Russian Hybrid Campaign Shifts Towards Ukraine’s Military Enablers

Recent incidents indicate that Russia is now targeting Starlink infrastructure in Eastern Europe. On 23 September, power equipment at a Starlink ground station near Warsaw was set on fire. Polish authorities suspect that the perpetrators acted on behalf of Russian intelligence. On 9 October, attackers damaged Starlink antennas at the Plana Teleport facility south of Sofia. A Bulgarian court has since approved European arrest warrants for two German suspects.[2][3]

During the night of 17–18 October, an attempted arson attack targeted Starlink equipment at a data center in Vilnius. The facility supports nine satellite antennas whose communications are used partly by Ukraine. Lithuanian authorities linked the incident to Russia. Increased security prevented significant damage or disruption.[2]

Starlink and its military counterpart, Starshield, support Ukrainian battlefield communications, reconnaissance and drone operations. Starlink and Starshield enable Ukrainian long-range drone operations by supporting command and control, near-real-time video transmission and the exchange of targeting and reconnaissance data. The strategic relevance of this capability was demonstrated during the Ukrainian attack against St Petersburg on the night of October 17-18 2026, [4][5][6]

Assessment

Russian efforts to disrupt Starlink infrastructure in Eastern Europe may aim to degrade the communications supporting Ukrainian drone operations and reduce Ukraine’s ability to conduct similar long-range strikes.

The targeting of Starlink also forms part of a broader pattern observed in 2026. As Truesec has previously reported, Russian sabotage is no longer limited to creating fear, uncertainty and political pressure but increasingly seeks to produce direct operational effects against Ukraine. This includes targeting defense companies, transport routes carrying military equipment and communications infrastructure supporting Ukrainian operations. [7][8]

Starlink-related facilities are attractive sabotage targets because relatively unsophisticated sabotage can impact them. Russia is often using so-called “disposable agents”, local criminals recruited online, to conduct these sabotage attacks, both to gain access to their targets and to create deniability. [9]

Russia will highly likely continue targeting European infrastructure directly connected to Ukrainian military support. Starlink ground infrastructure, defense companies, and logistics infrastructure are particularly exposed because disruption could affect support to Ukraine while simultaneously testing European protective measures and political resolve.

References

[1] Danish Defence Intelligence Service, Assessment of the Threat from Russia, 24 September 2026.
[2] The Insider, Lithuania reports attempted arson attack on Starlink equipment used to connect with Ukraine – the third incident in the EU this month, 19 October 2026.
[3] Reuters, Bulgarian court approves arrest warrant for two Germans over Starlink fire, 19 October 2026.
[4] Deutsche Welle, How much does Ukraine really need Starlink systems?, 18 October 2026.
[5] Reuters, Germany detains fourth person over Starlink fire in Poland, RMF FM reports, 13 October 2026.
[6] BBC News, Oil facilities hit in deadly overnight attack on St Petersburg, 18 October 2026.
[7] https://www.truesec.com/hub/blog/russia-targets-businesses-and-officials-behind-europes-ukraine-defence-supply-chain
[8] https://www.truesec.com/hub/blog/recent-increase-of-hybrid-attacks-against-defense-sector-in-europe
[9] https://www.truesec.com/hub/blog/russia-recruits-members-of-the-com-for-sabotage-operations