Lithuania's government says a Molotov cocktail attack on Starlink equipment serving Ukraine near Vilnius on 18 October was Russia-linked sabotage. Poland has charged two Turkish men it says acted for a foreign intelligence service, and a Sofia court has issued warrants for two German nationals who crossed into Bulgaria, burned antennas and left the same evening.
Lithuania's government has concluded that an attempt to burn Starlink satellite equipment serving Ukraine at Aukštieji Paneriai on the edge of Vilnius at about 2am on Sunday 18 October 2026 was Russia-linked sabotage, the third attack on the network's ground infrastructure in Europe in less than four weeks. Vilmantas Vitkauskas, head of the National Crisis Management Centre, told reporters the attack formed part of Russian efforts to disrupt Starlink and undermine Ukrainian military operations. "Ukraine is the target," he said.
Prime Minister Mindaugas Sinkevičius told LRT radio on 18 October that the attack was "part of Russia's hybrid war, involving acts of sabotage" and that the instigator had probably already been identified as the Russian side. After the National Security Commission met on 19 October, he told reporters the attackers had used Molotov cocktails and that suspects were being actively sought. Polish ministers have named Russian intelligence as the organiser of a fire at a Starlink station at Wola Krobowska on 23 September, and Bulgarian prosecutors have charged two German nationals in absentia over the burning of antennas near Sofia on 9 October.
Interior Minister Martynas Katelynas gave a more cautious account on 19 October. "It is really not clear exactly who did this," he told reporters, adding that investigators had yet to link the attack to any country and that surveillance cameras had captured the suspects.
Vilnius
The equipment stands on premises of Delska Lithuania, a data centre company that leases space to SpaceX, Vitkauskas said. The company provides connectivity through nine Starlink antennas used by Ukraine, according to Sinkevičius, who said the intruders tried to burn the antennas and a control unit and left incendiary liquid in containers holding between three and 10 litres. A security guard spotted the flames and put them out before firefighters arrived, and on 19 October Sinkevičius said "the antennas did not catch fire; the control unit was slightly scorched," ELTA reported. Vitkauskas said a successful attack would probably have caused some disruption to connectivity, but that other such stations exist.
Sinkevičius wrote on Facebook on 18 October that Lithuanian security services had warned the company of possible attacks and that security had been stepped up. Vitkauskas said the warning reached the company a day or two before the attempt, while Katelynas said on 19 October that the company had been warned several months earlier about various threats, as part of general advice to firms supporting Ukraine or producing dual-use goods.
The Lithuanian Criminal Police Bureau is leading a pre-trial investigation into destroying or damaging property in a generally dangerous manner, an offence that carries up to five years in prison where the property belongs to a strategic or nationally important company. Asked on 19 October whether anyone had been detained, Police Commissioner General Arūnas Paulauskas said: "Not yet." From 19 October the government raised the alert level at more than 15 sites of state-critical infrastructure.
Poland
Two masked people climbed the fence at Wola Krobowska, about 40 kilometres south of Warsaw, on the evening of 23 September, poured flammable liquid on the control equipment, set it alight and left about three minutes later, according to Poland's Internal Security Agency (ABW). Firefighters worked for more than six hours, and the blaze destroyed the station's power supply and backup generator. Exatel, the state-owned telecommunications company, operates the station, which carries Starlink traffic through Poland to Ukraine. The station lost its internet connection and several organisations including the Ukrainian military lost access, the Kyiv Post reported.
Poland's National Prosecutor's Office opened an investigation on 25 September into sabotage and a terrorist offence committed on behalf of a foreign intelligence service, citing reasonable grounds to suspect the perpetrators acted on orders from Russian intelligence. Spokesperson Przemysław Nowak said the aim was to disrupt Starlink traffic in Poland and other countries of Central and Eastern Europe.
A third suspect, a Ukrainian citizen according to RMF24, was remanded in custody for three months on 30 September. The ABW said this person had been vetted by the client who commissioned the attack, photographed and filmed the station, sent the material through Telegram and was then ordered to survey the site's security, working separately from the two men who set the fire.
Prosecutors charged Ümit E. and Müslüm T., two Turkish citizens living in Germany, on 7 October with acting for a foreign intelligence service and committing sabotage, the ABW said. The Warsaw District Court issued European arrest warrants on 10 October. German federal and Baden-Württemberg police, working with Germany's domestic intelligence service, arrested both men in Nürtingen on 12 October, and a German court ordered them held on 13 October. Searches turned up electronic devices, weapons and ammunition. The ABW said the men had entered Poland at Świecko, stopped in Łódź, driven to Wola Krobowska and returned to Germany after the fire, and that their transfer to Poland is under way.
RMF FM reported on 13 October that German authorities also hold a woman detained in Berlin whom investigators suspect of driving the two men. She was arrested during a separate counterterrorism operation, and German authorities also hold a man whose role has been withheld, UNITED24 reported. Polish prosecutors are deciding whether to seek the transfer of both.
Tomasz Siemoniak, the minister coordinating Poland's special services, said: "We have no doubt that Russian intelligence services are behind this act of sabotage." He said Russian services increasingly recruit people with ties to the criminal underworld. Prime Minister Donald Tusk called the fire another act of hybrid warfare.
Der Spiegel reported on 16 October, citing sources in several countries, that the Turkish suspects may belong to or have acted for the Daltons, a Turkish organised crime group whose alleged leader, Beratcan Gökdemir, was arrested in Russia in 2024 and has been held there despite Turkish extradition requests. Spiegel reported that Russian services may have commissioned the gang, a link Polish officials had not confirmed by 19 October.
