HoneySat: A Network-based Satellite Honeypot Framework
Efrén López-Morales
Network and Distributed System Security (NDSS) Symposium 2026 · Day 1 · Distributed Systems
This talk presents **HoneySat**, a high-interaction honeypot framework designed to detect and analyze network-based attacks against satellite ground infrastructure. The system creates believable decoy satellite missions that combine **real mission control software** with **simulated spacecraft** and **virtual ground stations**, enabling defenders to observe attacker behavior in a controlled environment without exposing real mission data. Deployed across five instances -- including one co-located in the address range of an actual mission in Chile -- HoneySat attracted attackers who performed **spacecraft component discovery**, attempted **telemetry data exfiltration**, and probed for **onboard procedure modification**.
AI review
A genuinely novel honeypot framework for satellite ground infrastructure that achieved real-world attacker engagement including attempted command modification. The satellite-in-the-loop capability -- synchronizing honeypot interactions with actual RF transmissions to defeat spectrum-monitoring adversaries -- is creative engineering I haven't seen before. The ROSAT incident context and 33/38 Space ATT&CK coverage demonstrate deep domain understanding. This is applied deception tradecraft at its best.