Full Report
Russian forces are trying to counter Ukrainian “mid-strike” drone attacks by camouflaging cargoes and installing powerful jamming systems to disrupt Elon Musk’s Starlink satellite internet system, Ukrainian drone commanders and pilots told Reuters. Kyiv’s development of “mid-strike” drones that can hit targets dozens of kilometres behind front lines accurately and cheaply, and are often flown…
Analysis Summary
# Tool/Technique: Starlink Electronic Warfare (EW) Jamming
## Overview
This technique involves the deployment of powerful, specialized electronic warfare (EW) jamming systems by Russian forces designed to disrupt and sever the connection between Starlink satellite terminals and their low-earth orbit (LEO) constellation. The primary purpose is to neutralize Ukraine’s "mid-strike" drone capabilities, which rely on Starlink for beyond-line-of-sight (BLOS) communication, navigation, and real-time video transmission for precision strikes.
## Technical Details
- **Type:** Technique / Electronic Warfare Tooling
- **Platform:** Satellite Communication (SATCOM) infrastructure; specifically the SpaceX Starlink constellation and associated Ground User Terminals.
- **Capabilities:** Signal interference, frequency jamming, and denial-of-service (DoS) at the physical layer of satellite communications.
- **First Seen:** While electronic warfare has been constant, this specific concerted campaign against mid-strike drone links was highlighted in reports around July 2024 (and noted in future-dated 2026 reporting).
## MITRE ATT&CK Mapping
- **[TA0040 - Impact]**
- **[T1491 - Communication Impairment]**
- **[T1499.003 - Endpoint DoS: Service Impairment]** (Specifically targeting the terminal's ability to sync with the satellite)
- **[TA0009 - Collection]**
- **[T1602 - Data from Information Repositories]** (Interference with data flow)
## Functionality
### Core Capabilities
- **Frequency Saturation:** Blasting high-power radio frequency (RF) noise on the specific Ku-band and Ka-band frequencies used by Starlink to drown out legitimate signals.
- **Link Severance:** Disrupting the handshaking process between the ground drone-mounted terminal and the satellite, preventing the drone from receiving pilot commands or transmitting telemetry.
- **Logistical Interdiction:** Targeting "mid-strike" drones used for attacking fuel storage, air-defense systems, and command centers.
### Advanced Features
- **Mobile Deployment:** Installation of jamming systems on mobile units to protect moving convoys ("camouflaged cargoes").
- **Targeted Interference:** Attempts to specifically identify and jam the phased-array signals inherent to Starlink's sophisticated beamforming technology.
## Indicators of Compromise
*Note: Indicators for EW are typically signal-based rather than file-based.*
- **Behavioral Indicators:**
- Sudden loss of GPS/GNSS signal synchronization (often used in tandem with jamming).
- Unexplained high latency (ping spikes) followed by total loss of signal (LOS).
- "No Satellites in View" errors on Starlink user interfaces despite clear sky visibility.
- Systematic failure of mid-strike drones at specific geographic "bubbles" or buffer zones around Russian assets.
## Associated Threat Actors
- **Russian Armed Forces** (Electronic Warfare units)
## Detection Methods
- **Spectrum Analysis:** Real-time monitoring of the RF spectrum to identify abnormal power spikes in the satellite communication bands.
- **Telemetry Monitoring:** Monitoring drone flight logs for patterns of "Signal Lost" events that correlate with proximity to specific Russian defensive perimeters.
- **Geospatial Correlation:** Mapping successful vs. unsuccessful strikes to identify active "black zones" where jamming is concentrated.
## Mitigation Strategies
- **Hardening Recommendations:** Implementing protective shielding on Starlink terminals to block ground-level interference while maintaining a vertical line of sight to the sky.
- **Frequency Hopping/Agility:** Software updates to allow terminals to switch between different satellite beams or frequencies more rapidly.
- **Inertial Navigation:** Supplementing Starlink/GPS-based flight with inertial navigation systems (INS) to allow drones to maintain course even when the data link is severed.
## Related Tools/Techniques
- **GNSS Spoofing:** Manipulating GPS signals to provide false location data to drones.
- **Pole-21:** A Russian electronic warfare system known for jamming satellite navigation signals over large areas.
- **Borey-1:** Specialized systems used to intercept and disrupt satellite-based communications.