New research reports more than 237 cyber actions that struck space infrastructure from 2023 to 2025.
Experts warn that cyber warfare now threatens space satellites and communications systems.
They note that 237 hostile operations hit the space sector between January 2023 and July 2025 during the Gaza conflict.
Analysts at the Center for Security Studies (CSS) at ETH Zürich gather social media posts, news reports, and cybercrime-forum material to document attacks on Israeli and international space agencies.
The data shows that Israel and Iran triggered the highest surge of space-focused cyberattacks in June 2025, when actors carried out 72 operations in a single month.
This figure forms nearly one-third of all incidents recorded during the entire study period, according to report author Clémence Poirier.
The study states that cyber activity against the space sector now reflects a broader wartime pattern also observed during Russia’s recent invasion of Ukraine.
Researchers identify nearly all threat actors as pro-Palestinian groups except for one.
The study notes that Hamas lacks satellites or space systems over Gaza, and researchers suggest that pro-Israeli groups may have acted secretly.
Methods Behind the Digital Strikes
Ten attacks appeared in October after Hamas launched its armed incursion on October 7, 2023.
These attacks hit organisations such as the Israel Space Agency (ISA) and the defence firm Rafael.
The report states that the escalation surprised global hacktivists and delayed their coordination as they selected targets.
Hacktivists struck 77 space-related organisations or companies during the Gaza conflict.
They concentrated attacks on Rafael, Elbit Systems, and the ISA, but they also hit international bodies such as NASA.
Researchers note that attackers targeted aerospace and defence firms mainly because those firms build military hardware rather than because of their space activities.
More than 70 percent of recorded space-related cyber events used denial-of-service attacks that overloaded networks until systems failed.
Attackers used DDoS tools quickly because the tools require little expertise and can distract from deeper intrusions.
Other operations involved data leaks, intrusions, and information theft.
Some actors timed leaks or data sales to key moments in the conflict, although the study says researchers cannot always verify these links and warns that attackers may fabricate such timing.
The study concludes that the visible incidents likely represent only a fraction of the true scale of activity uncovered through manual open-source investigation.
Expanding Patterns of Conflict
The space sector saw its largest activity spike when Israel and Iran exchanged attacks for 12 days in June 2025, producing 72 cyber operations.
Pro-Palestinian and pro-Iranian groups targeted Israel simultaneously throughout that surge.
The report states that both wars shaped each other politically, militarily, and rhetorically, while many actors operated across both arenas.
Hacktivists copied techniques from other conflicts and reapplied them during the Gaza fighting.
A 2023 DDoS attack by the so-called Cyber Army of Palestine on the ISA used code that resembled tools used by the IT Army of Ukraine.
Most incidents caused limited physical or operational damage, yet the activity pattern points to the emerging future of space-related cyber conflict.
The study argues that cyber operations now form consistent elements of modern warfare because hacktivists show strong interest in targeting space-industry actors.
Researchers call for new space-focused cyber strategies to safeguard essential space infrastructure from future attacks.
