German special police units have arrested a Turkish citizen in Reutlingen district on suspicion of ordering the 23 September arson attack on a Starlink ground station in Poland, the Stuttgart Prosecutor General's Office and Baden-Württemberg's State Criminal Police Office announced on 3 November. Investigators say he hired the two men who allegedly set the fire, acting from Germany. A trail in the case leads to a Turkish crime gang whose members may have worked for Russian intelligence, Der Spiegel reported.

Starlink keeps Ukraine's drone units and front-line troops connected, and Poland has supplied 29,500 of the terminals they use. Until now, arrests in Europe's run of attacks on Starlink sites had reached only people suspected of carrying them out. This is the first suspect held as the one who ordered an attack, and Germany has opened its own terrorism case instead of only executing Poland's warrants. That may bring investigators a step closer to whoever paid for the fire.

Prosecutors say he gave the orders from Germany

According to the investigators, the man commissioned the two Turkish citizens detained in October to carry out the attack. He also allegedly arranged for another suspect to drive them to Poland on the night of 23 September. Police seized eight mobile phones and ammunition from him. A Stuttgart court ordered him held on strong suspicion of preparing a terrorist offense. Prosecutors gave no further details, citing the ongoing investigation.

The two alleged arsonists, aged 38 and 34, were detained in Nürtingen on 12 October under European arrest warrants issued by Poland, and their extradition proceedings are still under way. Warsaw blamed Russian intelligence for the fire. Tomasz Siemoniak, the minister coordinating Poland's special services, said those services increasingly turn to people tied to the criminal world.

A Turkish gang whose leader Russia never handed over

In October, Der Spiegel first reported, citing independent sources in several countries, that the trail leads to the Daltons, a Turkish organized crime group also active in Germany. Gang members may have carried out the sabotage on behalf of Russian intelligence, the magazine wrote. The gang's alleged leader, Beratcan Gökdemir, was arrested in Russia in 2024, but Moscow never extradited him to Türkiye. German security sources told Der Spiegel that Russia even protected him, and it is unclear whether he is still there.

Germany's Interior Ministry warned in May that working with organized crime suits Russian services especially for “sabotage or killing operations,” Der Spiegel reported. Until now, Russia has mostly relied on petty criminals paid small sums, who know little about who is behind a job. On 27 October, Turkish police detained 85 suspected Daltons members, 30 of them minors, in 30 provinces. They said the gang recruited people through social media and directed them in a messaging group, and did not mention Starlink.

Three Starlink sites attacked in under a month

The fire in Wola Krobowska, south of Warsaw, was the first of three attacks on Starlink sites in Europe. In October, intruders burned antennas at a satellite ground station near Sofia, and a German court has ordered two 19-year-old Germans held pending extradition to Bulgaria. Sofia says the same pair struck another EU country on 18 October, the night guards foiled an attempt to burn Starlink antennas at a Lithuanian company. The Bulgarian and Lithuanian attacks are not part of the German arrest warrant, Der Spiegel noted.

In recent weeks, the Pentagon has urged several NATO allies, among them Lithuania, Latvia, and Estonia, to tone down their public warnings about the threat from Russia, four people familiar with the matter told Reuters. Pentagon officials argued that some European statements undermined Europe's security, the sources said. Pentagon policy chief Elbridge Colby recently advised a Baltic official against any "poking" of the Russians, one of the people said.

Russia's full-scale war on Ukraine is in its fifth year, and Moscow has spread a deniable arson and sabotage campaign across Europe. As Washington offers Moscow sanctions relief and presses Kyiv to stop hitting Russian energy, the restraint it seeks appears to fall on those Russia threatens, first Ukraine and now NATO's eastern flank.

An Estonian delegation was told to be "measured"

As an example of unhelpful rhetoric, Colby cited Europeans' public suggestions that Russia was "cornered like a rat," the person said. Reuters could not determine whose words he meant. In late September, Estonia said Russia had ordered the arson at Milrem Robotics, a Tallinn company supplying ground robots to Ukraine, and Estonian Prime Minister Kristen Michal likened Putin to a "rat in the corner." Michal said Putin was stepping up activity in Europe to erode the West's backing for Kyiv, and that the surest deterrent was to "back Ukraine."

At another meeting, Pentagon officials asked an Estonian delegation to keep its communications "measured," a person briefed on the encounter said. Another European official described the Pentagon's private messaging this way:

"We are helping you. The Americans are there… Just don't be loud. Don't make noise."

One European official called the advice cordial but baffling, since the Baltic states' own intelligence services have repeatedly judged it unlikely in recent months that Russia would test NATO's mutual defense provisions.

The Pentagon refused to discuss "private conversations among allies," and the Baltic defense ministries did not reply.

