Masked arson attack on Starlink site in Bulgaria exposes new vulnerability in Europe’s Ukraine lifeline
Two masked attackers set fire to 11 of 17 Starlink antennas at a secure site near Sofia that helps provide satellite communications to Ukraine and the EU, a Bulgarian MP says. The suspected sabotage hits a quiet but crucial link in Kyiv’s war network and raises questions about how well Europe can protect the infrastructure that keeps Ukrainian forces online.
A satellite ground site in Bulgaria that helps carry Starlink communications for Ukraine and European users has been hit by suspected arson, taking most of its antennas offline and exposing a new weak point in the continent’s support network for Kyiv.
Bulgarian lawmaker Ivaylo Mirchev said two unidentified individuals wearing masks broke into a secure site near Sofia and deliberately set fire to 11 of its 17 Starlink antennas. The equipment provides satellite internet connectivity, he said, and plays a role in routing traffic that includes Ukrainian military and civilian communications. Mirchev publicly criticized his own government for staying silent and questioned how the country is responding to what he described as likely Russian-linked sabotage.
There has been no immediate confirmation from Bulgarian security services, Starlink’s parent company SpaceX, or European Union institutions. Investigators have not publicly named suspects or offered forensic details from the scene. But if Mirchev’s account is accurate, the attack took out nearly two-thirds of the site’s operational antennas in a single blow.
For soldiers on the ground in Ukraine, Starlink terminals are more than tablets on tripods. They are the backbone of frontline connectivity, routing drone feeds, encrypted messages, logistics data, and basic calls home. While individual user terminals sit inside Ukraine, backbone infrastructure in countries like Bulgaria, Poland, and others ensures those signals can reach the broader internet and military command systems. Burning antennas near Sofia may not cut service entirely, but it adds a fragility that commanders and technicians now have to factor into their plans.
For European governments, the incident complicates an already sensitive discussion about critical infrastructure security. After the Nord Stream pipeline explosions and unexplained cable damage in the Baltic and Mediterranean, EU members have begun mapping and guarding energy and communications assets more aggressively. A successful attack on a satellite ground site – apparently executed with little sophistication beyond masks and accelerant – suggests that soft targets remain exposed even as navies and air forces focus on offshore threats.
The strategic stakes stretch beyond Ukraine. Starlink and similar constellations have become essential to disaster response, rural connectivity, and commercial operations across Europe. If attackers can intimidate operators or drive up insurance costs by torching antennas in EU member states, they gain a low-cost way to unsettle both wartime and peacetime communications.
The timing also intersects with growing friction over how Starlink is used in the war. Reports from Ukraine describe new speed restrictions on Starlink services that have forced the cancellation of some drone missions in Russian-occupied territory. Separately, analysts have described US-origin “StarShield” military packages facing new limits at high speeds, constraints linked to Pentagon decisions and, according to some commentary, influenced by Elon Musk’s political positioning on the conflict.
Taken together, software limits from the provider side and physical sabotage on the ground create a double squeeze on Ukraine’s most visible satellite lifeline. Kyiv’s forces and their Western backers now have to plan for both toggled-off service and burned-out antennas.
Key signs to watch next will include official Bulgarian statements, any move to label the attack as foreign-directed sabotage, and whether the EU or NATO expand their infrastructure protection efforts to explicitly cover satellite ground stations. If replacement antennas appear quickly and security around similar sites visibly tightens, the message will be that Europe understands these nodes as part of its own security perimeter, not just someone else’s war.
Sources
- OSINT