Low-Earth-orbit constellations communicate with ground stations in windows of 8 to 12 minutes, several times per day. Satellite Eclipse exploits the operational pressure of these windows: ground stations authenticate rapidly, often with credentials cached from the previous pass, and monitoring is tuned for throughput rather than anomaly detection.
The weapon positions itself as a man-in-the-middle at the ground-station uplink — physically, via compromised edge routers, or logically, via BGP hijack of the station's management plane. It captures the authentication exchange, waits for the legitimate station to lose line-of-sight, then initiates its own pass using the replayed credentials.
The August 2027 incident observed a single satellite commanded to de-orbit its own telemetry cache and accept a new ground-station whitelist. The legitimate operator lost contact for 72 hours. Attribution remains contested; the replayed credentials were valid, making the malicious commands indistinguishable from authorized ones in the audit log.