The First Shot of the Space War Won't Be a Missile

Last week a Russian military satellite parked itself about 500 metres from a commercial radar satellite that feeds imagery to Ukraine. Then it sat there.

Five hundred metres. In orbit, that's close enough to read the serial numbers.

The Russian spacecraft is Cosmos 2612. The target was ICEYE-X36, a synthetic aperture radar satellite run by the US arm of Finnish company ICEYE. According to tracking firm LeoLabs, Cosmos 2612 closed in between October 15 and 19, loitered, made a string of small adjustments, then backed off in a controlled departure. LeoLabs called it the first known unsanctioned rendezvous in low Earth orbit. Some Russian launch watchers on Telegram claim it got much closer than 500 metres. I'd treat that number carefully. 500 metres is plenty.

This wasn't a near miss. Nobody matches another satellite's orbital plane by accident.

This didn't start last week

Cosmos 2612 went up in April as one of six Russian satellites launched together. By May, US Space Force was publicly flagging Russian satellites sitting near a Western commercial radar satellite used by Ukraine. Over the summer, four of them, Cosmos 2610 through 2613, shifted orbits toward the same target. October was the closest look yet.

Go higher and the story gets older. In geostationary orbit, Russia's Luch/Olymp "inspector" satellites have been shadowing Western comms satellites since 2014, sometimes for months at a stretch. The Financial Times reported that European officials believe the pair intercepted traffic from at least a dozen European satellites. In 2024 the Pentagon said Cosmos 2576, parked in the same orbit as a US government satellite, was likely a counterspace weapon. Moscow called it fake news.

So the pattern is ten years old. What changed is the distance. And the target is a company.

I've seen this play before

I've spent 26 years doing incident response. Over 600 engagements. The one thing that never changes: by the time anyone notices the attacker, they've been inside looking around for a while.

Recon comes first. Always. They map what you have, how it talks, what it depends on, and who notices when something moves. Then they wait for a reason.

That's what Cosmos 2612 looks like to me. LeoLabs said the same thing in more careful language: the maneuvers show capabilities that could support intelligence collection, inspection, coercive signalling, interference, or groundwork for future counterspace operations. Pick any one of those. None of them are friendly.

It's also a message. Russia knows LeoLabs is watching. It knows Space Force is watching. Doing this in plain view is the point. "We can get to your eyes whenever we want" is a cheap thing to say when you say it with a satellite you've already launched.

The first shot already happened

Everyone pictures the space war as missiles and debris clouds. The first real shot looked a lot more like a bad firmware update.

On February 24, 2022, hours before Russian troops crossed into Ukraine, Viasat's KA-SAT network went down. Not the satellite. The modems on the ground. Thousands of terminals used by the Ukrainian military and government were knocked offline, and the spillover cut internet for tens of thousands of users across Europe. Wind farms in Germany lost remote monitoring.

That was a space attack. It just didn't happen in space.

This is why I keep telling people a satellite is just another network. There's the spacecraft, the ground stations, the uplinks, the user terminals, the software supply chain, and the vendors with remote access into all of it. The bird in orbit is the hardest piece to reach. Everything else is stuff we already know how to break, because attackers break it in corporate networks every day.

Flying a spacecraft to within 500 metres of a target is expensive, slow, and visible. Phishing an engineer at a ground station operator is none of those things.

Commercial companies are the front line now

ICEYE-X36 isn't a military satellite. It's a commercial product, registered in the United States and launched from the US in 2024. ICEYE has been selling radar imagery to Ukraine since 2022 and expanded that deal with Ukraine's Ministry of Defence in January. Ukrainians literally crowdfunded access to an ICEYE satellite back in 2022, and Ukrainian military intelligence says it had pulled more than 5,900 images from that "People's Satellite" by May of this year.

That imagery finds Russian equipment. Russia noticed.

Same story with Starlink. Same story with Viasat. The war in Ukraine turned commercial space operators into combatants whether they signed up for it or not. Their boards didn't vote on it. Their customers didn't get a memo.

If you're a vendor whose product helps one side of a war, you're a target. If you're a customer of that vendor, you're downrange. Most third-party risk programs I've reviewed never even ask the question.

You don't own a satellite. You depend on dozens.

GPS isn't just maps. It's time. Cell networks, card payments, power grid synchronization, and a lot of the logging I rely on to rebuild an incident afterward all lean on satellite timing signals. GPS jamming and spoofing are already routine around the Baltic and in conflict zones. Airline crews deal with it constantly.

Then there's satellite comms for remote sites, fishing fleets, rural connectivity, and the backup link nobody has tested since the day it was installed. Weather data. The imagery your insurer uses to price your risk.

Ask your team one question this week: if satellite timing and comms went sideways for 72 hours, what breaks first?

If the answer is "we don't know," that's your finding. Write it down.

Keep it in proportion

The sky isn't falling. Nobody is about to start shooting satellites out of orbit for fun. Russia blew up one of its own dead satellites in 2021 and the debris field sent its own cosmonauts scrambling for shelter on the ISS. Kinetic attacks in orbit hurt everyone, the attacker included.

The realistic threats are quieter. Jamming. Spoofing. Blinding sensors. Cyber attacks on ground segments and the vendors who run them. Close approaches designed to rattle operators and the governments behind them until they pull back support. That's the gray zone, and Russia has been comfortable living there for a decade.

Bottom line

The space war isn't coming. The opening move happened in February 2022, through modems on the ground. Last week was just the part we could finally see.

Treat space like the rest of your attack surface. Know what you depend on. Know who your vendors are working for. And assume the recon has already started, because in my experience it always has.