Cyber Is the Quiet Weapon in Orbit: Lessons from DIA's 2026 Space Threat Report

On 26 October, the US Defense Intelligence Agency released the 2026 edition of Challenges to Security in Space, its third open assessment after the 2019 and 2022 editions. Most headlines went to lasers and spaceplanes. If you work in space cybersecurity, the bigger story is how the report treats cyber: as one layer in a toolkit that adversaries are learning to combine, not as a side issue.

Cyber Sits Inside a Threat Continuum

The report arranges counterspace threats on a scale from reversible to irreversible. Denial and deception, along with electronic attacks such as jamming and spoofing, are temporary. Cyber attacks, directed-energy weapons and orbital threats can have temporary or permanent effects. Kinetic strikes, physical attacks on ground infrastructure and a nuclear detonation in space cannot be undone.

Cyber attacks, in DIA's description, target the data inside a satellite signal and the systems that use, transmit and control it. The report names three access points: the orbital, link and terrestrial segments. Each is a way in.

That makes cyber attractive. It sits low on the escalation ladder, its effects can be tuned, and it does not by itself fill orbit with debris. The attack surface is also growing fast. As of June 2026, the report counts 15,058 satellites in low Earth orbit alone.

Russia Uses Cyber as an Opening Move

Russia's approach is the clearest case study. Since at least 2010, its military has built forces and capabilities for what it calls "information confrontation," a broad idea of information superiority that includes space-enabled collection and transmission.

The proof came on 24 February 2022. Russian malware targeted customers of Viasat's satellite broadband service just before the invasion of Ukraine and disrupted service for 50,000 users across Ukraine and other European countries. DIA describes it as preparation of the battlespace.

Jamming has followed. Russian forces have intermittently disrupted GPS over territory they control, and in late 2023 interference was detected across the Baltic region. Estonia's regulator blamed Russia. Russian sources also claim to have used a mobile system called Tirada against the Starlink constellation.

For industry, this is uncomfortable. Moscow has listed US commercial space terminals and other commercial satellites supporting Ukraine as legitimate military targets, which puts commercial operators inside the target set.

China Plans for Combined Arms in Space

China's approach is broader. The report says the People's Liberation Army treats offensive cyber capabilities as a major component of integrated warfare, and probably intends to use cyberattacks for strategic coercion and deterrence: to constrain an adversary's actions or slow its mobilization. Targets could include logistics, commercial activity and the networks that carry command, control and intelligence.

The PLA unit responsible for signals intelligence has supported cyberespionage against US and European satellite and aerospace industries since at least 2007, according to DIA. That espionage feeds military research and acquisition.

Cyber is only one tool. DIA judges that China is taking a combined arms approach, with options from temporary effects to permanent damage. Ground-based lasers can already disrupt, degrade or damage satellites in low Earth orbit, and China may field space-based directed-energy systems by the late 2020s. Commercial firms are developing jammers aimed at synthetic aperture radar and satellite communications, including the extremely high frequencies used by the US military.

China launched 93 rockets in 2025, up from 22 in 2016, and its intelligence, surveillance and reconnaissance fleet passed 510 systems by July 2026, more than triple the 2018 total.

Iran and North Korea Bring Cheap, Deniable Tools

The emerging space powers matter less for what they orbit and more for what they can disrupt. Iran's defense minister said in October 2023 that the country must harness space and cyber capabilities in its national defense. Tehran has publicly acknowledged jamming satellite communications and GPS, and its state-owned electronics industry has marketed GPS jammers.

North Korea's hacker groups have targeted foreign partners' defense industries and the US aerospace sector, possibly to gain access to space technology. Its GPS jamming has deliberately hit civilian receivers near the border with South Korea, including during joint exercises with the United States. Russia has offered help with Pyongyang's space program, and Moscow has also launched satellites for Iran.

None of these tools is sophisticated, which is exactly why they spread. According to the report, cheaper satellites and commercial launch services are making formerly government-centered space services available to state and non-state actors with malign interests.

Trends Shaping Orbit Through 2040

DIA identifies five forces that will make space more contested and more crowded over the next 15 years.

Adversary cooperation. China supplies components to Russia, and Russia supports Iran and North Korea. Beijing and Moscow also offer launches and satellites to many other countries, seeking influence and prestige.

Commercialization. Cheaper small satellites and commercial launch put once state-only capabilities within reach of anyone with enough money, including actors with malign interests.

Reusable launch. Only the United States has an operational reusable rocket. China hopes to be second, and programs in Russia, Japan and Spain plan tests by 2033.

Artificial intelligence. The report calls it "super intelligence." Russia and China are researching it for command and control, space domain awareness and intelligence. The PLA describes this as the "intelligentization" of warfare.

Orbital congestion. As of June 2026, 15,058 satellites are in low Earth orbit, 271 in medium Earth orbit, 572 in geostationary orbit and 22 in highly elliptical orbits. More than 35,000 cataloged objects larger than 10 cm circle the Earth, plus an estimated 600,000 to 900,000 lethal but untracked fragments in low orbit. Nearly half of low-orbit debris traces to three events: China's 2007 anti-satellite test, the 2009 satellite collision and Russia's 2021 Nudol test. New mega-constellations will probably triple the low-orbit population by 2030, and collision risk will keep rising through at least 2040.

What the Space Sector Should Do

One caveat: this is a US government assessment, and Beijing has dismissed it as threat hyping. Readers outside the United States, including in Europe, should treat it as one important input and compare it with independent analysis.

Still, the practical direction is clear.

Defend every segment. Ground stations, links and on-board software all need security attention, not only the satellite.

Plan for commercial targeting. Operators and service providers supporting government customers should assume they are in scope.

Prepare for degraded navigation and communications. Jamming and spoofing are routine, so resilience and fallback plans are part of cybersecurity.

Share information early. Combined attacks span cyber, electronic and physical domains, and defenders need a joint picture.

Invest in people. Few professionals understand both space systems and security. Closing that gap is a strategic task.

Conclusion

Defenders who plan for layered, combined attacks on EVERY segment will be the ones still online when the next crisis begins.