Moonlight Defender - Purple Teaming in Space!

by Ben Hawkins

Day 1 · Creator Stage 4 · · 30 min · 3 min read

Defensive Security Network & Infrastructure

TL;DR

Ben Hawkins detailed two Moonlight Defender purple team exercises for Space Force. MD1 used the Moonlighter cubesat in orbit for a buffer overflow attack with contact windows. MD2 simulated space and ICS/OT systems using NASA NOS cubed and Factory IO. Red and blue teams learned to defend against satellite and ground station threats. Tools included the Space Invader attack platform and open-source software. The exercises aligned with MITRE ATT&CK via SPARTA.

The Cyber Training Gap in Space Operations

▶ Watch (1:06)

Space Force operators train heavily on space systems but cyber is often left out. Red team effects in exercises have no integration on the space side. Operators see no impact. That gap leaves cyber operators untrained for real threats. Hawkins’s team designed Moonlight Defender to close it. The first exercise used Moonlighter, a 3U cubesat in low Earth orbit. It had separate flight control and a cyber payload attacked via APIs. Only one exercise ran because Moonlighter deorbited early.

Moonlight Defender 1: Real Satellite Purple Team

▶ Watch (1:50)

The red team’s primary objective was disrupting imaging operations on orbit. They executed a buffer overflow through contact windows, only able to communicate at specific orbit points. That added stress and time pressure. The blue team sat on console as SOC analysts, mapping key terrain and building dashboards. Aerospace’s SPARTA framework mapped every TTP to MITRE ATT&CK to maintain rigor. The exercise proved that purple teaming with a real satellite provides accurate training data for skill assessment.

Moonlight Defender 2: Simulation and ICS/OT Integration

▶ Watch (8:49)

After Moonlighter deorbited, the team used NASA NOS cubed simulation software. They added a virtual factory environment with PLC-driven Factory IO pallet system. Red team received initial access and laterally moved through the factory to the ground station and satellite. Blue team struggled with ICS/OT unfamiliarity. One operator straight out of high school defended the factory alone. A quick training session helped. The blue team stayed within their daily DCO operator role, using inline response tools with root access. The white cell matured with more exercise expertise.

Tools and Scalable Framework for Space Cyber Exercises

▶ Watch (17:10)

The team built Space Invader, an attack platform focused on rogue ground station capabilities. It can send erroneous traffic and even ransomware a satellite using open-source protocol libraries. The range ran on vSphere 6.7 with open-source software like COSMOS and NASA CFS. A 3D-printed satellite model with Raspberry Pi running core flight software provided the coolness factor for trainees. The goal is a modular, low-cost framework that aligns with Space Force training requirements and can be handed off easily.

Notable Quotes

you give a 19-year-old access to root and able to possibly wipe out an entire root directory Ben Hawkins · ▶ 7:54

we wanted them to be noisy enough to be seen. We wanted to give Blue the opportunity to respond. Ben Hawkins · ▶ 13:01

Space is hard, you know. Ben Hawkins · ▶ 3:57

Key Takeaways

Moonlight Defender closed the cyber training gap for Space Force with two purple team exercises.
Real satellite operations (MD1) and simulation (MD2) both provided valuable training, but ICS/OT systems required special attention.
Open-source tools and a modular framework make space cyber exercises scalable and low-cost for military units.

Filed under

Defensive Security Network & Infrastructure