Full Report
A Turkish criminal group known as the Daltons is suspected of involvement in the Sept. 23 arson attack on a Starlink satellite communications ground station in…
Analysis Summary
# Incident Report: Arson Attack on Starlink Ground Station, Wola Krobowska, Poland
> **Note on scope:** This was a physical arson attack, not a cyber intrusion. Fields that apply to network intrusions (malware, credential theft, lateral movement, network IOCs) are marked as not applicable. Attribution in the source is based on unnamed security sources and press reporting, and has not been confirmed by a court.
## Executive Summary
On September 23, 2026, a fire was set at a Starlink satellite communications ground station in Wola Krobowska, Masovian Voivodeship, Poland. Polish officials describe it as a deliberate act of sabotage that engulfed the power station and generator in an attempt to cut internet service to institutions, including Ukrainian military users. Per Polish officials, the station was not knocked out of service. In October, German authorities detained two Turkish nationals at Poland's request, and reporting links the attack to the Turkish criminal group known as the Daltons, possibly acting on behalf of Russian intelligence.
## Incident Details
- **Discovery Date:** September 23, 2026 (fire response; exact time not disclosed)
- **Incident Date:** September 23, 2026
- **Affected Organization:** Starlink ground station operator (not named); downstream users include Ukrainian military communications
- **Sector:** Satellite communications / critical telecommunications infrastructure
- **Geography:** Wola Krobowska village, Masovian Voivodeship, Poland (near Warsaw)
## Timeline of Events
### Pre-Incident Context
- **Months before:** German government and security officials warned that Moscow could use organized crime groups for sabotage in Europe.
### Initial Access (Physical)
- **Date/Time:** September 23, 2026 (exact time not disclosed)
- **Vector:** Physical access to the site. How perpetrators reached the facility is not public.
- **Details:** Perpetrators set a fire at the power station and generator, the apparent aim being to disable the station.
### Lateral Movement
- Not applicable. The attack was localized to the site's power infrastructure.
### Impact
- **Affected:** Power station and generator damaged by fire.
- **Service:** Internet connectivity disruption for dependent institutions was the intended effect. Officials state the station was not taken out of service.
### Detection & Response
- **Detection:** Fire at the site, followed by Polish authorities treating it as sabotage.
- **September 24:** Polish officials publicly suspected sabotage. Deputy Prime Minister Krzysztof Gawkowski made the statement.
- **October 12:** Two Turkish citizens, Ümit E. (38) and Müslüm T. (34), were detained in Baden-Württemberg, Germany, at Poland's request. Polish authorities suspect their involvement.
- **October 12:** Bulgarian authorities reported a separate incident in which unidentified people set fire to Starlink antennas about 20 km outside Sofia. Reporting does not establish a confirmed link to the Polish attack.
## Attack Methodology
- **Initial Access:** Physical access to the site (method not disclosed)
- **Persistence:** Not applicable
- **Privilege Escalation:** Not applicable
- **Defense Evasion:** Not disclosed
- **Credential Access:** Not applicable
- **Discovery:** Not disclosed. Target selection and pre-attack surveillance are unknown.
- **Lateral Movement:** Not applicable
- **Collection:** Not applicable
- **Exfiltration:** Not applicable
- **Impact:** Arson targeting power and generator systems to cause a service outage
## Impact Assessment
- **Financial:** Not disclosed. Equipment and repair costs are unknown.
- **Data Breach:** None reported.
- **Operational:** Disruption of internet connectivity for dependent users was the intended effect. The station was reportedly not taken out of service, and the extent of actual downtime is unclear.
- **Reputational:** Heightened public and governmental attention to the vulnerability of satellite ground infrastructure and to Russian hybrid operations in Europe.
## Indicators of Compromise
- **Network Indicators:** None reported (physical incident)
- **File Indicators:** None reported
- **Physical/Behavioral Indicators:**
- Fire set at power station and generator
- Use of a criminal proxy for sabotage (reported, unconfirmed)
- Suspects' movement across borders (Poland to Germany, per reporting)
- Similar arson pattern at a Starlink facility in Bulgaria (reported, not confirmed as linked)
## Response Actions
- **Containment:** Fire response and site securing by Polish authorities. Specific measures not detailed.
- **Eradication:** Not applicable in the traditional sense. Repair or replacement of damaged power and generator equipment is implied but not described.
- **Recovery:** Not disclosed. Officials state the station remained operational.
- **Investigation:** Polish-led investigation with German cooperation, which resulted in the October 12 detentions. Bulgarian authorities are investigating a separate arson.
## Lessons Learned
- **Power infrastructure is a single point of failure.** The attack targeted the power station and generator, showing that loss of power can disable a site regardless of the satellite link.
- **Criminal proxies lower the cost of hybrid sabotage.** Reporting suggests a state actor may have used a criminal group, which complicates attribution and deterrence.
- **Cross-border cooperation worked.** Detentions in Germany at Poland's request show that European law enforcement coordination can yield results within weeks.
- **Warnings preceded the incident.** Officials had flagged the risk months earlier, suggesting that threat intelligence was not translated into site-level hardening in time.
- **What could have been done better:**
- Perimeter security and intrusion detection at remote sites
- Fire detection and automatic suppression for generator and power systems
- Redundant power and geographic diversity so one site's loss does not cut service
- Faster public communication to dispel uncertainty about impact
## Recommendations
1. **Physical security:** Harden perimeters with fencing, motion sensors, CCTV with remote monitoring, and access logging. Consider guard patrols for critical satellite ground stations.
2. **Fire protection:** Install early-warning fire detection and automated suppression in power and generator enclosures, and keep them physically separated where feasible.
3. **Redundancy:** Provide backup power (e.g., dual generators, batteries) and redundant ground stations so that a single arson does not interrupt service for critical users.
4. **Insider and contractor vetting:** Review staffing, maintenance, and subcontractor access, since outsiders may have used local knowledge or access.
5. **Threat intelligence integration:** Translate government threat warnings about state-directed sabotage into specific site risk assessments and funded mitigations.
6. **Cross-border information sharing:** Maintain channels among operators, national police, and intelligence services across the EU and with allied states.
7. **Monitoring for patterns:** Track arson incidents at similar infrastructure (such as the reported Bulgarian case) to identify campaigns early.
8. **Incident communications plan:** Prepare public statements that clearly state service impact, since ambiguity about whether the station was disabled fuels speculation.