Starlink arson in Europe linked to Russian intelligence and Daltonlar mafia

Series of sabotage acts against satellite network

Over 25 days, Starlink infrastructure was attacked in three European Union countries: Poland, Bulgaria and Lithuania. Polish counterintelligence (ABW) determined that the sabotage acts were linked to the activities of Russian intelligence services. During the investigation, it was possible to establish contacts between suspects who operated in the territory of different states, and the trail led to the Turkish criminal group Daltonlar.

Chronology of incidents in Poland and arrest of perpetrators

On 23 September 2026, two masked individuals set fire to a Starlink station in the village of Wola-Krobowska near Warsaw. The direct attack lasted three minutes, but extinguishing the fire took more than six hours. According to ABW, the perpetrators arrived in Poland from Germany and returned there after committing the crime.

On 12 October, two Turkish citizens were detained in the city of Nürtingen (Germany): 38-year-old Yumit E. and 34-year-old Müslüm T. They are charged with sabotage and acting in the interests of foreign intelligence under Articles 130 § 7 and 163 § 1 of the Polish Penal Code. The investigation used the results of DNA analysis, fingerprints and video recordings.

In addition, on 30 September, a suspected intelligence officer was detained who was sending photographs of the facility's security via the Telegram messenger.

Attacks in Bulgaria and Lithuania

On 9 October, eight of 18 Starlink antennas were set on fire near the Bulgarian village of Plana. Three antennas were completely destroyed, two were partially burnt, and three more sustained damage. The suspects entered Bulgaria from Serbia in a Volkswagen car with German number plates and left the country that same night.

On 23 October, 19-year-old Islam Zeku and Beytullah Tirpan, who hold dual citizenship, were detained in Duisburg (Germany). They face a sentence of imprisonment for a term of three to 12 years.

On 18 October at 02:30, an antenna on the premises of the Delska company in Vilnius sustained fire damage. Security managed to contain and extinguish the fire. On 29 October, Lithuanian police reported that they suspect the same pair, who were detained in Germany, in this attack. They were charged under Articles 249¹, 250⁶ and 250 of the Penal Code regarding terrorism. Germany is considering requests for the extradition of the suspects.

Daltonlar leader under Russian protection

The probable leader of the Daltonlar group, Beratjan Gökdemir, known by the pseudonym Can Dalton, is in Russia. On 21 November 2024, he was detained in Moscow on an Interpol red notice, but was not extradited to Turkey. Initially, he faced 32 years in prison, and in other cases involving murders and armed attacks — 1,281 years in prison and two life sentences, ARD reports.

On 25 June 2026, Turkish Justice Minister Akın Gürlek again appealed to Russian Prosecutor General Alexander Gutsan with a request to extradite Gökdemir. A representative of Daltonlar told ARD that the group's leader runs it from a protected house provided by the Russian authorities. Journalists also found greetings addressed to him from participants in the war against Ukraine on the side of Russia.

In Berlin, Daltonlar is associated with extortion. In particular, there is a known case where 250,000 euros was demanded from the owner of a supermarket chain, after which two stores were shot at.

Mass arrests in Turkey

On 27 October, Turkish police conducted raids against Daltonlar in 30 provinces. According to data as of 30 October, 89 people were detained, including 35 minors. For 52 of the detainees, a preventive measure in the form of arrest was requested. Law enforcement officers seized six pistols and three shotguns.

Young people were recruited through social media, and tasks were distributed in WhatsApp groups named Dalton Kardeşler. On 6 October, as part of a separate case, 26 people were detained in 14 provinces.

While European investigators are establishing the masterminds behind the attacks on Starlink infrastructure, the probable head of the Daltonlar criminal network remains in Russia.