They attacked the firmware of customer terminals on the ground via a management network, not the satellites themselves.

See, among others:

https://www.viasat.com/about/newsroom/blog/ka-sat-network-cy...

https://www.reversemode.com/2022/03/viasat-incident-from-spe...

The terminal firmware had a bunch of security vulnerabilities allowing injection of arbitrary executables and commands without adequate signature verification.

The attack bricked the terminals requiring a hardware swap to restore service.