TLP:CLEAR · Disclosure is not limited.

Europe Hybrid Threats: Starlink Sites Targeted, Attribution Unresolved

Time window: Last 1 day · Audience: General analyst · Type: Situation report · DTG: 2026-10-19 13:41Z · Overall confidence: HIGH

BLUF

An attempted arson at Starlink ground infrastructure near Vilnius on 18 October adds to reported attacks on sites in Poland and Bulgaria. A multi-country pattern is emerging, but the available reporting does not establish Russian direction or a common command structure; protect exposed infrastructure while keeping attribution provisional.

Executive summary

Lithuanian authorities suspect Russian sabotage in an attempted fire at a Delska data centre near Vilnius at about 02:00 local time on 18 October. Employees extinguished the fire before it disrupted Starlink service, and no suspects had been detained as of 19 October. The incident follows damage to a Starlink ground station at Wola Krobowska, Poland, on 23 September and to 11 of 17 antennas near Sofia, Bulgaria, likely on 12 October. Poland's Internal Security Agency reported that two Turkish nationals suspected in the Wola Krobowska attack had been detained in Germany; prosecutors suspect a foreign intelligence service but the reporting does not identify it. Separately, Romanian F-16s shot down two drones over Romanian territorial waters on 17 October, with the Romanian defence ministry not specifying their origin. Reports of Russian drones falling in Moldova give differing counts. At NATO's Hybrid Symposium in Bucharest on 15 and 16 October, participants discussed Russian hybrid activity and protection of critical infrastructure.

Change from previous assessment

Since the 18 October brief, this assessment adds the 18 October attempted arson at a Starlink site near Vilnius, including the absence of detainees as of 19 October, and reports of similar attacks near Sofia and at Wola Krobowska. It also adds the Polish agency's report that two Turkish nationals suspected in the Wola Krobowska case were detained in Germany, while the suspected foreign intelligence service remains unnamed. Confidence that several Starlink sites have been targeted has increased; confidence in Russian direction has not. The earlier reporting on the Polish railway investigation, Black Sea shipping and the satellite close approach is not reassessed because these claims are not updated in this reporting window.

Key judgments

1. It is likely that Starlink ground infrastructure in Lithuania, Poland and Bulgaria has been targeted in separate attacks since 23 September, but current reporting does not establish a single coordinated campaign. The reported incidents were an attempted fire at the Delska site in Aukštieji Paneriai, Vilnius, on 18 October; damage to electrical infrastructure at Wola Krobowska, Poland, on 23 September; and damage to 11 of 17 antennas near Sofia, likely on 12 October. The date of the Bulgarian incident remains unconfirmed. (Confidence: medium · ASSESSED)
   • I&W: A Lithuanian, Polish or Bulgarian investigation publicly reports shared forensic evidence, methods or communications linking two or more of the Starlink site attacks, which would support a coordinated-campaign assessment. (0-30 days)
   • I&W: Investigators publish findings that the sites were targeted by unrelated actors using distinct methods, which would weaken the coordinated-campaign assessment. (1-3 months)
2. It is unlikely that public reporting currently establishes Russian direction of the Vilnius or Wola Krobowska attacks. Lithuanian authorities suspect Russian sabotage at Vilnius, but no suspects had been detained by 19 October. In the Polish case, two Turkish nationals were detained in Germany and prosecutors suspect a foreign intelligence service; the reporting does not name that service or a Russian handler. These are limits in the available reporting, not evidence that Russian involvement is excluded. (Confidence: low · ASSESSED)
   • I&W: Investigators or prosecutors publicly identify Russian tasking, financing or handlers in either case, which would support Russian direction. (0-3 months)
   • I&W: Authorities publicly attribute the attacks to unrelated non-Russian actors and report no foreign-service direction, which would further weaken the Russian attribution. (1-3 months)
3. Russia very likely continues hybrid activity against NATO Allies, including sabotage, drone incidents and cyber attacks, as NATO states; think-tank reporting also describes a longer-running pattern that includes disinformation and election interference. This broad reporting does not establish that the Vilnius arson or a specific current disinformation operation was directed by Russia. (Confidence: medium · REPORTED)
   • I&W: NATO or a member government publicly attributes a new sabotage, cyber or disinformation operation to Russia, reinforcing the assessment of continuing activity. (0-30 days)
   • I&W: NATO or member governments publicly revise the assessment and attribute the cited incidents to non-Russian actors, which would weaken it. (1-3 months)
4. It is likely that Romanian and Moldovan authorities will report further drone-related airspace incidents in the near term, but the recent reports do not establish one operator or a reconciled incident count. Romanian F-16s shot down two drones over territorial waters on 17 October, and Romania has repeatedly reported drone incursions since 2022; the defence ministry did not specify the origin of the two drones. A report of five Russian drones falling in Moldova over a little more than 17 hours conflicts in scale with a separate report of one drone crash. (Confidence: medium · ASSESSED)
   • I&W: Romanian or Moldovan authorities report another verified airspace incursion, drone recovery or interception, confirming continued incidents. (0-30 days)
   • I&W: No further verified incident is reported over the next three months and Moldovan authorities clarify that the reports described one overlapping event, weakening the near-term recurrence assessment. (1-3 months)
5. It is unlikely that the supplied reporting establishes a new, specifically identified Russian disinformation operation targeting Europe during 18-19 October. NATO and think-tank reporting describe disinformation campaigns as part of broader Russian hybrid activity, while the specific current allegation about Russian bots concerns the US midterm elections and appears in a social-media post citing unnamed analysts. (Confidence: low · ASSESSED)
   • I&W: A European government, NATO or a named platform publishes evidence of a Russian-linked network targeting a European audience, which would confirm a specific operation. (0-30 days)
   • I&W: The US midterm bot allegation is publicly retracted or attributed to unrelated actors, further weakening its relevance to this Europe-focused assessment. (0-30 days)

