No Return Address: Contship Jet Sinks as the Starlink Arson Trail Crosses Three Countries

Baltic Security Monitor | Analysis
Security Watch, 29 October 2026, 14:00 EET · 3 MATERIAL UPDATES (2 HIGH, 1 MODERATE) · 26 open investigations

The container ship hit by three sea drones off Bulgaria went down overnight, leaving 20 containers adrift, some loaded with lithium batteries and chemicals. On the same day Lithuania named two suspects in the attempted arson of Starlink equipment, and the trail led to Germany and Bulgaria. Investigators can find the people who carry out these attacks. Who gives the orders remains unproven.

The cycle in numbers

• Primary monitoring window: 29 October, 08:00–14:00 EET, with 24 hours of lookback
• MATERIAL UPDATES: 3, two rated HIGH and one MODERATE
• WATCH: 26 open investigations
• Uncertainty markers: 🟡 4 · 🔴 0

The Lithuanian Starlink case has been promoted from WATCH to MATERIAL.

Both of the day's main stories share one feature: the strike is recorded, the damage is counted, and the sender goes unnamed. In the Black Sea, the Bulgarian navy admits it had no forces close enough to intercept the drones. In Lithuania, police have found the perpetrators but not whoever hired them. For the Baltic states this is a familiar model of hybrid pressure, in which the forensic trail leads to the hands, not the head.

1. Contship Jet sinks, hazardous containers adrift

MATERIAL — HIGH · Black Sea / maritime security / environmental risk

The Liberian-flagged container ship Contship Jet, struck by three sea drones on 28 October about 21 nautical miles off the Bulgarian coast, sank during the night of 28–29 October. The loss was confirmed by Bulgaria's Maritime Administration and by the navy commander, Rear Admiral Kiril Mihaylov.

Of the 421 containers on board, 20 fell into the sea before the ship went down. According to the manifest, the cargo included lithium-ion batteries, corrosive liquids and acids, flammable liquids, ethanol solutions, household chemicals and plastics. The captain also mentioned various fuels.

Bulgaria's Environment Ministry is taking water samples at five points: Durankulak, Shabla, Cape Kaliakra, Byala and Sozopol. An initial inspection found no oil slicks or visible signs of pollution. The Maritime Administration does not currently expect significant damage to the sea or coastline, but final conclusions depend on laboratory results. Local shipping agents warn that the wreck and the drifting containers are a hazard to other vessels.

All 18 crew members, 14 Filipinos and four Ukrainians, had already been rescued on 28 October.

Rear Admiral Mihaylov said the origin of the drones is unknown because they "could have been launched from anywhere". He added that there were no forces or assets nearby that could reach the drones quickly enough to intercept and destroy them. Prime Minister Rumen Radev said the logic points to Russia, but "the problem is that we cannot prove it."

BSM analysis

The morning cycle covered the attack and the rescue. What is new is the consequence: a lost ship, cargo in the water and an environmental check off a NATO member's coast. This is not a new attack but an escalation of the fallout from a known one.

The key element is Mihaylov's admission. The navy commander says plainly that Bulgaria has no forces in its economic zone able to respond to a sea drone in time. A French patrol aircraft saw the strike, but no interceptor was within reach. The gap between detection and response described in the morning analysis is now confirmed at command level.

For the Baltic Sea there are two parallels. The first is the same response-time problem in economic zones crossed by shipping lanes and subsea cables. The second is environmental risk as a security dimension in its own right: a wreck carrying chemicals is a threat that outlasts the attack itself.

🟡 The drone operator and any actual pollution remain unconfirmed.

2. Lithuania names Starlink arson suspects as the trail leads to Bulgaria and Germany

MATERIAL — MODERATE · Hybrid threats / sabotage / critical communications infrastructure

Lithuanian police and prosecutors have identified two suspects in the attempted arson of Starlink equipment in Vilnius on 18 October. Unknown attackers tried to set fire to hardware stored by a Lithuanian company using Molotov cocktails and flammable liquid. The attempt failed. Prime Minister Mindaugas Sinkevičius said the authorities had warned the company in advance and stepped up security.

Both suspects are about 20 years old. One holds Turkish and German citizenship, the other Serbian and German. Both live in Germany, arrived in Lithuania the day before the attempt and left immediately afterwards. They are now in custody in Germany on European arrest warrants issued by Bulgaria in its own case over the burning of Starlink antennas.

On 27 October Vilnius prosecutors named them as suspects in offences including membership of a terrorist organisation, travel for terrorist purposes and an attempted terrorist act. According to Saulius Briginas, deputy head of Lithuania's criminal police, the men belong to a group linked to similar attacks in Bulgaria and Poland, where further arrests have been made. Warsaw suspects Russian sabotage behind a September fire at a Starlink ground station in Poland.

Lithuania had earlier described the attack as Russia-linked sabotage aimed at undermining Ukraine's military capability. Suspicion is not conviction, and Russian state involvement in these individuals' actions has not been proven.

BSM analysis

The case fits a pattern the region already knows. Young operatives with no ties to the target country are brought in for a single job and leave straight away. The Lithuanian, Bulgarian and Polish investigations are now linked, and that connection is the real news of the day.

The target is telling too. Starlink is a backbone of Ukraine's military communications, and the infrastructure supporting it sits in NATO countries. An attack on an equipment store in Vilnius is a strike on Ukrainian defence on Alliance soil.

Lithuania is treating the episode as terrorism, not simply arson. That opens up broader investigative tools and international cooperation. The next steps are extradition and an attempt to establish who coordinated the network.

🟡 Direct Russian state control over these suspects has not been proven.

WATCH: still under review

Estonia, bunkers in Ida-Viru County. Defence Minister Martin Herem told the Riigikogu on 28 October that around 150 bunkers are planned in Ida-Viru County as part of the Baltic Defence Zone. About 100 would stand on state land and the rest on municipal or private plots, for which compensation, leasing or purchase are being considered. This is planning detail, not a signed contract or completed construction.

Moscow, mass drone attack. Russia reports 1,214 Ukrainian drones intercepted nationwide, including 613 said to have been heading for Moscow. The scale and interception figures have not been independently confirmed.

Black Sea surveillance. Bulgaria is discussing deploying an additional surveillance system on 30 October. A planned system is not yet an operational capability, particularly given the navy commander's admission that interception assets are lacking.

Patriot / NASAMS. No new US approvals or interceptor deliveries have been confirmed. Britain's £500m air-defence package was covered in the morning analysis.

Conclusion

29 October produced two near-identical stories from different seas and different genres. In the Black Sea, drones sink ships and nobody intercepts them. In Lithuania, the arsonists are caught but the client stays in the shadows. At sea and on land, the strikes have an author but no proven address.

The next checks are the water test results off Shabla and Kaliakra, Bulgaria's decision on surveillance, the extradition of the suspects from Germany, and whether Lithuanian, Bulgarian and Polish investigators can reach the coordinator.

Hybrid war works because the operatives sign the job, not the people who ordered it.

Baltic Security Monitor (osint-baltic.com) — an analytical publication covering security on NATO's northeastern flank.
Security Watch cycle data is collected by an automated open-source monitoring system and independently verified.