Ukrainian Hackers Trick Russian Troops Into Revealing Starlink Coordinates

Russian soldiers began seeking Ukrainians willing to register their terminals for payment. The 256 Cyber Assault Division created a Telegram channel that posed as a criminal service offering to register Russian Starlinks as Ukrainian in exchange for cryptocurrency.

Operators used an AI chatbot to collect information in stages, beginning with serial numbers and ending with requests for GPS coordinates. The data revealed the locations of Russian headquarters, command posts and drone operator positions. The hackers provided the coordinates to Ukraine’s Ministry of Defence and directly to brigades operating in the relevant areas.

Yaro’s unit received one such set of coordinates. After mapping them against reconnaissance imagery, the officer identified a sheltered position marked by fresh tracks and rubbish. A strike drone later hit the structure. Camera footage from the drone showed a satellite dish on the roof, angled toward a neighbouring village rather than the sky.

Russian forces have since begun using Starlink dishes to create wifi bridges between units. The tactic enables communications but also makes positions easier for Ukrainian forces to identify. Yaro said Russian troops often remain in compromised locations because the soldier who provided the coordinates is reluctant to report the mistake or because movement near the front line is difficult.

Katerina, a 24-year-old drone pilot with the brigade who is four months pregnant, launches heavy bomber drones toward Russian positions daily. She joined the armed forces after her village was liberated in the first year of the war. During the week a Times reporter visited the 128th Brigade, drone strikes continued at a high pace with new targeting information arriving daily.

The 256 Cyber Assault Division consists of civilian cyber specialists. Hackers operating under call signs including Chester, Goldfinger, Scott and Chris gathered the Starlink data. The information was used both for immediate strikes and to build a broader picture of Russian deployments in the Zaporizhzhia, Donbas and other sectors where Ukrainian forces have faced pressure.

Russian advances were reported near Hulyaipole and in the Donbas cities of Pokrovsk, Myrnohrad and Lyman at the time the operation began. The loss of Starlink occurred at the end of an intense period of Russian bombing and winter blackouts.