p=0.4$, but faster).
• Outcome: The attacker receives $0 ransom and incurs a net loss of -$14.04M (due to exploit and holding costs). The defender saves the satellite with minimal operational costs.

B. Realized Scenarios (Operational Reality)

The paper contrasts the ideal equilibrium with two operational scenarios:

1. Unprepared Defender: Lacks Standard Operating Procedures (SOPs).
   • Result: Delays in initiating restores lead to "IDLE" passes. The ransom escalates, and the Safe Mode attempt fails due to lack of timely execution.
   • Outcome: Defender is forced to pay $136.5M. Total cost: $148.51M. Attacker profit: $122.46M.
2. Prepared Defender: Has tested SOPs and executes immediately.
   • Result: Executes Safe Mode and Privileged TC within the time constraints.
   • Outcome: Satellite recovered. Total cost: $9.02M. Attacker profit: -$14.03M.

5. Significance and Implications

• Operational Readiness is Critical: The study demonstrates that the difference between a catastrophic financial loss ($148M) and a manageable operational cost ($9M) lies in preparation (having tested restore procedures).
• Policy Guidance: Provides a quantitative basis for satellite owners to invest in recovery testing, simulation, and "wargaming" before an attack occurs.
• Strategic Insight: Shows that for high-value assets, paying ransoms is often suboptimal compared to aggressive recovery attempts, provided the recovery success probability is sufficiently high and the downtime costs are managed.
• Limitations & Future Work: The model currently assumes perfect information and discrete passes. Future work aims to incorporate Bayesian games (uncertainty), continuous communication windows (Inter-Satellite Links), and constellation-level attacks.

Conclusion

The paper establishes that while satellite ransomware is a theoretical threat today, the Orbital Escalation Game provides a robust framework for decision-making. It proves that with proper preparation and a strategy focused on rapid, probabilistic recovery rather than payment, satellite operators can neutralize ransomware threats even against sophisticated adversaries.