Lithuania Files terrorism charges against two suspects in Starlink arson case

Lithuania filed terrorism charges on Oct. 27, 2026, against two suspects, with the Vilnius Regional Prosecutor’s Office alleging they tried to burn Starlink equipment at a data center on the outskirts of Vilnius on Oct. 18. The Vilnius Regional Prosecutor’s Office charged the men under terrorism statutes implementing an anti-terrorism framework, alleging they created and participated in a terrorist group, entered Lithuania for terrorist purposes, and committed a terrorist act capable of serious consequences. Bulgarian prosecutors identified the suspects as Zeka Islam and Tirpan Beytullah, both 19. German police arrested them in Duisburg on Oct. 23 under European arrest warrants issued by Bulgaria on Oct. 19.

The suspects hold dual citizenship, one Turkish-German and one Serbian-German, and live in Germany’s Ruhr area. Both men had no earlier link to Lithuania and traveled there for the attempt. DCDNoticias reported the Vilnius attempt occurred in the early hours of Oct. 19, while Tech Times, Militarnyi, and AeroTime dated it to Oct. 18.

Polish police took a third suspect into custody on Oct. 16. Investigators believe these men carried out the Sept. 23 attack on a Starlink ground station in Wola Krobowska, Poland, about 50 km or 31 miles from Warsaw. Flames destroyed the facility’s power distribution panel and damaged its backup generator.

Polish Prime Minister Donald Tusk described the Sept. 23 attack as hybrid warfare and blamed Russia, announcing arrests publicly on Oct. 12 working with Poland’s Internal Security Agency and Europol. Poland’s Internal Security Agency announced on Oct. 16 that German police detained two Turkish nationals suspected of the attack under European arrest warrants. Prosecutors suspect a foreign intelligence service was behind the Poland attack. Five other suspects have been detained across Germany and Poland in connection with the broader network.

Two masked people entered Bulgaria from Serbia through the Kalotina border crossing in a car registered in Germany and presented themselves as tourists before setting fire to antennas at the Plana Teleport facility south of Sofia at approximately 10:25 p.m. local time. Bulgarian prosecutors documented that three antennas were destroyed, two were partly damaged, and three more sustained damage. Rumen Radev, Bulgaria’s prime minister, confirmed the attack during a parliamentary session on Oct. 14, after opposition lawmaker Ivaylo Mirchev revealed on Facebook on Oct. 12 that 11 of 17 antennas had been set alight. Tech Times dated the attack to Oct. 9, Militarnyi to the night of Oct. 10, and AeroTime called an Oct. 12 date unconfirmed.

The Vilnius attackers attempted to set fire to antennas and a control unit at the Delska data center and left incendiary liquids in containers holding between three and 10 liters. The facility contains nine satellite antennas, and Delska leases space to SpaceX for Starlink ground infrastructure. Lithuania’s prime minister, Mindaugas Sinkevičius, said Delska operates the site. Two days before the incident, Lithuanian authorities had warned Delska about potential attacks.

Starlink connectivity remained uninterrupted after the Vilnius attempt, although a successful fire could have temporarily disrupted service because other ground stations provide redundancy, according to Vilmantas Vitkauskas, head of the National Crisis Management Center. Ground station attacks do not shut down Starlink worldwide or regionally; instead, they degrade the gateway layer carrying connectivity to particular areas, including locations that supply satellite relay services for Ukraine’s operational zones.

A gateway is a fenced compound with arrays of large dish antennas operating in Ka-band and V-band frequencies, and where satellites connect to the internet. Starlink’s fleet includes roughly 11,000 satellites flying in low Earth orbit around 550 km above the planet, and internet traffic must eventually enter the terrestrial internet backbone at a gateway ground station. Modern Starlink satellites carry optical inter-satellite links, laser connections letting satellites relay data directly to each other in orbit, a standard since the v1.5 generation in late 2021; these links lessen but do not remove reliance on ground stations and cannot replace the gateway itself.

Building and launching a Starlink satellite costs roughly $250,000 to $1 million, while incendiary liquid, a lighter and gloves can ignite a ground station antenna; two people needed about 90 minutes to enter and leave the Plana Teleport attack, destroying 11 of 17 antennas. The three attacks unfolded within 25 days and were publicly linked for the first time as a single coordinated transnational sabotage network.

Lithuanian Criminal Police deputy chief Saulius Briginas said at an Oct. 29 press conference that every suspect belongs to one network, though separate people carried out the Poland attack. Briginas stated direct links between the Starlink arson attacks in Lithuania, Bulgaria, and Poland. Lithuanian authorities said they were looking into possible links to Russian intelligence services but had not determined the motive behind the attacks or who ordered them. Prosecutor Nerijus Puškorius noted that proving state direction is harder than proving the arson itself.

