Satellites guide our flights, time our bank transfers, and carry military communications, often through the same infrastructure. The ENISA Space Threat Landscape, published in March 2025, warns that this mix attracts adversaries ranging from cybercriminals to state-backed APT groups. Space cybersecurity has quietly become one of the most strategic fields in security research.
Space cybersecurity is the protection of satellites, ground stations, and the links between them from cyberattacks. We asked Davis Zheng, Founder and Principal Researcher at Kinryū Labs, why he chose this field, how honeypots reveal attacker tradecraft, and what it takes to fool an adversary who knows satellites inside out.
One year after Kinryū Labs gave its first-ever space research talk at DefCamp 2025, Davis brings the team’s satellite honeypot research to the DefCamp 2026 stage.
Why space cybersecurity attracts nation-state attackers
Most cybercrime follows the money, which is why ransomware gangs target hospitals, factories, and retailers. Space works differently. A single satellite can serve farmers, airlines, and armed forces at the same time, and private companies now own most of the active satellites in orbit, according to ENISA. For Davis, that dual-use nature is exactly what makes the field worth studying.
I was initially drawn to space systems as space is a dual-use technology, with a unique ecosystem and security posture. The same infrastructure serves civilian, commercial, and military users. Furthermore, with minimal financial incentives, space cybersecurity is largely dominated by nation-state actors, leading to possible research into novel frontier attacks.
From a national SOC to satellite honeypots
Davis knows the defensive side well. He is a veteran of the Singapore Armed Forces Digital Intelligence Service and a Cyber Security Agency of Singapore Cyber Olympian, and he led a team within a national 24/7 Security Operations Center that handled nation-state-level incidents. Today, he also tracks platform-abuse actors across millions of domains. So why build systems that invite attackers in?
A honeypot is a decoy system designed to look like a real target, so defenders can watch attackers at work without putting real assets at risk.
Honeypots let us engage threat actors with minimal risk. They show us tradecraft in action, which helps us detect and defend against future attacks before they cause real harm.
One research thread, from DefCamp 2025 to CYSAT Asia
Kinryū Labs brings together two fields that overlap more every year: space systems and advanced threat intelligence. Honeypots came later in the team’s journey as its space research has grown step by step, and the very first step was taken on a DefCamp stage.
At DefCamp 2025, Klara Kim and Donavan Cheah presented a threat model for nanosatellite on-board computers that combined MITRE EMB3D with Threat Assessment and Remediation Analysis (TARA). The talk showed how design oversights before launch, such as exposed debug ports or insecure communications, turn into attack surfaces once a satellite is in orbit. In 2026, Davis and Donavan took that work further at CYSAT Asia in Singapore.
We have been working on cybersecurity in space systems as part of iterative research, working toward a larger goal of developing our own research capabilities in this field. In fact, our research group Kinryū Labs' first-ever space research presentation was at DefCamp 2025 by Klara and Donavan, where we first started working on threat modeling space systems to help identify weak points that a threat actor may target. We have since built on that research, and we are excited to share our progress. CYSAT Asia's threat modeling talk built on the research we did and presented at DefCamp 2025.
What makes a satellite honeypot convincing
The attackers who target space systems are rarely beginners. Many of them understand satellite protocols, ground station software, and mission operations as well as the engineers who built them. A single detail out of place, such as a response that comes too fast or a telemetry value that never changes, can give the game away. So what was harder for Davis: getting the technical details right, or predicting how attackers would behave?
Both, but anticipating behavior was harder. The greatest difficulty would be baiting the threat actors. Threat actors in this field are already deeply knowledgeable about their targets; it is difficult to ensure that we can meet their expectations, that our honeypot is acting exactly as they expect, without missing anything that might make them suspect that it is a honeypot. These key technical details are just some of the interesting things that we will deep dive into during the presentation.
How threat intelligence maps an unexplored space cybersecurity landscape
Threat intelligence is the practice of collecting and analyzing information about attackers, their tools, and their campaigns, so defenders can anticipate what comes next. In most fields, analysts can lean on years of incident reports and shared indicators. In space, public data on real attacks is scarce, and much of what happens stays classified. Davis believes the discipline of his day job is what makes that gap workable.
Working in threat intelligence has helped teach the discipline and skills necessary to explore space cybersecurity, which has been largely unmapped and ignored. There are many applicable, transferable methodologies that I could bring across, such as analytics and hypothesis-driven data collection, which helps in working in a data-sparse field.
Hypothesis-driven collection means analysts start with a specific question about attacker behavior and then gather the data needed to confirm or reject it. In a field with little public data, that focus keeps research efficient and grounded. It is also how a honeypot earns its value, one carefully logged interaction at a time.
DefCamp 2026: a reunion with Romanian friends
For many international speakers, DefCamp is as much about people as it is about research. Davis already has a network in Romania, built through the Global Cybersecurity Camp, an international training program that brings together students and young professionals from several countries each year. The friendships he made there have outlasted the camp itself.
I look forward to visiting all my friends from Romania that I made at the Global Cybersecurity Camp. We still keep in contact and keep each other updated on security happenings all over the world. This international opportunity helps to bring in fresh perspectives and issues that we would rarely encounter in Singapore.
Meet Davis Zheng and Donavan Cheah at DefCamp 2026
Want to see how a fake satellite system lures real attackers? Catch False Signals: Emulating Space Systems for Threat Intelligence, the talk Davis Zheng presents with Donavan Cheah at DefCamp 2026.
You can learn from new research, meet attendees from more than 50 countries, and compare notes with the specialists who track attackers every day.
Get your DefCamp 2026 ticket and join us at the Palace of the Parliament in Bucharest on November 19 and 20.
Nadine Tudor is a marketing and communications trainee at Bit Sentinel, where she especially enjoys creating social media content and visual assets. New to cybersecurity, she’s eager to keep learning and to help make complex security topics easier for everyone to understand.
