The Higher Regional Court in Düsseldorf has ordered two 19-year-old Germans held pending extradition to Bulgaria, which accuses them of setting fire to Starlink antennas at a satellite ground station near Sofia, the court and Düsseldorf prosecutors said on 29 October. The men, from Duisburg and Moers, were arrested on 23 October, German prosecutors told Reuters.

As Russia presses its war on Ukraine, Starlink keeps Ukraine’s drone units and front-line troops connected, and its ground sites in Europe have become targets. Within a month, fires and attempted fires hit Starlink sites in Poland, Bulgaria, and Lithuania, and Warsaw and Vilnius have linked them to Russia. The Bulgarian case now has its first arrests, and Sofia says the same pair struck another EU country, which would make it more than a one-off.

Sofia says the pair struck another EU country on 18 October

Bulgarian Interior Minister Ivan Demerdzhiev said he expected both suspects to be handed over to Bulgaria, and that the same two carried out a similar attack in another EU member state on 18 October, the state news agency BTA reported on 28 October. He did not name the country outright, but went on to cite Lithuania’s prime minister on an attempted arson there.

Overnight on 18 October, intruders tried to set fire to a Lithuanian company that stores Starlink equipment used by Ukraine, but tipped-off guards foiled the attempt. Lithuania’s prime minister called it part of Russia’s hybrid war.

Bulgarian Prime Minister Rumen Radev said the suspects had been detained in Germany several days earlier, and that disclosing their names sooner would have let them flee. The opposition wants to know whether a foreign security service warned Bulgaria at least a week before the attack, and how two 19-year-olds could enter the country and leave unnoticed. Parliament has failed three times to gather a quorum for a sitting to hear Radev and the security chiefs.

The suspects refuse a quick handover

The two did not agree to a simplified extradition, and the court will rule later on whether handing them over is admissible, according to the court’s statement carried by the dts news agency. Any extradition is to be approved only on the condition that, after a final sentence, they are offered a transfer back to Germany to serve it. Their lawyers plan to contest the Bulgarian warrant, dpa reported.

Explore further

17 public broadcasters mapped Russia’s hybrid war on Europe. Germany: four dots

Bulgarian prosecutors say the pair crossed from Serbia as tourists on 9 October, set fire to eight antennas at the Plana teleport south of Sofia, and drove back to Serbia the same night. They were charged in absentia, a Sofia court confirmed European arrest warrants for them, and they face three to 12 years in prison if convicted.

Sofia City prosecutors announced the arrests on 27 October and said German authorities are gathering evidence for the case under a European investigation order. The pre-trial investigation continues, they said.

Ukraine’s Defense Intelligence (HUR) warned that Russia may stage sabotage in Central and Eastern Europe, including the Baltic states, and blame Ukraine for the attacks, in a Telegram post on 23 October.

The warning comes three days after The Wall Street Journal reported that US intelligence traces Europe’s sabotage wave to Putin’s personal order. If Russia stages new attacks and pins them on Ukraine, as HUR warns, European anger could turn on Kyiv rather than the Kremlin. This goes further than HUR’s statement on 2 October, which named potential Russian targets in Europe but did not mention a plan to blame Ukraine for attacks.

HUR says Moscow wants to discredit Ukraine’s army

Russia is stepping up its hybrid strategy to destabilize the European Union, according to HUR. The agency identified two aims: reducing foreign support for Ukraine by discrediting its Defense Forces, and intimidating European governments and societies.

The accusations would be spread through Russian propaganda channels and international platforms accessible to the Kremlin.

Potential targets include infrastructure and Russian Orthodox Church sites

HUR listed several potential targets for Russian provocations:

• critical infrastructure and areas bordering Russia;
• the Kaliningrad exclave;
• areas of EU countries with Russian-speaking populations;
• Kremlin-controlled sites, including properties belonging to the Russian Orthodox Church network;
• historical sites associated with Russia.

The list reflects HUR’s assessment of potential targets, not confirmation that attacks at these locations are planned.