Der Spiegel and Die Welt, citing European intelligence sources, tied the suspects in the Wola Krobowska and Plana Teleport attacks to the Daltons, a Turkish-Kurdish criminal group operating in Germany and other European cities. Militarnyi stated Daltons members may have organized the Poland arson at the behest of Russian intelligence services. In 2024, the Daltons broke away from Baris Boyun’s network to start a separate operation centered on violence-for-hire, arms trafficking, and extortion; most of its members were born in 2000 or later.

Beratcan Gökdemir, born in 1997 and described as the gang’s alleged leader, was arrested in Russia in 2024 and never extradited to Turkey despite Ankara’s request. ARD reported in March 2026 that a gang spokesperson said Gökdemir lived in a Russian government-provided safe house, and the broadcaster found video of Russian-side fighters in Ukraine recording birthday messages for him. Turkish police arrested 85 suspected members of the Daltons in a nationwide operation on Oct. 28. Milan’s Public Prosecutor’s Office arrested Baris Boyun in Viterbo, Italy, in May 2024, classified his network as terrorist, and accused him of instigating a murder in Berlin and planning a suicide bomber attack against a Turkish aluminum factory; Italy refused to extradite Boyun to Turkey.

Tomasz Siemoniak, who coordinates Poland’s special services, said Russia is outsourcing sabotage to criminal networks. In May 2026, Germany’s Federal Interior Ministry said organized crime serves as Moscow‘s instrument and gives operational cover that lets Russia reach strategic effects while keeping plausible deniability. Europol defines violence-as-a-service as a gig-economy model in which criminal groups sell commissioned violence ranging from assault to sabotage and enlist young operatives through social media and encrypted messaging platforms such as Telegram.

Europol’s Operation Grimm, led by Sweden, made 280 arrests across 11 countries in its first year and identified more than 1,400 people tied to violence-as-a-service networks. The International Institute for Strategic Studies found that Russian sabotage operations almost quadrupled from 2023 to 2024. The International Centre for Counter-Terrorism, based in the Netherlands, recorded 151 hybrid operations in Europe attributed to Moscow since February 2022; Poland had the most incidents, while Lithuania and Germany each had 15.

In 2026, Lithuanian prosecutors charged a multinational GRU-directed network that included nationals of Spain, Colombia, Cuba, Russia, and Belarus with arson attacks on a plant supplying radio wave scanners to Ukraine’s military. That case implicated attempted sabotage in Poland, Romania, and the Czech Republic. Lithuania and Bulgaria both want to prosecute the current suspects, but they had made no extradition decision by Oct. 29. German courts will resolve the competing extradition claims.

Under Lithuanian law implementing an anti-terrorism framework, membership in a terrorist group alone carries a sentence of five to 15 years. Poland, Lithuania, and Bulgaria are coordinating the investigation through Europol channels. Russia’s Foreign Ministry has not formally responded, while Moscow has repeatedly denied responsibility for sabotage operations in Europe.

Ukraine’s military began using civilian Starlink and Starshield, a military-grade variant run by the US government, for battlefield communications, drone guidance, and strike coordination shortly after Russia’s full-scale invasion began in February 2022. Starshield offers deeper encryption and government-controlled operational parameters, and SpaceX-US government agreements govern its use rather than Ukraine. Elon Musk said Starshield systems belong to the US government, which runs them.

In October 2026, multiple reports said Ukraine briefly lost Starshield-linked guidance capabilities after a speed limiter was placed on terminals, which disrupted drone and missile operations beyond roughly 100 mph. Starshield speed restrictions imposed overnight on Oct. 13 to 14 disrupted Ukrainian drone operations and led some units to cancel missions; connectivity was at least partly restored, but it remains unclear who ordered the restrictions. That episode was unrelated to the arson campaign but illustrated dependence on satellite communications infrastructure.

The Telegraph reported last week that Musk asked US President Donald Trump to slow down Starlink in Ukraine by introducing speed limits that hampered Ukraine’s drone defenses. Musk blamed Trump for the slowdown, while Trump told White House reporters last week that neither he nor Musk caused Ukraine to lose Starlink access. Ukraine’s communications infrastructure has relied on Starlink as a key component since the war with Russia began in 2022, and Ukraine received thousands of Starlink terminals after the invasion. Russia has targeted this infrastructure and other communications infrastructure during the war.

Law enforcement officials speculate the attacks aimed to disrupt Starlink satellite communications in Europe, especially for Ukrainian users, though exact motives remain undetermined. Mindaugas Sinkevičius said, “Clearly, this was an attempted act of sabotage, as we are already seeing similar incidents repeated across Europe.”