SBU Detains Two in Lviv Over 14 Starlink Terminals

By John Maximus · Published 22 September 2026
Reported from named sources and checked against the publishers linked in this article. Corrections: editorial and corrections policy.

The Security Service of Ukraine (SBU), the country’s main counter-intelligence agency, has detained two men in Lviv who it says illegally registered 14 Starlink satellite terminals for Russian forces. The detentions were reported on 21 September 2026 by antikor and on 22 September by ukrmedia, both citing the SBU.

According to the SBU as relayed by both outlets, Russian troops used those communication systems to plan combat operations in the Donetsk, Kherson and Zaporizhzhia regions. ukrmedia says the planning was directed against Ukraine’s Defence Forces.

Key facts

• SBU counter-intelligence detained two men in Lviv, both reports say.
• The pair are suspected of illegally registering 14 Starlink terminals for Russian armed groups.
• The SBU says all of the illegally registered systems have been blocked.
• The terminals were used by Russian forces to plan operations in three Ukrainian regions, according to the agency.
• Investigators are also checking whether the same two men registered dozens of further terminals.

Why it matters

The case is not about hardware smuggling as described by either outlet, but about account registration: ukrmedia reports that the suspects used other people’s passport details for device verification, then handed the details to a Russian supervisor once the terminals were activated. Readers who buy, sell or hand over kit will recognise the paperwork involved — the same identity and billing details that govern how Starlink accounts are paused, transferred and cancelled.

The SBU’s stated remedy was to block the accounts rather than the dishes themselves. The agency says every one of the 14 illegally registered systems has been switched off in this way.

How the SBU says the scheme worked

Both reports describe the same chain of recruitment. antikor writes that “One of the suspects turned out to be a Lviv student recruited by Russian special services.” ukrmedia adds that Russian security services approached him while he was looking for “easy” money on Telegram channels; antikor says only that he had begun looking for easy ways to make money online.

The student then brought in an unemployed acquaintance from Lviv, according to both outlets. ukrmedia says the acquaintance helped find people to set up payment terminals. Together, the two searched for individuals whose passport data could be used to register the satellite terminals.

The investigation established that the pair fraudulently recruited 14 people for that purpose, both reports say. After the devices were activated, the suspects passed the necessary details to their Russian handler and were paid in return.

Arrests, charges and custody

ukrmedia reports that counter-intelligence documented the activities of both men and arrested them at their homes, seizing mobile phones during the searches that the security service says were used to coordinate with the enemy.

Both outlets say the detainees have been charged with aiding the aggressor state, committed by a group of persons by prior conspiracy, and that they are in custody without the right to bail. ukrmedia states that the investigation is continuing.

The open question: 40 more terminals

The two reports diverge slightly on the scale of what is still being examined. ukrmedia says information is being verified regarding the possible illegal registration by these individuals of a further 40 satellite communication terminals. antikor says law enforcement officers are checking information about the possible registration of more than 40 additional terminals.

Neither report says whether any of those additional terminals has been located or blocked, and neither gives a timeline for that part of the inquiry.

What the sources do not say

Neither outlet names the two suspects, gives their ages, or states how much they were paid by the Russian handler. Neither report describes how the terminals physically reached Russian units, nor does either say whether SpaceX, the operator of the Starlink network, was involved in identifying or blocking the accounts.

There is also nothing in either report about how the 14 people whose passport details were used will be treated by the investigation. Both stories stop at the detention of the two men and the blocking of the terminals.

Background

Satellite terminals registered in one country but operated in another are a recurring theme in wartime reporting, and Moscow has been pursuing its own low-Earth-orbit programme — Russia’s own Starlink rival, Rassvet, has been covered separately on this site. For buyers in any market, the identity and verification steps at the centre of this case are the same ones that apply to second-hand kit and the checks that go with it.

The SBU has not published a figure for how many terminals it has blocked in total, and neither of the two reports used here attempts one. This article will be updated if the agency releases further detail on the 40 terminals still under review.

Frequently Asked Questions

What sentence do the two suspects face?

Both outlets report that the men face up to 12 years in prison with confiscation of property. According to ukrmedia, they are being held in custody without the right to bail while the investigation continues.

Which articles of Ukraine’s Criminal Code were used?

ukrmedia reports that the detainees were notified of suspicion under Part 2 of Article 28 and Part 1 of Article 111-2 of the Criminal Code. It describes the offence as aiding an aggressor state, committed by a group of individuals acting in collusion.

What did investigators seize from the suspects?

According to ukrmedia, counter-intelligence officers documented the pair’s activities and arrested them at their homes. During the searches, mobile phones were seized that the security service says the suspects had used to coordinate with the enemy.

Do the two reports agree on how many extra terminals are being checked?

They are worded differently. ukrmedia says information is being verified about the possible illegal registration of a further 40 satellite communication terminals, while antikor says law enforcement is checking the possible registration of more than 40 additional terminals.