Earlier warnings and reported sabotage

On 2 October, HUR said Russian intelligence services had been ordered to increase activity in EU and NATO countries. It named military facilities, critical infrastructure, communications systems, and Starlink ground stations as potential targets and said it had alerted partners.

Warnings of Russian false flags on NATO’s eastern flank predate HUR’s. In August, Bloomberg reported, citing an unnamed European intelligence official, that Russia might expand hybrid attacks against Poland and the Baltic states, including false-flag attacks. A European government official separately told the agency that the CIA had warned countries in the region of a possible Russian attack. Lithuania’s military intelligence had warned earlier in August that Moscow might reassemble captured Ukrainian drones for false-flag strikes on critical infrastructure in the Baltic region.

Meanwhile, The Wall Street Journal reported on 20 October that US intelligence agencies believe the attempted drone attack on Leipzig-Halle Airport in Germany in early August was among the opening shots of a sabotage campaign ordered by Russian President Vladimir Putin. The Journal cited European officials briefed on the intelligence findings.

According to the newspaper, at least three drones carrying military-grade Semtex explosives were involved. One struck an Antonov cargo plane used to transport military aid to Ukraine but failed to explode. Another collided with a different aircraft, while a third detonated near the airport perimeter. German newspaper Welt am Sonntag has since named two suspects, citing German investigation files. Earlier German media reports described the sequence differently.

The Journal also reported sabotage attacks on Starlink stations in Poland, Lithuania, and Bulgaria in recent weeks. In August, Slovak authorities said they had foiled a planned arson attack on a Ukrainian drone factory, the Journal reported.

Russia denies involvement in sabotage in Europe. Responding to Berlin’s accusations over the Leipzig incident in early September, Putin asked where the evidence was.

Someone tried to set fire overnight to a Lithuanian company that stores Starlink communication equipment, but tipped-off guards foiled the attempt, Lithuanian Prime Minister Mindaugas Sinkevičius said. He linked the attack to Russia’s hybrid war against Europe. It is the third suspected sabotage of Starlink infrastructure in Europe in under a month.

Russia keeps attacking Ukraine at the front and from the air while running a sabotage campaign behind the lines in Europe, which ISW has linked into one pattern. Starlink keeps Ukraine’s drone units and front-line troops connected, and Poland pays for much of that service.

Fuel canisters and a control unit

The attack came just after midnight, the prime minister wrote. Security services had warned the company about possible attacks, security was stepped up, and the attempt failed.

The company provides connectivity through nine Starlink satellite antennas used by Ukraine, Sinkevičius told Lithuanian public radio LRT. At almost 2 a.m., intruders tried to burn the antennas and their control unit, leaving behind incendiary liquid in canisters of 3 to 10 liters.

“It is obvious that this is part of Russia’s hybrid war with elements of sabotage,” he said, adding that the client was likely “the Russian side.”

He said he believes the people involved, and how many there were, are known, but gave no details, citing the investigation.

Police Commissioner General Arūnas Paulauskas said no suspects had been detained, any damage was minimal, and the company kept working. A pretrial investigation is under way.

Explore further

New Starlink restrictions disrupt Ukrainian drone missions. Kyiv adviser says move is tied to “political situation”

A drone the same morning

Hours later, an object that apparently entered from Poland crossed northern Lithuania, and NATO jets failed to identify it, Defense Minister Robertas Kaunas said. Possible fragments were found in the Pasvalys district near the Latvian border. Latvia’s military said the object may have blown itself up on a course toward Latvia.

Sinkevičius said the sabotage version had to be checked for the drone too. He called the National Security Commission for Monday, 19 October, to examine both incidents and consider giving services more powers to neutralize drones.

The third Starlink site

In September, a fire destroyed the distribution panel at a Starlink ground station in Wola Krobowska, Poland. Germany detained two Turkish nationals on 12 October, and Warsaw blamed Russian intelligence. In Bulgaria, masked intruders burned 11 of 17 Starlink antennas near Sofia.