French and US maritime patrol planes are watching the western Black Sea, where drones keep hitting merchant ships, Romanian outlet Curs de Guvernare reported on 19 October, citing flight-tracking data. Romania blames Russia for the attacks, while Bulgaria says it cannot prove who launched them.

Ukraine’s three small Danube ports have kept its grain exports from collapsing further, and Russia has pounded those ports since the summer. The ships serving them are now being hit in the economic zones of two NATO members. Many were anchored near or heading to the Sulina Canal, which links the Danube to the sea. That puts the allied patrols over these waters in the middle of the fight over Ukraine’s grain trade.

Two patrol planes over the western Black Sea

A French Navy Atlantique 2 maritime patrol plane arrived in Constanța, Romania’s main Black Sea port, on the evening of 18 October, Curs de Guvernare said. On 24 October, French Foreign Minister Jean-Noël Barrot said in the Bulgarian port of Varna that a French patrol plane had been operating in the area under NATO for two weeks and had contributed to rescue operations.

Meanwhile, a US Navy P-8A Poseidon flew into Varna from Sicily on 18 October, AFP reported, citing flight-tracking data. Two days later, Bulgarian Prime Minister Rumen Radev said it had begun reconnaissance patrols after Sofia asked allies for help, and that some allies had responded quickly. Bulgarian Defense Minister Dimitar Stoyanov called the deployment a joint decision of Bulgaria and NATO. He said the plane cannot strike targets and passes its data to NATO, Anadolu Agency reported.

NATO promises more

On 20 October, NATO’s North Atlantic Council met at Romania’s request. Afterward, the alliance said it would send more maritime patrol aircraft, radar systems, and drones to the Black Sea. NATO military spokesman Col. Martin O’Donnell added that allies have sent or will send intelligence personnel and explosives-forensics teams. NATO itself has not attributed the attacks to any country.

Romania names Russia, Bulgaria hedges

Romania has been blunter. On 15 October, after four merchant ships were hit within a day, acting Foreign Minister Oana Țoiu wrote on X that “Russia bears full responsibility for these developments.” On 17 October, Romanian F-16s shot down two jet-powered Russian Geran drones near Sulina, Romania’s Defense Ministry said.

Unitățile aeriene și navale ale Gărzii de Coastă (GdC/MAI) și ale Inspectoratului General pentru Situații de Urgență (IGSU/MAI) sunt implicate activ în operațiunile de căutare și salvare, în vederea găsirii membrilor dați dispăruți ai echipajului navei care a fost atacată în…

— Toiu Oana (@oana_toiu) October 15, 2026

On 23 October, a drone sank the cargo ship Khoryv off Constanța, killing a Ukrainian sailor, and President Nicușor Dan blamed Russia too. “It is part of Russia’s escalation process in its war in Ukraine,” Dan said.

Bulgaria is more cautious. Radev told parliament on 14 October that the attacks worked in Russia’s favor but that Sofia could not prove it. Since taking office in May, he has sought a thaw in ties with Moscow.

A Russian drone strike sank the Comoros-flagged cargo ship Khoryv in the Black Sea near Romania’s port of Constanța on 23 October, killing a Ukrainian sailor and leaving three crew members missing. Nine others were rescued, Digi24 reported.

The sinking comes amid a surge in attacks on commercial shipping near Romania and Bulgaria, threatening civilian crews and routes used to transport Ukrainian agricultural exports. As Russia intensifies strikes on Ukrainian ports and shipping, the Danube corridor and nearby waters have become increasingly important to Ukraine’s maritime trade.

Romanian President Nicușor Dan blamed Russia for the attack, describing it as part of Moscow’s escalation of the war against Ukraine and its attacks on NATO’s eastern flank, Reuters reported. 

Ukraine’s Foreign Ministry confirmed to Radio Svoboda that a Ukrainian citizen was among those killed.

