Stalked in Orbit: Russia’s Grey-Zone War on Commercial Satellites

Part IWhat happened, stated precisely

In late May 2026, four Russian military satellites — launched approximately one month earlier — performed maneuvers that matched the orbital plane of ICEYE-X36, a commercial synthetic-aperture radar (SAR) reconnaissance satellite operated by Finnish company ICEYE. Plane-matching is not incidental; it is the orbital-mechanics signature of a deliberate rendezvous and proximity operation. The event was reported by Resilience Media on 10 July, with analysis from Juliana Suess, space security researcher at Stiftung Wissenschaft und Politik (SWP) in Berlin, and Dr John Sheldon, founding partner at AstroAnalytica.

The target matters as much as the tactic. ICEYE-X36 is Ukraine’s “People’s Satellite” — its service capacity was crowdfunded by the Ukrainian population through the Prytula Foundation, and its radar imagery feeds directly into the intelligence picture of Ukraine’s armed forces. SAR sees through clouds and darkness; it is among the most operationally consequential commercial capabilities in the war. Suess assesses the likely Russian intent as non-kinetic: “trying to jam the satellite, trying to prevent communications from reaching back down, potentially intercepting data... the data that ICEYE 36 is collecting could also be useful to Russia, because it’s positioned to catch imagery over Ukraine.”

Set the incident in its documented pattern and it stops looking like an anomaly. The Secure World Foundation’s counterspace assessments identify sixteen known or suspected threatening RPO incidents by Russian military and intelligence satellites between 2014 and 2025. Russia’s Luch/Olymp signals-intelligence satellites have spent a decade drifting through the geostationary belt, parking near commercial communications satellites — behavior widely assessed as signal-interception missions. Germany has publicly reported jamming of its assets; the United Kingdom says jamming attempts against its systems occur weekly. Every incident in the pattern shares one property: all non-kinetic, all deniable, all below the threshold that would trigger an armed response. That is the definition of grey-zone warfare, and orbit is now one of its principal theaters.

Part IIWhy deterrence fails: the dependency asymmetry

The instinctive strategic answer — hold Russian space assets at risk in return — runs into an asymmetry that has defined Russian doctrine for two decades. As Suess puts it: “Russia has always seen the US military reliance on space as a weakness and as a vulnerability to exploit.” Mutual deterrence requires mutual dependence, and the dependence is not mutual. The Western way of war — precision navigation, satellite communications, space-based ISR — is space-coupled at every layer. So is the Western economy: timing signals for financial markets, PNT for logistics, satellite broadband for critical infrastructure. Sheldon’s formulation is blunt: “The whole Western concept of war — along with the West’s economic and critical infrastructure — is space-dependent. That is our soft underbelly.”

Russia’s side of the ledger is thinner by design and thinner still by decay. Its Earth-observation constellation is outdated; Suess notes Russia has been attempting to purchase commercial satellite imagery since April 2022, and that early in the full-scale invasion Russian forces “couldn’t get satellite imagery to confirm the hits that they thought they’d achieved” — falling back on overflights and intercepted Ukrainian communications for battle-damage assessment. A power with little in orbit worth holding hostage, facing an adversary whose entire operating model lives there, has every incentive to keep probing. The strategic question, both experts converge on, is therefore not deterrence but resilience: not “how do we threaten theirs” but “how do we keep ours running when the probing starts.”

Part IIIThe resilience stack: satellite, constellation, ground

The article’s expert sourcing sketches what OED would formalize as a three-layer resilience stack, and each layer maps to a distinct vendor economy.

Layer one: the spacecraft. Frequency hopping defeats fixed-band jammers by forcing the attacker to chase the signal. Software-defined payloads — the approach Suess notes is gaining momentum — allow capabilities to be re-weaponized post-launch against threats that did not exist at design time: “features are built into a satellite not knowing how or if they will be of any use in the future, but with the software tools to make use of or adapt certain capabilities.” The binding constraint is economic, not technical. Sheldon: “The commercial satellite companies can do just about anything that is technically possible to protect their satellites... The problem is it almost eradicates the possibility you’re going to make a profit.” Hardening is a margin decision, and unsubsidized commercial operators will systematically under-harden.

Layer two: the constellation. Mass and orbital diversity are resilience. Large constellations require proportionally more effort to degrade kinetically and dilute the effect of laser dazzling against EO sensors; multi-orbit architectures hedge against any single regime becoming contested or debris-fouled. This is the architecture argument Starlink settled empirically in Ukraine — and it is worth noting that the proliferated-constellation thesis is a core plank of the SPCX public story since the June 12 Nasdaq debut. But proliferation is a partial shield: as Suess notes, it “doesn’t help against signal jamming, for example, because for the most part signal jamming is directed at the receiver on the ground.”

Layer three: the ground. The most under-priced layer. Sheldon: “You can affect... the benefits you get from a space system by exploiting any part of that system on the ground: the up-down links and the user segment. You’re denying your adversary its access to space, and you can do that for the foreseeable future without even touching the satellite in orbit.” Ground stations, cloud backhaul, undersea and overland fiber, user terminals — the whole terrestrial nervous system of a space service is attack surface. Suess adds the corollary: for navigation and communication in particular, “we do need to have a terrestrial backup option.” OED scores Ground Segment at 68/100 — above SSA and National Security Space — precisely because demand for hardened, distributed, allied-territory ground infrastructure is structural and growing regardless of which orbital architecture wins.

Part IVThe insurance wedge: the regulator nobody elected

The most consequential paragraph in the source reporting is the one easiest to skim past. Sheldon: “Commercial satellites now being part and parcel of military command, ISR and other structures, they’re legitimate targets, whether we like it or not... Insurers, if they’re going to provide coverage, will want to see measures put in place that will at least try and protect those satellites as best as possible.” Read against OED’s Launch Insurance Premium Index (LIPI), this is not a throwaway line — it is a market-structure prediction.

