Threat actors may modify the internal authentication process of the victim ground station to facilitate initial access, recurring execution, or prevent authorized entities from accessing the ground station. This can be done through the modification of the software binaries or memory manipulation techniques.
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.