SBU detains alleged Russian agent accused of registering 27 Starlink terminals for Moscow’s troops

Ukraine’s Security Service, the SBU, says it has detained a man in Kharkiv Oblast who is suspected of helping Russian forces regain access to Starlink for battlefield use. According to the agency, the suspect registered 27 Starlink terminals in the front-line city of Izium and passed the access details to Russian handlers.

Investigators believe the terminals were intended to support Russian combat operations in the region, including coordination of assault groups and drone strikes. The case highlights how satellite internet has become a critical part of modern warfare, especially for command, communications, and unmanned systems operating near the front.

Since February, Ukraine and SpaceX have tightened controls on Starlink access in the country, limiting service to verified terminals. Those restrictions were designed to block Russian use of the network for military communications and drone missions. Ukrainian officials have said the changes reduced Moscow’s ability to rely on Starlink on the battlefield and supported Ukrainian operations in areas including Zaporizhzhia and Dnipropetrovsk oblasts.

The SBU says Russian forces responded by trying to work around the verification system through local intermediaries. In this case, investigators allege that Russian intelligence recruited a Ukrainian citizen to activate terminals on their behalf.

The suspect is described as an unemployed internally displaced person from Khrustalnyi, a city in Luhansk Oblast that is under Russian occupation. After relocating to Izium, he allegedly searched Instagram for opportunities to make money and was then contacted by Russian intelligence operatives, according to the SBU.

The agency says he initially registered a single Starlink terminal in his own name and transferred the account credentials to a Russian handler located in occupied eastern Ukraine. After that, he was allegedly instructed to verify more terminals and to enlist local residents to help register the equipment.

In total, investigators say 27 Starlink units were processed through the scheme. The SBU also alleges that the man was tasked with collecting coordinates of Ukrainian military positions so they could be used for Russian targeting.

According to the agency, the suspect expected that after completing the assignments he would be evacuated to occupied Luhansk Oblast. Ukrainian authorities have not publicly detailed what charges he may face, but the detention fits a broader pattern of alleged Russian intelligence activity inside Ukraine.

Officials say Moscow has repeatedly tried to recruit Ukrainians for intelligence gathering, strike coordination, and sabotage. In some cases, recruitment reportedly relies on direct payments or online “easy money” offers. In others, investigators say, people are pressured through threats, coercion, or blackmail, particularly if they live in occupied territory or have relatives in captivity.

The Starlink angle is especially notable from a technology and security standpoint. What began as a vital communications tool for civilian resilience and Ukrainian defense has also become a contested digital asset. Access control, identity verification, and hardware registration are now as strategically important as the terminals themselves.

The incident also illustrates a recurring challenge for platform operators and national security agencies: even when systems are locked down technically, adversaries may shift to social engineering. Rather than hacking the network, they seek out people who can be persuaded or pressured into legitimizing access.

This is not the first recent SBU announcement involving alleged Russian recruitment inside Kharkiv Oblast. On March 13, the agency said it had detained another suspect accused of helping prepare an attack on Andrii Biletskyi, commander of Ukraine’s 3rd Army Corps. In that case, the individual was described as a drone operator in a Ukrainian brigade who was allegedly recruited through his ex-wife living in occupied Zaporizhzhia Oblast.

As the war continues, Ukraine’s counterintelligence battle increasingly overlaps with commercial technology infrastructure. Cases like this one show how satellite internet, identity systems, and local civilian networks can all become part of the conflict.