Finished SpyChain!

After nearly a year of design, implementation, and refinement, the SpyChain project is complete.
SpyChain represents the first full simulation of coordinated, multi-component supply-chain malware within a small-satellite environment, implemented entirely inside NASA’s NOS3 framework.

Background

Modern CubeSats rely on modular software architectures—particularly NASA’s Core Flight System (cFS)—that allow plug-and-play integration of third-party components.
While this modularity accelerates development, it also expands the attack surface. SpyChain explores how vendor-supplied modules could be compromised to act maliciously once integrated into flight software.

Implementation

SpyChain was implemented in NOS3, a high-fidelity satellite simulation that mirrors real spacecraft behavior through simulated hardware models, cFS applications, and COSMOS ground-station tools.
Each malicious component followed the legitimate cFS lifecycle, passing integration and operating invisibly under nominal conditions.
Two agents were developed:

• Trigger Agent — monitored GNSS telemetry to determine orbital insertion, activating malicious behavior only under mission-relevant conditions.
• Attack Agent — established covert communication using a FIFO file and exfiltrated telemetry via the legitimate radio UDP socket, bypassing detection by ground operators.

This design preserved structural fidelity to real CubeSat operations while allowing reproducible testing in a safe, simulated environment.

Results

Across five experimental scenarios, SpyChain demonstrated:

1. Coordinated communication between colluding components without operator awareness.
2. Telemetry exfiltration through legitimate radio channels, indistinguishable from normal downlink traffic.
3. Deceptive diagnostics capable of misleading ground operators and masking real faults.
4. Stealth and persistence, with the malware blending seamlessly into expected mission behavior.

Scenario 5 achieved complete stealth by replacing visible software-bus communication with a covert file channel—proving that supply-chain malware can persist undetected throughout pre-launch testing and on-orbit operations.

Countermeasures

Our results emphasize the urgent need for runtime monitoring, software-bus access control, and system-call filtering (e.g., via seccomp) to limit covert behaviors in flight software.
SpyChain’s insights have already contributed to the SPARTA matrix through a new defense-evasion technique, Component Collusion (DE-0012), formalizing this previously unrecognized threat vector.

Reflection

Completing SpyChain marked a milestone in my small-satellite cybersecurity research.
It bridges theory and practice—transforming abstract supply-chain concerns into measurable, reproducible behaviors within NASA’s open simulation ecosystem.
By sharing this work publicly, the project aims to foster stronger collaboration between academia, NASA, and the wider aerospace community to secure the next generation of modular satellite systems.

arXiv preprint: arXiv:2510.06535