The 2026 LIPI print shows launch premium rates at 7.6% (down from the 8.4% 2024–25 peak but nearly double the 2021 soft-market floor), roughly 17 active underwriters after the 2023–24 carrier exits, and — the number that matters here — an in-orbit insurance gap of approximately 96%: on the order of 8,900 operational satellites carry no in-orbit coverage at all. Grey-zone targeting attacks exactly this gap. If deliberate, deniable, non-kinetic interference becomes a routine loss driver, underwriters face a peril that is neither accident nor formally war — and war-risk exclusions in space policies remain largely untested against a jamming loss or an interference-induced anomaly. The rational underwriter response is the one Sheldon predicts: condition coverage on demonstrable resilience — frequency-hopping comms, encrypted TT&C, maneuver reserves, conjunction-response procedures. Insurance requirements become the de facto resilience regulation for the commercial fleet, arriving years before any government mandate. OED scores Space Insurance & Risk at 55/100 with a +5 delta — one of the strongest positive deltas on the board — on precisely this thesis: the sector is transitioning from passive risk-transfer to active standards-setting.

Part VThe iceberg, again: the targets are private and the sensors are private

Here is the structural observation a defense-desk summary will miss. Nearly every named actor on the friendly side of this story is a private company. ICEYE — the operator of the stalked satellite, the world’s largest SAR constellation operator, reportedly past $500M in cumulative contracted revenue — is private (Helsinki). The commercial SSA networks that detect and characterize stalking behavior — LeoLabs, ExoAnalytic (acquired by Anduril, March 2026), Slingshot Aerospace — are private. The proliferated-constellation resilience proof point, Starlink, only became publicly investable on June 12. Of the entire capability chain in this story — the target, the sensor layer that watches the stalkers, and most of the hardened-comms suppliers — the majority sits below the public-market waterline, funded by venture capital, sovereign defense budgets, and, in ICEYE-X36’s case, literal crowdfunding.

This is the OED iceberg thesis in its purest form. When European governments now debate — in Sheldon’s words, a debate “Europe is only now starting to have” — what the state owes commercial operators whose satellites have become military infrastructure, they are debating the governance of an asset class that public investors largely cannot see and cannot price. The repricing will happen anyway: through insurance requirements, through defense procurement premiums for resilient design, through the valuation of the next ICEYE or LeoLabs round. Charting that repricing before it surfaces in a ticker is the job.

Part VIOED assessment and market frame

Lead with the counter-thesis, as discipline requires. The skeptical case: grey-zone incidents in orbit have been accumulating since 2014 without producing a confirmed kinetic loss or a paid insurance claim attributable to hostile interference; the ICEYE-X36 event may resolve as surveillance rather than attack; and “resilience” spending is notoriously hard to isolate as an investable line item — it dissolves into general defense-space budgets. The rebuttal is the trend’s shape, not any single event: sixteen cataloged incidents, weekly jamming against a NATO state, a decade of Luch/Olymp loitering, and now a four-on-one plane-match against a commercial satellite whose military function is public knowledge. The direction is monotonic. Commercial spacecraft are converging on combatant status, and every serious actor in the chain — operators, underwriters, defense ministries — is beginning to behave accordingly. We hold National Security Space at 56 (procurement-gated, hence flat), but the event flow supports the positive deltas on the adjacent sectors where the repricing actually lands: EO, SSA, and above all Insurance & Risk. You are not underwriting a war in space. You are underwriting the compliance, sensing, and hardening economy that a permanent grey zone requires — and that economy is being built now, mostly in private.

Public-market exposure cards

Eight listed names with direct-to-indirect exposure to the grey-zone resilience thesis. The exposure-confidence tag reflects how load-bearing the read-through is, not a price view. The defining feature of this event repeats the sector’s pattern: the targeted operator, the detection layer, and the response-spacecraft builders are all private. Public exposure is to the surrounding hardening economy, not the front line.

Card footnotes: ¹ SPCX exposure is to the constellation-resilience architecture argument and DoD Starshield revenue, not to the ICEYE incident itself. Cards are exposure maps, not recommendations. The most directly relevant capabilities in this event — commercial SAR under fire (ICEYE), stalker detection (LeoLabs, ExoAnalytic/Anduril, Slingshot), and RPO response (True Anomaly, Scout Space) — are private and unlisted.

Watch list

• ICEYE-X36 STATUS. Any ICEYE or Prytula Foundation disclosure of service degradation, anomalous telemetry, or defensive maneuvering — the difference between surveillance and attack.
• THE FOUR STALKERS. Independent commercial SSA characterization (LeoLabs, Slingshot, COMSPOC) of the Russian quartet’s subsequent maneuvers; sustained station-keeping near X36 would escalate the assessment.
• INSURANCE WORDING. First evidence of underwriters adding grey-zone interference exclusions, resilience warranties, or premium credits for frequency-hopping / encrypted TT&C — the Sheldon prediction becoming policy language. LIPI will track.
• EUROPEAN FRAMEWORK. Whether the EU Space Act draft or national legislation (Germany, UK weekly-jamming disclosures) formalizes state obligations to commercial operators whose assets serve military users — the debate “Europe is only now starting to have.”
• ICEYE FINANCING. Any ICEYE raise, strategic round, or listing signal; a defense-repriced SAR leader coming to public markets would close the sector’s largest visibility gap.
• PRECEDENT EVENTS. Recurrence against other commercial operators (Planet, BlackSky, Capella, Umbra tasked over Ukraine); a second plane-matching incident converts pattern to doctrine.