Full Report
Prime Minister Donald Tusk said that German Police had arrested two suspects on behalf of Polish services and called the attack “another act of hybrid warfare” in a post on X.
Analysis Summary
# Incident Report: Sabotage of Starlink Ground Station in Wola Krobowska
## Executive Summary
A Starlink ground station in Wola Krobowska, Poland, was targeted in a kinetic arson attack attributed to Russian intelligence services. The incident, described as an act of hybrid warfare, aimed to disrupt satellite internet connectivity crucial for Ukrainian military operations. Following a multinational investigation, two Turkish nationals were arrested in Germany on behalf of Polish authorities.
## Incident Details
- **Discovery Date:** September 23, 2026
- **Incident Date:** September 23, 2026
- **Affected Organization:** Exatel (Operator); Starlink/SpaceX (Technology Provider)
- **Sector:** Telecommunications / Critical Infrastructure
- **Geography:** Wola Krobowska, Masovian Voivodeship, Poland
## Timeline of Events
### Initial Access
- **Date/Time:** September 23, 2026
- **Vector:** Physical Trespass / Kinetic Attack
- **Details:** Suspects gained physical access to the facility perimeter to initiate the attack.
### Lateral Movement
- **N/A:** As a kinetic arson attack, movement was limited to physical navigation of the site rather than digital network movement.
### Data Exfiltration/Impact
- **Details:** No data exfiltration reported. The primary impact was the physical destruction of telecommunications hardware by fire, leading to a disruption of internet traffic routed to Ukraine.
### Detection & Response
- **Discovery:** Emergency services responded to a fire at the ground station facility on September 23.
- **Response Actions:** Polish special services launched a sabotage investigation; German police arrested two suspects in Germany on October 10, 2026.
## Attack Methodology
- **Initial Access:** Physical breach of the Wola Krobowska ground station site.
- **Persistence:** Not applicable (One-time kinetic event).
- **Privilege Escalation:** Physical bypassing of site security/fencing.
- **Defense Evasion:** Use of foreign proxies (Turkish nationals) and cross-border movement (fleeing to Germany) to obfuscate the link to Russian intelligence.
- **Credential Access:** N/A.
- **Discovery:** Physical reconnaissance of critical infrastructure vulnerabilities.
- **Lateral Movement:** N/A.
- **Collection:** N/A.
- **Exfiltration:** N/A.
- **Impact:** Arson/Incendiary device used to cause hardware failure and service outage.
## Impact Assessment
- **Financial:** Undisclosed costs related to the replacement of specialized Starlink ground station equipment and infrastructure repairs.
- **Data Breach:** None reported.
- **Operational:** Disruption of high-speed internet hubs serving the front line in Ukraine; potential degradation of military communications.
- **Reputational:** High public impact; highlights vulnerabilities in European support infrastructure for Ukraine.
## Indicators of Compromise
- **Network indicators:** N/A.
- **File indicators:** N/A.
- **Behavioral indicators:**
- Physical surveillance of telecommunications facilities by non-affiliated foreign nationals.
- Coordination between criminal underworld elements and foreign intelligence services.
## Response Actions
- **Containment:** Fire suppression by local emergency services at the Wola Krobowska site.
- **Eradication:** Identification and apprehension of the physical threat actors (two suspects arrested in Germany).
- **Recovery:** Restoration of internet traffic through alternative Exatel routing or hardware replacement.
## Lessons Learned
- **Key Takeaways:** State-sponsored threats are increasingly utilizing "kinetic hybrid warfare" (physical sabotage) alongside cyberattacks.
- **Proxies:** Adversaries are outsourcing physical operations to criminal elements or foreign nationals to maintain deniability.
- **Cross-Border Cooperation:** Rapid coordination between Polish and German law enforcement was critical for the apprehension of suspects.
## Recommendations
- **Physical Security:** Enhance perimeter security, surveillance (CCTV), and motion detection at all critical telecommunications hubs, particularly those serving Ukraine.
- **Intelligence Sharing:** Increase monitoring of individuals linked to the criminal underworld who may be recruited for state-sponsored sabotage.
- **Redundancy:** Ensure geographic redundancy for satellite ground stations to mitigate the impact of a single physical point of failure.