Bulgarian authorities have issued European arrest warrants for two 19-year-old German citizens suspected of carrying out a targeted sabotage operation against satellite communications infrastructure outside Sofia. The legal move, confirmed on Monday, comes amid growing alarm across Europe over suspected Russian-directed attacks against commercial and dual-use logistics supporting Ukraine’s defense.
The Sofia City Court formally granted prosecutors’ requests for the warrants after reviewing investigative findings related to an arson attack that damaged a vital satellite antenna array. In its ruling, the court determined that the evidence gathered by state investigators established clear and reasonable grounds to suspect that the two German teenagers carried out the operation.
The targeted equipment forms part of the ground-level infrastructure supporting the Starlink satellite network operated by SpaceX. Ukraine’s armed forces have relied heavily on the constellation throughout Russia’s full-scale invasion, utilizing Starshield—a dedicated, military-grade iteration of the satellite communication system—to maintain resilient command, control, battlefield coordination, and tactical intelligence in areas where conventional cellular and fiber-optic networks have been obliterated or systematically jammed.
While Bulgaria does not share a direct land border with Ukraine, its strategic location on the western rim of the Black Sea places it squarely within the broader theater of regional instability sparked by Moscow’s war. Intelligence and security services throughout Eastern Europe and NATO member states have spent months warning that critical infrastructure located far behind the actual front lines is increasingly being singled out by covert operators seeking to disrupt Kyiv’s vital communication channels.
The Bulgarian warrants follow an almost identical case in Poland, where a separate arson attack against satellite communications equipment triggered a multinational investigation and multiple arrests across Germany, underscoring an expanding pattern of synchronized disruptions across the continent.
What do we know about the incident in Bulgaria?
The Bulgarian investigation centers on an incident that unfolded on the evening of October 9 in a remote, high-altitude location in the mountains south of the capital, Sofia. The installation in question housed an array of 18 satellite antennas configured to facilitate high-speed data transmission and maintain reliable orbital linkups.
According to prosecutors, the two teenage suspects deliberately set fire to the communications hardware under the cover of darkness. The blaze tore through multiple units before emergency personnel could contain it. Of the 18 antennas operating on the premises, three were completely incinerated, two suffered severe burn damage, and three others sustained varying degrees of structural and electrical impairment. In total, nearly half of the installation’s operational capacity was directly impacted by the flames.
Evidence compiled by Bulgarian border officials and law enforcement indicates that the operation was executed with a high degree of speed and calculated logistical planning. Investigators established that the two suspects entered Bulgarian territory from neighboring Serbia, traveling in a private passenger vehicle bearing German registration plates.
Upon crossing the frontier, the young men presented themselves as ordinary tourists embarking on a routine visit. However, surveillance and border records revealed that the pair remained in the country for only a matter of hours—arriving shortly before the blaze was ignited and departing Bulgarian jurisdiction immediately after the installation was set on fire. The swift transit in and out of the country indicated to authorities that the perpetrators operated with advance reconnaissance and a predetermined extraction route.
Plamen Tonchev, the head of the State Agency for National Security (DANS), Bulgaria’s domestic counterintelligence and security service, publicly confirmed that the agency is treating the fire not as an isolated act of vandalism, but as a deliberate act of hostile sabotage. Tonchev cautioned that the incident south of Sofia could represent an opening salvo rather than an isolated anomaly, warning that further covert attacks against communications and transport nodes within Bulgarian territory cannot be ruled out as regional tensions persist.
The geopolitical dimension of the incident has placed Bulgarian authorities on high alert. The Black Sea region remains one of the primary arenas of the wider Russia-Ukraine conflict, serving as a corridor for drone strikes, naval operations, and military logistics. Despite maintaining formal diplomatic ties with Moscow and historically complicated domestic political alignments, Bulgaria has progressively integrated its defense and security framework into collective Western defense initiatives, making its national infrastructure a potential target for asymmetric retaliation.
What is the potential tie-in to a Polish sabotage case?
The warrants issued in Sofia arrived just one week after law enforcement agencies in Germany and Poland disrupted what officials described as a mirror operation aimed at Starlink infrastructure hundreds of miles to the north.
In late September, an arson attack was launched against a major Starlink satellite communications station situated in central Poland, a nation that borders Ukraine directly and serves as the primary conduit for Western military, humanitarian, and logistical assistance flowing into the war zone. Following rapid intelligence-sharing between Warsaw and Berlin, German police carried out an operation early last week that resulted in the detention of four individuals suspected of direct involvement in the Polish attack.
The four suspects rounded up by German federal authorities consisted of three men and one woman residing in Germany, two of whom held Turkish nationality. The group is accused of acting on instructions to physically disable satellite communications critical to regional connectivity.
Polish authorities did not hesitate to identify what they viewed as the ultimate sponsor of the operation. Polish Prime Minister Donald Tusk denounced the attack as a brazen manifestation of "hybrid warfare" orchestrated by the Russian Federation. Tusk and Polish defense planners have repeatedly emphasized that conventional military operations in Ukraine are being systematically paired with non-linear destabilization tactics aimed at NATO rear areas, including cyber warfare, disinformation, targeted arson, and infrastructure sabotage.
Crucially, Polish intelligence officials noted that Moscow’s intelligence apparatus appeared to have adjusted its operational methodology. Rather than deploying trained, official intelligence officers whose movements are heavily tracked by European security services, Russian agencies have increasingly turned to contracting proxies, including elements drawn from organized crime networks operating inside Germany and elsewhere in Western Europe. Security analysts observe that this outsourced model relies on disposable operatives—often motivated by financial payouts or recruited via digital channels—to execute high-risk physical attacks while affording their handlers plausible deniability.
The thread connecting the Sofia and Polish operations points toward an increasingly coordinated, trans-European campaign targeting commercial satellite providers whose technology supports the Ukrainian defense apparatus. Just days before the Bulgarian court issued its arrest warrants, another Baltic leader signaled identical concerns. In Lithuania, the prime minister publicly declared that Russian intelligence services were almost certainly behind a recently thwarted arson plot directed at a commercial enterprise hosting communication hardware deployed for Starlink satellite relays.
For European security and counterintelligence agencies, the convergence of incidents in Bulgaria, Poland, and Lithuania reveals a concerted effort to locate and exploit physical vulnerabilities in distributed digital networks. While satellite constellations like Starlink orbit hundreds of miles above the Earth, immune to direct conventional assault by non-state actors, their functionality depends entirely on physical ground stations, uplinks, power feeds, and maintenance nodes scattered across civilian landscapes in allied nations.
European authorities are now working to determine whether the two German teenagers sought by Sofia were recruited through the same criminal pipelines or social media vectors identified in the Polish investigation. As the European arrest warrants move through Interpol and international judicial channels, security officials across the European Union face the mounting challenge of safeguarding thousands of decentralized, dual-use communication assets against a covert campaign of hybrid warfare that continues to spread across state borders.