One messenger is a key figure in the review of US troops in Europe

Colby is a key figure in the Pentagon's ongoing review of US force posture in Europe, which could lead to a sharp troop drawdown. In September, the Pentagon was weighing pulling up to 40,000 troops from Europe.

Russia has lately stepped up its deniable attacks on NATO members, Western intelligence officials say. Its suspected arson campaign against Starlink sites serving Ukraine has reached Lithuania, and on 28 October German prosecutors announced the arrest of two Belarusians suspected of plotting arson near Nuremberg. Russia denies running a sabotage campaign. Meanwhile, US officials have discussed business deals with Russia, which many European officials oppose.

The Higher Regional Court in Düsseldorf has ordered two 19-year-old Germans held pending extradition to Bulgaria, which accuses them of setting fire to Starlink antennas at a satellite ground station near Sofia, the court and Düsseldorf prosecutors said on 29 October. The men, from Duisburg and Moers, were arrested on 23 October, German prosecutors told Reuters.

As Russia presses its war on Ukraine, Starlink keeps Ukraine’s drone units and front-line troops connected, and its ground sites in Europe have become targets. Within a month, fires and attempted fires hit Starlink sites in Poland, Bulgaria, and Lithuania, and Warsaw and Vilnius have linked them to Russia. The Bulgarian case now has its first arrests, and Sofia says the same pair struck another EU country, which would make it more than a one-off.

Sofia says the pair struck another EU country on 18 October

Bulgarian Interior Minister Ivan Demerdzhiev said he expected both suspects to be handed over to Bulgaria, and that the same two carried out a similar attack in another EU member state on 18 October, the state news agency BTA reported on 28 October. He did not name the country outright, but went on to cite Lithuania’s prime minister on an attempted arson there.

Overnight on 18 October, intruders tried to set fire to a Lithuanian company that stores Starlink equipment used by Ukraine, but tipped-off guards foiled the attempt. Lithuania’s prime minister called it part of Russia’s hybrid war.

Bulgarian Prime Minister Rumen Radev said the suspects had been detained in Germany several days earlier, and that disclosing their names sooner would have let them flee. The opposition wants to know whether a foreign security service warned Bulgaria at least a week before the attack, and how two 19-year-olds could enter the country and leave unnoticed. Parliament has failed three times to gather a quorum for a sitting to hear Radev and the security chiefs.

The suspects refuse a quick handover

The two did not agree to a simplified extradition, and the court will rule later on whether handing them over is admissible, according to the court’s statement carried by the dts news agency. Any extradition is to be approved only on the condition that, after a final sentence, they are offered a transfer back to Germany to serve it. Their lawyers plan to contest the Bulgarian warrant, dpa reported.

Bulgarian prosecutors say the pair crossed from Serbia as tourists on 9 October, set fire to eight antennas at the Plana teleport south of Sofia, and drove back to Serbia the same night. They were charged in absentia, a Sofia court confirmed European arrest warrants for them, and they face three to 12 years in prison if convicted.

Sofia City prosecutors announced the arrests on 27 October and said German authorities are gathering evidence for the case under a European investigation order. The pre-trial investigation continues, they said.

Ukraine’s Defense Intelligence (HUR) warned that Russia may stage sabotage in Central and Eastern Europe, including the Baltic states, and blame Ukraine for the attacks, in a Telegram post on 23 October.

The warning comes three days after The Wall Street Journal reported that US intelligence traces Europe’s sabotage wave to Putin’s personal order. If Russia stages new attacks and pins them on Ukraine, as HUR warns, European anger could turn on Kyiv rather than the Kremlin. This goes further than HUR’s statement on 2 October, which named potential Russian targets in Europe but did not mention a plan to blame Ukraine for attacks.

HUR says Moscow wants to discredit Ukraine’s army

Russia is stepping up its hybrid strategy to destabilize the European Union, according to HUR. The agency identified two aims: reducing foreign support for Ukraine by discrediting its Defense Forces, and intimidating European governments and societies.

The accusations would be spread through Russian propaganda channels and international platforms accessible to the Kremlin.

Potential targets include infrastructure and Russian Orthodox Church sites

HUR listed several potential targets for Russian provocations:

• critical infrastructure and areas bordering Russia;
• the Kaliningrad exclave;
• areas of EU countries with Russian-speaking populations;
• Kremlin-controlled sites, including properties belonging to the Russian Orthodox Church network;
• historical sites associated with Russia.

The list reflects HUR’s assessment of potential targets, not confirmation that attacks at these locations are planned.

Earlier warnings and reported sabotage

On 2 October, HUR said Russian intelligence services had been ordered to increase activity in EU and NATO countries. It named military facilities, critical infrastructure, communications systems, and Starlink ground stations as potential targets and said it had alerted partners.

