Ukrainian Hackers Trick Russian Troops Into Revealing Starlink Coordinates

Ukrainian hackers have tricked Russian soldiers into revealing the GPS coordinates of more than 2,600 Starlink satellite receivers that had been smuggled into Russia for use on the battlefield. The receivers, brought in via Central Asia, Turkey and the Middle East, allowed Russian forces to control attack drones over longer ranges with greater accuracy and to use real-time battlefield mapping.

The operation unfolded in early February as Russian units attempted to infiltrate Ukrainian positions near Zaporizhzhia under cover of fog and poor weather. Russian troops had advanced to within 12 miles of Zaporizhzhia city after moving through the Kakhovka floodplain.

Yaro, an intelligence officer with the 128th Heavy Mechanised Brigade fighting near the village of Plavni, said the enemy was attempting to move infantry between Ukrainian positions during periods of poor weather. Access to Starlink had become important for Russian operations.

"Since 2025 they started to use Starlinks to control their big drones and give a higher precision for the attacks, give them an advantage to bypass our anti-drone systems," said Goldfinger, a wounded soldier turned hacker for Ukraine’s 256 Cyber Assault Division.

Kyiv asked SpaceX to require registration for Starlink terminals used in Ukraine. The company required users to visit an authorised service centre in unoccupied territory and present a passport. Unregistered devices were then blocked, leaving Russian units without the service they had come to rely on.

Russian soldiers began seeking Ukrainians willing to register their terminals for payment. The 256 Cyber Assault Division created a Telegram channel that posed as a criminal service offering to register Russian Starlinks as Ukrainian in exchange for cryptocurrency.

Operators used an AI chatbot to collect information in stages, beginning with serial numbers and ending with requests for GPS coordinates. The data revealed the locations of Russian headquarters, command posts and drone operator positions. The hackers provided the coordinates to Ukraine’s Ministry of Defence and directly to brigades operating in the relevant areas.

Yaro’s unit received one such set of coordinates. After mapping them against reconnaissance imagery, the officer identified a sheltered position marked by fresh tracks and rubbish. A strike drone later hit the structure. Camera footage from the drone showed a satellite dish on the roof, angled toward a neighbouring village rather than the sky.

Russian forces have since begun using Starlink dishes to create wifi bridges between units. The tactic enables communications but also makes positions easier for Ukrainian forces to identify. Yaro said Russian troops often remain in compromised locations because the soldier who provided the coordinates is reluctant to report the mistake or because movement near the front line is difficult.

Katerina, a 24-year-old drone pilot with the brigade who is four months pregnant, launches heavy bomber drones toward Russian positions daily. She joined the armed forces after her village was liberated in the first year of the war. During the week a Times reporter visited the 128th Brigade, drone strikes continued at a high pace with new targeting information arriving daily.

The 256 Cyber Assault Division consists of civilian cyber specialists. Hackers operating under call signs including Chester, Goldfinger, Scott and Chris gathered the Starlink data. The information was used both for immediate strikes and to build a broader picture of Russian deployments in the Zaporizhzhia, Donbas and other sectors where Ukrainian forces have faced pressure.

Russian advances were reported near Hulyaipole and in the Donbas cities of Pokrovsk, Myrnohrad and Lyman at the time the operation began. The loss of Starlink occurred at the end of an intense period of Russian bombing and winter blackouts.