Loading story…
European security and satellite-industry officials are warning that Russian “inspector” satellites Luch-1 and Luch-2 have been conducting sustained proximity operations in geostationary orbit (GEO) near high-value European government and commercial communications satellites, raising concerns about signals intelligence collection, surveillance, and potential interference. Reporting based on orbital tracking data indicates Luch-2 has approached or “visited” at least 17 GEO satellites serving Europe since its 2023 launch, with activity focused on operators tied to NATO countries; analysts assess that by positioning within uplink/downlink beam paths, a nearby spacecraft could potentially capture transmitted signals or at minimum characterize usage patterns and emissions.
Satellite-tracking firms cited in the reporting (including Slingshot Aerospace and France-based Aldoria) describe the Luch vehicles as maneuvering and “parking” close to target satellites for months at a time; one example given is Luch-2 operating in proximity to Intelsat 39. Beyond passive collection, observers note the same maneuvering and thruster capabilities could support more aggressive actions (e.g., nudging a satellite out of alignment), and that intelligence derived from monitoring could enable follow-on ground-based jamming or hacking by identifying users and locating ground terminals. Analysts also point to Russia expanding similar reconnaissance capabilities with newer satellites (e.g., Cosmos 2589 and Cosmos 2590), while suggesting Luch-1 may no longer be functional based on recent observations.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
An IISS report cited by The Guardian alleged that Russia used hundreds of drones launched from shadow-fleet vessels to surveil nuclear facilities, military bases, and other strategic infrastructure across more than 12 European countries. The report said over 140 drones were observed near sensitive sites, exposing NATO air-defense gaps against low-cost, low-altitude drones.
In response to the reported Russian satellite activity, governments and satellite operators increased space domain awareness efforts, discussed norms for proximity operations, and considered technical defenses such as stronger encryption, adaptive antennas, and more resilient LEO architectures.
UK Space Command reported ongoing jamming attempts targeting British military satellites, underscoring broader concerns about Russian counterspace activity beyond surveillance.
European security officials concluded that communications from more than a dozen European satellites may have been intercepted during sustained Russian proximity operations involving Luch-1 and Luch-2.
Since its March 2023 launch, orbital tracking data indicated Luch-2 approached at least 17 European government and commercial communications satellites in geostationary orbit.
Russian inspector satellite Luch-2 was launched in March 2023 and later became the focus of European security concerns over close-proximity operations in GEO.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
euronews.al
Open sourcetomshardware.com
Open sourcetechrepublic.com
Open sourcearstechnica.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A recently launched Chinese satellite passed within 200 meters of the Starlink-6079 satellite in low-Earth orbit, raising concerns about the risks posed by insufficient coordination between satellite operators. The incident occurred after a Long March 2D rocket launched nine satellites from the Jiuquan Satellite Launch Center in Northwestern China, with one of the payloads coming dangerously close to the Starlink satellite at an altitude of 560 km. Michael Nicolls, SpaceX's VP of Starlink Engineering, publicly confirmed the near-miss and emphasized the urgent need for improved sharing of satellite trajectory data to prevent future collisions. The close approach, which occurred at speeds exceeding 17,400 mph, highlights the growing congestion in low-Earth orbit, where Starlink alone operates approximately 8,000 of the estimated 12,000 active satellites. Both sources cite Nicolls' warning that most of the risk in space operations stems from a lack of coordination and deconfliction between operators, calling for systemic changes to avoid potentially catastrophic incidents in the future.
Jun 29, 2026
The UK Ministry of Defence reported a sharp increase in **drone sightings near British military bases**, citing **266 incidents** last year versus **126 in 2024**, and linked the trend to concerns about hostile reconnaissance of sensitive defence sites, including airbases used by the **US Air Force**. In response, the UK government is moving to expand authorities under the **Armed Forces Bill** so designated military personnel can directly intervene against threatening uncrewed systems—covering **air, land, and submersible drones**—without first requiring police involvement. In Ukraine, **SpaceX and Ukrainian authorities** implemented an **emergency measure** to disable **unauthorized Starlink terminals** being used to control Russian long-range drones, following reports that Russia continued leveraging Starlink-enabled connectivity for strikes deeper inside Ukraine. Ukrainian officials characterized the action as a temporary fix that may also disrupt some legitimate users, while SpaceX and Ukraine pursue a more durable approach to prevent unauthorized use of the satellite service in contested environments—highlighting how **commercial communications infrastructure** is being exploited as part of drone-enabled warfare and broader hybrid threats across Europe.
Jul 3, 2026
Slovak authorities disrupted a planned arson attack against a Skyeton drone-manufacturing facility near Prešov that produces unmanned systems for Ukraine’s military. In Germany, authorities investigated suspected sabotage using improvised devices intended to short-circuit a substation connected to the Jänschwalde power complex, while Berlin publicly attributed a drone attack on Leipzig/Halle Airport to Russia and raised its threat assessment. The incidents indicate an escalation in suspected Russia-linked hybrid activity targeting European defense production, logistics, airports, and energy infrastructure supporting Ukraine. Russia is increasingly assessed to be using locally recruited criminal proxies—reportedly including recruits found via Telegram—as expulsions of intelligence personnel restrict operations conducted under diplomatic cover; affected organizations should incorporate physical-security, insider-risk, reconnaissance, and proxy-recruitment indicators into security programs.
Sep 23, 2026