Spoofing would probably be possible, but would take a substantial amount of technical knowledge. The pings along show it's not a stationary terminal, unless someone has dismantled it and managed to adjust the synchronization internally to just the right level with millisecond accuracy, or has written some pretty complex software to emulate a terminal. They'd also need to know just when the real 777's SATCOM terminal went off so they could turn theirs on.
If it's not the real terminal, this would probably be the most sophisticated hijacking ever seen (which, admittedly, it may still turn out to be).
I have seen nothing about the pings that suggests motion. I think the accuracy suggested is wildly fanciful.
I wasn't suggesting spoofing. I'm suggesting screw-up. Administratively, one party in the chain has lost track of where this terminal/sim/identifier is.
Aircraft lost. Terminal not aboard 9M-MRO (terminal on the ground at KL) keeps transmitting. Someone comes in to work the next day at KL and turns it off. The signal was heard by the IOR bird but not the POR bird and this is being interpreted as "terminal not located near the equator"; I interpret the IOR but not POR as "there is a building/hanger on the eastern side of the terminal's location in KL."