Lithuania Links Starlink Sabotage in Bulgaria and Poland, Identifies Serbian-German Suspect

Lithuanian investigators have identified two suspects in an attempted arson attack against Starlink satellite communications infrastructure in Vilnius and established links to similar attacks in Bulgaria and Poland, raising concerns about coordinated sabotage targeting critical infrastructure supporting Ukraine.

The Lithuanian Criminal Police Bureau announced on October 29 that the suspects, both residents of Germany, hold dual citizenship. One is a Serbian-German national, while the other holds Turkish and German citizenship.

Investigators believe the same individuals were involved in attacks in Lithuania and Bulgaria, while suspects in a separate incident in Poland are connected to the wider group. Lithuanian authorities are also examining possible links to Russia, although the investigation has not established who ultimately organized or financed the operations.

Lithuanian Police Identify Suspects in Cross-Border Investigation

The Lithuanian investigation concerns an October 18 attempt to set fire to Starlink satellite communications equipment at a commercial facility in the Aukštieji Paneriai district of Vilnius.

The targeted site is operated by Lithuanian technology company Delska, which provides facilities used by SpaceX for Starlink infrastructure. According to Lithuanian officials, the location supports nine satellite communications antennas associated with connectivity used by Ukraine.

A fire broke out during the incident but was extinguished by a security guard before the equipment could be destroyed. The facility's operations were not interrupted.

Saulius Briginas, deputy head of the Lithuanian Criminal Police Bureau, said investigators had identified two men who allegedly arrived in Lithuania shortly before the attack and departed immediately afterward.

On October 27, Lithuanian prosecutors formally designated both men as suspects in an investigation involving the creation and participation in an organized terrorist group, travel for terrorist purposes and an alleged terrorist act that could have caused serious consequences.

Both suspects are currently detained in Germany following European arrest warrants issued by Bulgarian authorities in connection with a separate Starlink arson case.

Bulgarian Attack Provides Critical Connection

The Lithuanian announcement establishes a significant new connection to the October 9 attack against Starlink antennas at the Plana satellite communications facility south of Sofia.

As AdriaDefense reported on October 29, German authorities detained two men accused by Bulgarian prosecutors of deliberately setting fire to satellite communications equipment after entering Bulgaria from Serbia.

Bulgarian investigators established that the suspects entered the country through the Kalotina border crossing in a vehicle with German registration plates, spent several hours in Bulgaria and returned to Serbia the same evening.

According to the Bulgarian prosecution, three Starlink antennas were completely destroyed, two were partially burned and three others sustained fire damage.

The suspects, identified in Bulgarian court proceedings as Zeka Islam and Tirpan Beytulla, were detained in Germany on October 23. German judicial authorities are considering their extradition to Bulgaria.

The latest Lithuanian findings suggest the attack near Sofia was not an isolated incident. Investigators now suspect that the same two individuals subsequently traveled to Lithuania, where they attempted another attack against Starlink infrastructure nine days later.

Polish Intelligence Investigation Reveals Wider Network

Lithuanian authorities have also identified connections to a third Starlink sabotage case in Poland.

On September 23, a fire damaged the power infrastructure of a Starlink ground station in Wola Krobowska, south of Warsaw.

Poland's Internal Security Agency (ABW), working with police and prosecutors, subsequently determined that the fire resulted from deliberate arson.

Investigators reconstructed the movements of two Turkish nationals residing in Germany who allegedly entered Poland, traveled to the facility and returned to Germany after the attack.

Both men were detained in Germany on October 12 following European arrest warrants requested by Polish authorities.

The Polish investigation also identified an individual suspected of conducting reconnaissance of the facility and transmitting photographs and videos of its security arrangements through Telegram.

Lithuanian investigators believe the individuals involved in the Polish incident are connected to those suspected in Bulgaria and Lithuania. However, the Polish attack involved different alleged perpetrators, and the precise structure of the suspected network remains under investigation.

Possible Russian Connection Under Investigation

The attacks have attracted particular attention from European intelligence agencies because Starlink provides communications capabilities extensively used by Ukrainian military forces.

Lithuanian Prime Minister Mindaugas Sinkevičius previously described the Vilnius incident as a possible element of Russian hybrid warfare. Polish authorities have separately investigated whether the September attack involved activities undertaken on behalf of Russian intelligence.

The Lithuanian Criminal Police Bureau and prosecutors are working with law enforcement and intelligence partners in Germany, Bulgaria and Poland to establish the relationships between the suspects and identify potential organizers.

Nevertheless, no final judicial finding has established that the three attacks were ordered or financed by Russian intelligence services.

The distinction is important as investigators continue to examine whether the incidents formed part of one coordinated campaign or involved connected groups operating under separate instructions.

European Satellite Infrastructure Faces Growing Security Risks

The emerging investigation illustrates how satellite communications facilities have become potential targets in the broader security environment surrounding Russia's war against Ukraine.

While Starlink is known primarily for its satellite network, the system also depends on ground-based infrastructure, including gateway antennas, power supplies, network connections and supporting technical facilities.

Disrupting these assets can create operational risks for communications services, although authorities have not demonstrated that the attacks in Bulgaria, Lithuania or Poland caused interruptions to Ukrainian military operations.

For European defense companies, telecommunications providers and critical infrastructure operators, the cases highlight the importance of physical security, access controls, contractor screening and cross-border intelligence cooperation.

The next significant developments will involve extradition proceedings in Germany and the continuing investigations into whether the suspects received instructions, financing or logistical support from a common organization.

All suspects remain presumed innocent unless convicted by a court.