Warnings of Russian false flags on NATO’s eastern flank predate HUR’s. In August, Bloomberg reported, citing an unnamed European intelligence official, that Russia might expand hybrid attacks against Poland and the Baltic states, including false-flag attacks. A European government official separately told the agency that the CIA had warned countries in the region of a possible Russian attack. Lithuania’s military intelligence had warned earlier in August that Moscow might reassemble captured Ukrainian drones for false-flag strikes on critical infrastructure in the Baltic region.

Meanwhile, The Wall Street Journal reported on 20 October that US intelligence agencies believe the attempted drone attack on Leipzig-Halle Airport in Germany in early August was among the opening shots of a sabotage campaign ordered by Russian President Vladimir Putin. The Journal cited European officials briefed on the intelligence findings.

According to the newspaper, at least three drones carrying military-grade Semtex explosives were involved. One struck an Antonov cargo plane used to transport military aid to Ukraine but failed to explode. Another collided with a different aircraft, while a third detonated near the airport perimeter. German newspaper Welt am Sonntag has since named two suspects, citing German investigation files. Earlier German media reports described the sequence differently.

The Journal also reported sabotage attacks on Starlink stations in Poland, Lithuania, and Bulgaria in recent weeks. In August, Slovak authorities said they had foiled a planned arson attack on a Ukrainian drone factory, the Journal reported.

Russia denies involvement in sabotage in Europe. Responding to Berlin’s accusations over the Leipzig incident in early September, Putin asked where the evidence was.

A Sofia court has cleared European arrest warrants for two 19-year-old Germans charged with setting fire to Starlink antennas south of the Bulgarian capital, a court spokeswoman told dpa. Prosecutors named the pair in court, but both had already left Bulgaria. The case adds Bulgaria to a run of attacks on Starlink sites in Europe, which Poland and Lithuania have linked to Russia.

While Russia presses its assault along the front and strikes Ukraine’s cities, Starlink keeps Ukraine’s drone units and front-line troops connected, and Poland pays about $50 million a year for its terminals. The network’s ground links in Europe are now a target in their own right, and ISW has linked the Polish fire to a wider Russian pattern of sabotage. Each attack on a ground station hits a network whose speed caps already disrupted Ukraine’s drone missions this month.

Two names, a few hours in Bulgaria

Prosecutors identified the suspects as Zeka Islam and Tirpan Beytullah, Bulgaria’s state news agency BTA reported, noting the names may be misspelled. Their whereabouts are unknown, according to German authorities cited by the agency. They were charged in absentia on 14 October and face three to 12 years in prison if convicted.

According to the indictment, the two crossed from Serbia at the Kalotina checkpoint at 17:37 on 9 October and told border officers they were tourists. At about 22:25, wearing gloves and masks, they allegedly set fire to antennas at the Plana teleport, a satellite ground station near the village of Plana. They drove back into Serbia through the same checkpoint at 23:55.

Three antennas burned completely, two were partly damaged, and three more were affected, prosecutors say. The pair traveled in a Volkswagen with German plates, and a national warrant followed two days after the charges, ZDF reported.

The court-appointed lawyers argued that investigators had pinned down the vehicle, not the men in it. The court rejected those objections, finding reasonable grounds to suspect the pair. The lawyers said they would appeal. The ruling can be challenged within three days.

An opposition MP made the fire public three days later

The fire became public only on 12 October, when opposition MP Ivaylo Mirchev of Democratic Bulgaria posted about it on Facebook. He said 11 antennas had been set on fire, more than prosecutors later counted.

In parliament two days later, Prime Minister Rumen Radev asked the head of the State Agency for National Security (DANS) not to reveal details, saying disclosure could harm the investigation. DANS head Plamen Tonchev told lawmakers he believes the fire was sabotage and that more such attacks cannot be ruled out, dpa reported.

After the ruling, Mirchev wrote that Radev personally owes the public an explanation of what has been achieved, BTA reported.

Bulgaria’s case joins attacks Poland and Lithuania tie to Russia

Bulgaria has not said who might be behind the fire. Authorities in Poland and Lithuania have linked similar recent arsons on Starlink equipment to Russia.

In September, fire hit a Starlink ground station south of Warsaw, and Germany later detained two suspects. On 18 October, Lithuania’s prime minister said intruders had tried to burn a company’s Starlink antennas used by Ukraine, calling it part of Russia’s hybrid war. Moscow claims such accusations are baseless, Reuters reported.

Someone tried to set fire overnight to a Lithuanian company that stores Starlink communication equipment, but tipped-off guards foiled the attempt, Lithuanian Prime Minister Mindaugas Sinkevičius said. He linked the attack to Russia’s hybrid war against Europe. It is the third suspected sabotage of Starlink infrastructure in Europe in under a month.

