By: Dawn Zoldi
As Tehran continues to wage an active electronic warfare (EW) campaign against U.S. and Israeli drone and missile operations, Kratos Defense is tracking it every step of the way. At the 2026 Space Symposium, Harris Mohamad, one of the company’s AI engineers, walked attendees through a demo of the company’s KnownSpace Global Sensor Network, a commercially operated, globally distributed RF monitoring architecture that the company says gives it persistent space domain awareness across the full geostationary belt. He shared live data (think: spectral graphs, geolocation plots and satellite waterfall charts) that showed the current interference signatures, the geolocations and the compromised transponders.
Inside the KnownSpace Global Sensor Network
Anchored out of Colorado Springs, Colorado, the KnownSpace network spans more than 190 radio frequency (RF) sensors deployed across over 19 sites worldwide, which provide 24/7 geo-belt coverage. A network operations center (NOC) tasks those sensors continuously, looking at whatever satellites operators choose to monitor.
The network delivers four core capabilities: interference monitoring to detect and flag RF jamming on communications satellites; signal geolocation to pinpoint where jamming originates; signal survey and analysis to characterize the pattern-of-life behavior on satellites; and satellite tracking using difference-of-arrival techniques to detect orbital maneuvers.
None of those sites sit inside Iran. But they don’t need to. “RF is not a laser pointer,” Mohamad explained. “It’s a floodlight. As long as you’re in the same beam footprint as the satellite, you can collect on it.” The KnownSpace network captures uplink and downlink activity occurring within Iran’s borders without needing physical presence there precisely because those satellite beam footprints that cover the Middle East also encompass Kratos’ sensor locations elsewhere in the region.
Why Iran Targets SATCOM Links
To understand the implications of what Kratos collects, Mohamad laid out the operational stakes. U.S. and Israeli forces depend heavily on satellite communications to execute operations with drones and missiles. Those platforms that don’t require a human controller within visual range because satellite relay fills the gap. That architecture weaves together military satellites, commercial satellite capacity, low earth orbit (LEO) constellations and geostationary birds into a complex, but essential, communications web.
For Iran, disrupting that web has become a wartime priority. Jammers can attack SATCOM links by transmitting energy into the same uplink frequency slot that a legitimate user occupies. In the frequency domain, those signals combine and degrade, or outright block, the receive signal on the other end. The technique is straightforward, but Kratos’ data showed just how precisely and aggressively Iran executes it.
Comb Jamming: Efficient, Broadband and Hard to Pin Down
Among the types of jamming Kratos documented, Mohamad’s team observed a technique called continuous waveform comb jamming. This method takes un-modulated tones and repeats them across an entire frequency space in rapid bursts. The approach hits a broad swath of frequencies simultaneously. It uses significantly less energy than standard modulated jamming techniques. This makes geolocation harder because the timing signatures that geolocation depends on become difficult to resolve when signals are packed so tightly together. “This is a very effective method of interference,” Mohamad noted. “They’re impacting a really broad range of frequencies, and they’re bursting the signal, which uses far less energy than a general noise attack.”
A Month-Long Pattern of Escalating Disruption
The pattern-of-life data Kratos collected told a clear escalation story. On March 5th, the satellite payload in question was operating normally. Signals were active across a full 24-hour cycle, clearly visible in both the power spectral density plot and the waterfall display that maps signal activity over time. By March 16th, the picture had deteriorated sharply. Spectrum noise had spiked, and legitimate signal uptime had dropped from around 24 hours down to roughly five.
By the time of the Space Symposium presentation, the situation had worsened further. Signals that had been active around the clock were now mostly offline. When users attempted to transmit, Iranian jammers came back online almost immediately to suppress them. Mohamad described this reactive, near-real-time suppression capability as noteworthy in its speed and precision.
He was careful to clarify what that means operationally. Users aren’t necessarily cut off entirely, but they’re forced off that particular transponder and frequency payload. The war for spectrum access is continuous, and the adversary seems to be adapting.
Geolocation Zeroes In on Tehran
To confirm Iran as the source of the jamming, rather than merely suspect it, Kratos relies on the physics of signal spillover. When a jammer transmits energy into a satellite’s uplink frequency, some of that energy spills onto adjacent satellites. By observing both the target satellite and the adjacent one simultaneously and then measuring the differences in signal arrival time and frequency, Kratos’ analysts can calculate where the jamming signal had to originate.
When Mohamad’s team ran that analysis across the interference events they had documented, the geolocations clustered in one place: Tehran. Cross-referencing open-source overhead imagery confirmed the picture. Antenna yards were consistent with the infrastructure needed to mount a sustained satellite jamming campaign.
Kratos didn’t stop at geolocation. The team also applied signal processing algorithms to the collected data to reconstruct details about Iranian communication networks on other satellites,, including the protocols in use, active user terminals and hub locations. In one example Mohamad highlighted, analysts identified what appeared to be an iDirect Evolution hub transmitting out of Tehran, with four user terminals visible in the spectral data. Many of those terminals self-report their own geolocations to the hub, a feature designed for mobile users who need to tell the network where they are for best signal quality. It’s also one that hands Kratos an unambiguous position fix without additional analysis.
The Maritime Thread: China, Iran and Dark Vessel Transfers
The intelligence picture extended well beyond jamming, however. Using the same KnownSpace infrastructure, Kratos tracked a maritime satellite network operating on a commercial satellite designated Chinasat 11. What the data revealed was a sprawling shipping network connecting Chinese vessels to Iran and Iraq.
The hub controlling that network sits at Chabahar Port in Iran, identified on commercial mapping services as the Chabahar Port Amplification Station. Open-source imagery shows a fenced antenna yard at the facility, the node that manages satellite connectivity for the entire maritime network.
More telling than where the ships were going was where four of them were not going. During the collection period, four vessels in the network remained stationary off the coast of Malaysia for the entire duration of Kratos’ observations. That location, Mohamad noted, matches a region that Bloomberg News had previously reported as a known dark vessel transfer zone, an area where ships rendezvous in open water to exchange cargo outside the visibility of government monitoring. Given that Iranian crude oil faces heavy US sanctions, the implication was that these vessels were likely conducting illicit oil transfers designed to move sanctioned Iranian oil without triggering financial penalties.
Space Domain Awareness as an Intelligence Discipline
Kratos’ demonstration at the 2026 Space Symposium provided a window into how commercially operated, not-classified space domain awareness (SDA) infrastructure has matured into a genuine intelligence discipline. The passive collection of RF signals that are already flooding the electromagnetic spectrum enables the company to track EW campaigns, map adversary communications networks and expose illicit maritime activity.
Kratos’ value proposition rests on scale and persistence. With more than 190 sensors operating around the clock across 19 sites, Kratos can build pattern-of-life data that makes anomalies legible. It showed much more than simply the spike of a single jamming event. Its data revealed the slow escalation of a coordinated suppression campaign unfolding over weeks. That kind of longitudinal visibility separates isolated situational awareness to true domain awareness.
For U.S. and allied forces relying on satellite links to keep drones and missiles connected across distances in the Middle East, the threat Mohamad described remains active and ongoing. The spectrum is contested. And Kratos, from its perch in Colorado Springs, is watching.