# Russian Hybrid Campaign Shifts Towards Ukraine's Military Enablers (Starlink Ground Station Sabotage in Poland, Bulgaria and Lithuania)

> A Russian hybrid campaign has shifted from creating fear and weakening public support for Ukraine toward directly obstructing Western military assistance. Between 23 Sep and 18 Oct 2026, arson and sabotage hit Starlink ground infrastructure in Poland, Bulgaria and Lithuania, using 'disposable agents' recruited online.

- **Published:** 2026-10-22T22:55:22Z
- **Last reviewed:** 2026-10-22T22:55:22Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4195
- **ID:** TL-2026-4195
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** Russian state intelligence services (Russia)
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Truesec reports (22 Oct 2026) that Russian hybrid activity, which combines physical sabotage, destructive cyber activity and influence operations, is now aimed at the enablers of Ukraine's military capability rather than at public opinion. The Danish Defence Intelligence Service assessed on 24 Sep 2026 that Russian activities have shifted 'from primarily creating fear and weakening public support for Ukraine towards directly obstructing Western military assistance'. Named target categories are Starlink/Starshield communications infrastructure, Ukrainian battlefield communications and drone operations, European defence companies, and transport routes carrying military equipment.

Three incidents are documented. On 23 Sep 2026 a fire destroyed power equipment at a Starlink ground station at Wola Krobowska, about 40 km south of Warsaw. Polish authorities called it sabotage and said they have no doubt Russian intelligence services are behind it, and Prime Minister Tusk called it 'another act of hybrid warfare'. German authorities detained two Turkish nationals on 12 Oct in connection with the attack. On 9 Oct 2026 eight Starlink antennas were set alight at the Plana Teleport site, 30-40 km south-east of Sofia, Bulgaria. Three were destroyed, two partly damaged and three otherwise affected. Two 19-year-old German nationals entered via the Kalotina checkpoint at 17:37, set the fire around 22:25 wearing gloves and masks, and left toward Serbia at 23:55 in a German-registered car. They were charged in absentia on 14 Oct, and Bulgaria issued European arrest warrants. On 17-18 Oct 2026 an attempted arson targeted a Vilnius company storing Starlink equipment, reported as a data center with nine satellite antennas. Enhanced security stopped the fire, with minor damage and no disruption. Lithuania linked it to the Polish and Bulgarian incidents and to Russia, and said Ukraine is the target.

The operational model is 'disposable agents': local criminals or low-level individuals recruited online who give the state sponsor deniability, and who in some cases may not know the sponsor. Poland's reporting places the Warsaw incident among more than 210 documented sabotage cases in Europe since 2022. Moscow denies the accusations. Attribution to Russian state services rests on statements by Polish, Lithuanian and Danish authorities and has not been independently corroborated; the sources contain no malware, CVEs or network IOCs. MITRE mappings are approximate because ATT&CK covers physical sabotage poorly.

## MITRE ATT&CK

- T1591 Gather Victim Org Information
- T1593 Search Open Websites/Domains
- T1585 Establish Accounts

## Sources

- [Truesec: Russian Hybrid Campaign Shifts Towards Ukraine's Military Enablers](https://www.truesec.com/hub/blog/russian-hybrid-campaign-shifts-towards-ukraines-military-enablers)
- [Poland Blames Starlink Sabotage on Russia (Broadband Breakfast)](https://broadbandbreakfast.com/poland-blames-starlink-sabotage-on-russia/)
- [Lithuania thwarts attack on Starlink facility as sabotage attempts spread across Europe (United24)](https://united24media.com/war-in-ukraine/lithuania-thwarts-attack-on-starlink-facility-as-sabotage-attempts-spread-across-europe-23559)
- [Lithuania says attempted arson of Starlink station sabotage is aimed at influencing Ukraine (Ukrainska Pravda)](https://www.pravda.com.ua/eng/news/2026/10/18/8058641/)
- [Lithuania says attempted Starlink arson was Russia-linked sabotage (The Star)](https://www.thestar.com.my/news/world/2026/10/18/lithuania-says-attempted-starlink-arson-was-russia-linked-sabotage)
- [Bulgarian authorities seek arrests of Germans in arson of Starlink antennas (ABC News / AP)](https://abcnews.com/International/wireStory/bulgarian-authorities-seek-arrests-germans-arson-starlink-antennas-137391013)
- [Bulgaria Issues European Arrest Warrants in Starlink Antenna Fire](https://teslanorth.com/2026/10/19/bulgaria-starlink-european-arrest-warrants/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4195