Russia keeps attacking Ukraine at the front and from the air while running a sabotage campaign behind the lines in Europe, which ISW has linked into one pattern. Starlink keeps Ukraine’s drone units and front-line troops connected, and Poland pays for much of that service.

Fuel canisters and a control unit

The attack came just after midnight, the prime minister wrote. Security services had warned the company about possible attacks, security was stepped up, and the attempt failed.

The company provides connectivity through nine Starlink satellite antennas used by Ukraine, Sinkevičius told Lithuanian public radio LRT. At almost 2 a.m., intruders tried to burn the antennas and their control unit, leaving behind incendiary liquid in canisters of 3 to 10 liters.

“It is obvious that this is part of Russia’s hybrid war with elements of sabotage,” he said, adding that the client was likely “the Russian side.”

He said he believes the people involved, and how many there were, are known, but gave no details, citing the investigation.

Police Commissioner General Arūnas Paulauskas said no suspects had been detained, any damage was minimal, and the company kept working. A pretrial investigation is under way.

A drone the same morning

Hours later, an object that apparently entered from Poland crossed northern Lithuania, and NATO jets failed to identify it, Defense Minister Robertas Kaunas said. Possible fragments were found in the Pasvalys district near the Latvian border. Latvia’s military said the object may have blown itself up on a course toward Latvia.

Sinkevičius said the sabotage version had to be checked for the drone too. He called the National Security Commission for Monday, 19 October, to examine both incidents and consider giving services more powers to neutralize drones.

The third Starlink site

In September, a fire destroyed the distribution panel at a Starlink ground station in Wola Krobowska, Poland. Germany detained two Turkish nationals on 12 October, and Warsaw blamed Russian intelligence. In Bulgaria, masked intruders burned 11 of 17 Starlink antennas near Sofia.

German services detained two Turkish citizens on 12 October over the 23 September arson attack on a Starlink ground station in Wola Krobowska, near Warsaw, Poland’s Internal Security Agency (ABW) said. Both are suspected of arson, and Polish officials blame Russian intelligence. RMF24 later reported that German police also detained two more people who may be connected to the attack.

Poland is one of the main corridors for Western aid to Ukraine, and Polish Foreign Minister Radosław Sikorski has said Poland spends about $50 million a year on Ukraine's Starlink service. That puts Polish infrastructure in the path of a Russian campaign that already hacks cameras to track arms heading east.

Fingerprints, DNA, and a route out

The men were held under European arrest warrants and now await transfer to Poland. Interior Minister Marcin Kierwiński wrote that the suspects would face charges of “subversion, sabotage on behalf of a foreign intelligence service” after their transfer to Poland. Polish authorities issued European arrest warrants for the suspects, who were subsequently detained in Germany.

Działania @PolskaPolicja i @ABW_GOV_PL we współpracy ze służbami niemieckimi (BKA) doprowadziły
do zatrzymania na terenie Niemiec 2 obywateli Turcji odpowiedzialnych za podpalenie stacji Starlink w Woli Krobowskiej. Zarzut-dywersja, sabotaż na rzecz obcego wywiadu. @CBSPolicji

— Marcin Kierwiński (@MKierwinski) October 12, 2026

Police chief Marek Boroń said investigators reconstructed how the suspects prepared the attack and fled. “We have secured recordings pointing to this specific action. We have fingerprints, the perpetrators’ DNA, how they moved, when they came to Poland, and when they were evacuated from our country,” he said. One suspect lives in Germany, and the other had been ordered to leave the country, he added.

Warsaw points at Moscow

Prime Minister Donald Tusk called the fire another act of Russia's hybrid war and promised the saboteurs will answer to Polish justice.

Na zlecenie polskich służb niemiecka policja zatrzymała dwóch obywateli tureckich podejrzanych o podpalenie stacji Starlink na Mazowszu. To kolejny akt wojny hybrydowej. Sprawcy sabotażu odpowiedzą przed polskim wymiarem sprawiedliwości.

— Donald Tusk (@donaldtusk) October 12, 2026

“We have no doubt that Russian intelligence services are behind this act of sabotage,” said Tomasz Siemoniak, the minister coordinating Poland’s special services.

Those services increasingly turn to people tied to the criminal world, he added.

Two more possible links

German counterterrorism officers detained a woman in Berlin, and a man is also in German custody, Polish radio RMF FM reported, citing its reporter. Both may be linked to the arson. The woman allegedly picked up the Turkish men near Łódź after they entered Poland from Germany, then drove them to Wola Krobowska. The man’s role is still being examined.