Threat reportThreat IntelligenceTL-2026-4195
Russian Hybrid Campaign Shifts Towards Ukraine's Military Enablers (Starlink Ground Station Sabotage in Poland, Bulgaria and Lithuania)
Russian Hybrid Campaign Shifts Towards Ukraine's Military (TL-2026-4195), also tracked as Starlink ground station sabotage, is a high-severity tracked intrusion set, first published 2026-10-22. It is attributed to Russian state intelligence services (Russia) with medium confidence, affects SpaceX Starlink / Starshield ground station and antenna infrastructure, maps to 3 MITRE ATT&CK techniques (T1585, T1591, T1593), and is covered by 9 detection rules and 9 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 3MITRE ATT&CK
- Actors
- 1Russian state intelligence services
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-4195
- Threat ID
- TL-2026-4195
- Also known as
- Starlink ground station sabotage, Russian hybrid warfare against Ukraine's military enablers
- Severity
- HIGH
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution
- Russian state intelligence services
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- DESTRUCTION
- Target sectors
- telecoms, satellite-communications, defense, military, transport, logistics
- Target regions
- poland, bulgaria, lithuania, Europe, ukraine
- Detection rules
- 9
- Indicators of compromise
- 9
How Russian Hybrid Campaign Shifts Towards Ukraine's Military works
A Russian hybrid campaign has shifted from creating fear and weakening public support for Ukraine toward directly obstructing Western military assistance. Between 23 Sep and 18 Oct 2026, arson and sabotage hit Starlink ground infrastructure in Poland, Bulgaria and Lithuania, using 'disposable agents' recruited online.
Truesec reports (22 Oct 2026) that Russian hybrid activity, which combines physical sabotage, destructive cyber activity and influence operations, is now aimed at the enablers of Ukraine's military capability rather than at public opinion. The Danish Defence Intelligence Service assessed on 24 Sep 2026 that Russian activities have shifted 'from primarily creating fear and weakening public support for Ukraine towards directly obstructing Western military assistance'. Named target categories are Starlink/Starshield communications infrastructure, Ukrainian battlefield communications and drone operations, European defence companies, and transport routes carrying military equipment.
Three incidents are documented. On 23 Sep 2026 a fire destroyed power equipment at a Starlink ground station at Wola Krobowska, about 40 km south of Warsaw. Polish authorities called it sabotage and said they have no doubt Russian intelligence services are behind it, and Prime Minister Tusk called it 'another act of hybrid warfare'. German authorities detained two Turkish nationals on 12 Oct in connection with the attack. On 9 Oct 2026 eight Starlink antennas were set alight at the Plana Teleport site, 30-40 km south-east of Sofia, Bulgaria. Three were destroyed, two partly damaged and three otherwise affected. Two 19-year-old German nationals entered via the Kalotina checkpoint at 17:37, set the fire around 22:25 wearing gloves and masks, and left toward Serbia at 23:55 in a German-registered car. They were charged in absentia on 14 Oct, and Bulgaria issued European arrest warrants. On 17-18 Oct 2026 an attempted arson targeted a Vilnius company storing Starlink equipment, reported as a data center with nine satellite antennas. Enhanced security stopped the fire, with minor damage and no disruption. Lithuania linked it to the Polish and Bulgarian incidents and to Russia, and said Ukraine is the target.
The operational model is 'disposable agents': local criminals or low-level individuals recruited online who give the state sponsor deniability, and who in some cases may not know the sponsor. Poland's reporting places the Warsaw incident among more than 210 documented sabotage cases in Europe since 2022. Moscow denies the accusations. Attribution to Russian state services rests on statements by Polish, Lithuanian and Danish authorities and has not been independently corroborated; the sources contain no malware, CVEs or network IOCs. MITRE mappings are approximate because ATT&CK covers physical sabotage poorly.
MITRE ATT&CK techniques used in TL-2026-4195
Resource Development
Reconnaissance
T1591 Gather Victim Org Information; T1593 Search Open Websites/Domains
Affected products and versions in Russian Hybrid Campaign Shifts Towards Ukraine's Military
- SpaceX — Starlink / Starshield ground station and antenna infrastructure
Vulnerable versions: Physical sites in Poland (Wola Krobowska), Bulgaria (Plana, near Sofia), Lithuania (Vilnius)
Remediation for Russian Hybrid Campaign Shifts Towards Ukraine's Military
Immediate actions
- Raise physical security (CCTV, perimeter alarms, fire detection and suppression, guarding) at Starlink/Starshield ground stations, teleports and data centers hosting satellite antennas
- Act on warnings from national security services; Lithuanian authorities had warned the targeted company beforehand and its enhanced security stopped the fire
- Review access logs and CCTV at sites for reconnaissance or after-hours visits, including foreign-registered vehicles and short-stay border crossers
Workarounds
- Distribute critical antenna and power equipment across sites
- Increase patrol frequency and fire-resilient power-equipment housing at remote sites
Longer-term hardening
- Build redundancy and failover for satellite and military-enabling communications so a single site loss does not cause an outage
- Add sabotage and 'disposable agent' scenarios to insider-risk and physical threat models for defence suppliers, logistics and telecom operators
- Coordinate with national CERTs, police and intelligence services for hybrid-threat information sharing
Timeline of Russian Hybrid Campaign Shifts Towards Ukraine's Military
- Fire destroys power equipment at a Starlink ground station at Wola Krobowska, about 40 km south of Warsaw; Poland treats it as Russian-linked sabotage.
- Danish Defence Intelligence Service assesses that Russian activity has shifted toward directly obstructing Western military assistance to Ukraine.
- Eight Starlink antennas are set on fire at the Plana Teleport site near Sofia; two German nationals cross at Kalotina at 17:37, set the fire around 22:25 and leave toward Serbia at 23:55.
- German authorities detain two Turkish nationals in connection with the Polish Starlink station fire.
- Bulgaria charges the two German suspects in absentia and obtains European arrest warrants; reports emerge that 11 of 17 Starlink antennas in the Sofia area were burned.
- Attempted arson at a Vilnius company storing Starlink equipment is thwarted by enhanced security; Lithuania links it to Russia and to the Polish and Bulgarian incidents.
- Truesec publishes its analysis of the shift in Russian hybrid campaigns toward Ukraine's military enablers.
Sources cited for Russian Hybrid Campaign Shifts Towards Ukraine's Military
- Truesec: Russian Hybrid Campaign Shifts Towards Ukraine's Military Enablers
- Poland Blames Starlink Sabotage on Russia (Broadband Breakfast)
- Lithuania thwarts attack on Starlink facility as sabotage attempts spread across Europe (United24)
- Lithuania says attempted arson of Starlink station sabotage is aimed at influencing Ukraine (Ukrainska Pravda)
- Lithuania says attempted Starlink arson was Russia-linked sabotage (The Star)
- Bulgarian authorities seek arrests of Germans in arson of Starlink antennas (ABC News / AP)
- Bulgaria Issues European Arrest Warrants in Starlink Antenna Fire
Detection coverage for TL-2026-4195
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4195 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.