Outlook & scenarios

Separate incidents, cautious attribution (55%)

Investigations in Lithuania, Poland and Bulgaria proceed without public evidence of a shared network. Authorities maintain security measures around Starlink infrastructure, while Lithuanian suspicion of Russian involvement remains unproven and the Polish investigation continues to refer to an unidentified foreign intelligence service.

Investigations establish a connected campaign (25%)

Investigators identify shared methods, communications or financing across two or more Starlink site attacks. A public link to Russian tasking would raise the risk assessment and prompt stronger coordination among affected governments and NATO.

High-impact service disruption (8%)

An attack causes a fire at a site whose loss is not covered by existing network redundancy, interrupting Starlink connectivity. A public attribution before the evidence is fully established intensifies diplomatic pressure and complicates investigation coordination.

Recommendations

1. Maintain a shared incident log for the Vilnius, Wola Krobowska and Sofia sites. Record date, location, damage, method, suspects and the precise wording of each authority's attribution separately.
2. Prioritise follow-up on the Lithuanian Criminal Police Bureau investigation and the Polish Internal Security Agency case. Seek public updates on suspects, forensic links and any evidence of foreign-service tasking before treating the incidents as Russian-directed.
3. Track Bulgarian investigators' confirmation of the Sofia incident date and the reported damage to 11 of 17 antennas. Compare the disclosed methods with the Vilnius and Polish cases.
4. Reconcile Romanian and Moldovan drone reports with official statements on recovered debris, origin and incident counts. Do not attribute the two Romanian drones to Russia unless authorities provide supporting evidence.
5. Separate broad reporting on Russian disinformation from claims about a specific operation. Require a named source, documented network behaviour or platform findings before assessing the US midterm bot allegation as evidence of activity in Europe.

Confidence & uncertainty

Overall confidence is high for the occurrence and immediate consequences of the Vilnius attempted arson and for the reported attacks at Starlink sites in Poland and Bulgaria. The reporting includes statements from Lithuanian officials and specific details on the sites, damage and service impact. Confidence in Russian direction or a shared command structure is low: Lithuania has announced suspicion but no detainees, while Polish prosecutors refer to an unnamed foreign intelligence service. Drone counts and origins remain unresolved, and the specific current disinformation allegation rests on weak social-media reporting.

Intelligence gaps

• [EEI 1.2 · UNCOVERED] Observed reconnaissance activity around critical sites indicative of attack planning (unauthorised drone flights, repeated surveillance visits, loitering vehicles, mapping/photography of assets). Recommended collection: open-source/media
• [EEI 1.3 · UNCOVERED] Law-enforcement or customs seizures, arrests or interdictions of persons or shipments carrying explosives, sabotage tools, specialty cutting/electrical equipment, or covert comms gear destined for/near critical infrastructure. Recommended collection: law enforcement
• [EEI 2.1 · UNCOVERED] Emergence or amplification of coordinated social-media networks (sets of accounts, pages, channels) pushing identical narratives or hashtags across multiple platforms, including bot-like activity metrics and origin IP/common management indicators. Recommended collection: social-media/OSINT
• [EEI 2.2 · UNCOVERED] Publication or internal guidance from state-run media, proxy outlets, or identified influence platforms distributing talking points, pre-scripted messaging, or translated content targeted at specific EU countries/communities. Recommended collection: open-source/media
• [EEI 2.3 · UNCOVERED] Distribution of manipulated multimedia (deepfakes), targeted phishing/whaling campaigns, or localized false narratives timed to political events (elections, protests, court rulings) with tracked reach and engagement metrics. Recommended collection: cyber/forensic
• [EEI 3.1 · PARTIAL] Unusual financial transactions: wire transfers, crypto conversions, or payments to shell companies, NGOs or individuals exceeding typical baselines that link to known proxies or front organisations. Recommended collection: financial
• [EEI 3.2 · UNCOVERED] Travel and movement indicators for suspected operatives: repeated border crossings, chartered/irregular flights, booking patterns or mobile/location data placing identified individuals in staging areas shortly before incidents. Recommended collection: border/immigration
• [EEI 3.3 · UNCOVERED] Cargo, freight or maritime movements with discrepancies (concealed/dual-use equipment, false manifests, unusual routing) detected at ports, rail hubs or via AIS that correspond to deliveries of material used in sabotage or influence operations. Recommended collection: customs/ports
• [EEI 3.4 · UNCOVERED] Intercepted or otherwise-obtained communications showing tasking, coordination, or payment instructions between Russian agencies/handlers and proxy groups, including identified command-and-control servers or encrypted group identifiers. Recommended collection: signals-intel/SIGINT

Red cell review: CONCUR WITH COMMENT

TLP:CLEAR