Bulgaria
Two men entered Bulgaria from Serbia at the Kalotina border crossing at 5:37pm on 9 October, telling border officers they were tourists, according to the Sofia City Prosecutor's Office. At about 10:25pm they set fire to antennas at the Plana teleport south of Sofia, wearing masks and gloves, and at 11:55pm they drove back into Serbia through Kalotina in a German-registered car. The indictment lists three antennas destroyed, two partly damaged and three otherwise affected. Ivaylo Mirchev, co-leader of the opposition party Yes, Bulgaria!, had first disclosed the attack on Facebook on 12 October, writing that 11 of the site's 17 antennas had burned and that the Interior Ministry had kept the attack quiet for three days.
Prosecutors charged the two men in absentia on 14 October with arson carrying three to 12 years in prison. BTA, the Bulgarian state news agency, named them as Zeka Islam and Tirpan Beytullah, German nationals born in 2007, noting that the spellings may be inexact. On 19 October Sofia City Court authorised European arrest warrants for both, finding reasonable grounds to suspect them, and German authorities say their whereabouts are unknown. Court-appointed defence lawyer Zhanet Manasieva said: "It may ultimately turn out that these are not the people who committed the criminal act." The defence said it would appeal within the three days allowed.
Prime Minister Rumen Radev told a parliamentary hearing on 14 October that the investigation was close to conclusion and was being run with partner services, and asked the head of the State Agency for National Security not to disclose details. "A little more patience, you will have a result," he said. Interior Ministry Secretary General Lyubomir Nikolov said on 15 October that suspects had been identified. After prosecutors sought the warrants on 19 October, Mirchev asked when the two men had left Bulgaria and when the security services learned of it, and wrote that Radev "personally owes the public an explanation."
Interior Minister Ivan Demerdzhiev told parliament that additional security had been placed at similar facilities but that owners were responsible for protecting them. Neterra, Starlink's official distributor in Bulgaria, said the equipment belonged to another party and its own network was unaffected.
Shared methods
Attackers in all three countries struck at night and used flammable liquid against antennas or the equipment that powers and controls them, and cameras in Poland and Bulgaria recorded two masked people each time, according to the ABW and Bulgarian prosecutors. The Polish and Bulgarian suspects travelled from outside the country, spent hours rather than days on the ground and drove out again: the Turkish suspects returned to Germany after the Polish fire, and the Bulgarian suspects were back in Serbia about 90 minutes after the antennas burned. The four men accused of setting the Polish and Bulgarian fires are German nationals or live in Germany. In Poland, a separate scout working for the same client reconnoitred the target in advance.
Earlier cases and their evidence
Lithuanian prosecutors alleged in March 2025 that Russia's military intelligence agency, the GRU, set up a group to carry out arson attacks in Lithuania, Poland and Latvia, including the 9 May 2024 fire at an IKEA store in Vilnius that caused about 500,000 euros in damage. Two Ukrainian citizens, one of them a minor, were accused of setting it. A Lithuanian court convicted a teenager over the IKEA fire in October 2025 after he pleaded guilty, Euronews reported.
Dylan Earl pleaded guilty to aggravated arson and to offences under the UK National Security Act 2023 over a 20 March 2024 fire at an industrial unit in Leyton, east London, that stored generators and Starlink equipment bound for Ukraine. Prosecutors said Wagner Group agents acting for Russian military intelligence planned the attack, recruited through British intermediaries and dealt with Earl through a Russian recruiter. Jake Reeves also pleaded guilty, and an Old Bailey jury convicted Jakeem Rose, Ugnius Asmena and Nii Mensah of aggravated arson in July 2025. Earl was sentenced to 23 years in October 2025 over a fire that caused about £1 million in damage.
Associated Press reporting counts the Polish fire among more than 210 incidents across Europe since February 2022 that Western officials consider sabotage or malign activity linked to Russia. Russian officials reject such accusations as baseless and the product of anti-Russian hysteria, according to Reuters.
What the network carries for Ukraine
Ukrainian forces use Starlink terminals for battlefield communications and fit receivers in many drones as part of their guidance systems, Reuters reported. Satellite traffic reaches terrestrial networks through ground stations such as those at Wola Krobowska and Plana. Poland has spent more than 480 million złoty on Starlink terminals and subscriptions for Ukraine's armed forces since 2022, according to the Polish newspaper Rzeczpospolita.
Ukrainian officials said on 13 and 14 October that restrictions on Starshield, SpaceX's separate military service, had cut connections to drones in flight, a dispute between Ukrainian officials, SpaceX and the US government that predates the Vilnius attempt. Elon Musk said the US government sets Starshield's limits, while White House officials and Secretary of State Marco Rubio denied that the disruption was deliberate.
Drone over northern Lithuania
Lithuania's National Security Commission also reviewed an unidentified object, believed to be a drone, that exploded over northern Lithuania on the morning of 18 October, scattering debris in the village of Juodžionys in Pasvalys district. NATO fighters scrambled from Šiauliai and a red air threat alert covered Panevėžys and Šiauliai counties. Preliminary military information suggests the object may have entered from Poland. President Gitanas Nausėda wrote on X that "Russia's war of aggression against Ukraine is spilling over onto the Eastern flank of NATO and EU." Sinkevičius said before the meeting that the government would consider giving the security services additional legal powers to neutralise drones.