Ukrainian sailor killed, three crew members missing

The Khoryv sent a distress signal at around 10 a.m. local time, about 13 nautical miles (24 kilometers) east of Constanța, just outside Romania’s territorial waters, Digi24 reported. The vessel caught fire, sustained major damage, and capsized, with only a small part of its hull remaining visible above the water.

Romania’s naval authority said 13 crew members were aboard: 10 Ukrainians and three Azerbaijanis. Rescue teams recovered nine sailors alive and one body, while three crew members remained missing, Reuters reported.

Ukraine’s Foreign Ministry said the vessel had been traveling from a Turkish port and confirmed that the Ukrainian Embassy in Romania had received information from Romanian authorities about one Ukrainian sailor’s death. Four Ukrainian survivors, including the captain, were taken to a hospital, while two others did not require medical assistance.

Attacks threaten Black Sea shipping

The sinking comes amid a surge in attacks on commercial vessels off the coasts of Romania and Bulgaria. At least seven cargo ships have been hit over the past two weeks, with around 30 sailors reported dead or missing, according to Reuters.

The vessels targeted in recent incidents were either anchored near or heading toward the Sulina Canal, which connects the Danube River to the Black Sea. The canal has become a key export route for Ukraine, one of the world’s largest exporters of grain and vegetable oils.

Ukraine has increasingly relied on Danube ports and routes through Romanian territorial waters as Russia attacks its own Black Sea ports. Strikes on commercial vessels threaten crews and risk disrupting Ukrainian agricultural exports to international markets.

Russia has intensified attacks on Ukrainian ports and ships traveling to or from Ukraine. Moscow has described its strikes on vessels as retaliation for Ukrainian attacks on Russian or Russia-linked ships.

NATO plans stronger Black Sea surveillance

NATO said on 20 October it would send additional maritime patrol aircraft, radar systems, and drones to the Black Sea following the attacks on commercial shipping, according to Reuters. The alliance has not specified which capabilities it will deploy.

Romania, Ukraine, and Bulgaria have called on NATO to do more to protect commercial vessels. The latest sinking adds urgency to those calls as attacks increasingly affect shipping near NATO territory.

The latest incident highlights the growing risks to commercial shipping as Russia’s war against Ukraine increasingly affects maritime traffic beyond Ukraine’s own coastline.

In a direct confrontation with Russia, European NATO states would likely be even more vulnerable than Ukraine to swarms of Russia’s new jet-powered strike weapons, Fabian Hoffmann of the Norwegian Institute for Defence Studies (NIDS) argued in a 20 October op-ed for the Center for European Policy Analysis (CEPA). He calls them low-cost cruise missiles. Just three days earlier, Romania met what it believes were two of them over the Black Sea.

Romanian F-16 fighter jets shot down two jet-powered Geran-family drones over Romania’s territorial waters on 17 October, the Defense Ministry said. Interim Defense Minister Radu Miruță said they flew at about 450 km/h and were likely Geran-4s, the first of that type Romania had downed.

Faster drones for a faster war

Russia began using the Geran-4 in May in response to effective Ukrainian interceptor drones, Ukraine’s military intelligence (HUR) said, adding that it reaches up to 500 km/h. By June, those interceptors were downing about half of slower Shahed-type drones, defense adviser Serhii Beskrestnov estimated.

Hoffmann traces the shift to the Geran-3, a model Ukraine recovered intact in 2025. In his account, a Chinese JT80 turbojet roughly doubled its speed, from 185 to 350 km/h. However, he puts newer models, including the Geran-4, at 600 km/h or more, above HUR’s figure for that model.

By his estimate, each costs $150,000–$250,000, against about $50,000 for a long-range drone. Still, from Russia’s perspective, he wrote, that buys a significantly higher chance of getting through.

Engines are the bottleneck

Hoffmann argues defenses must match the threat’s speed, for example with jet-powered interceptor drones. Ukraine already fields some. On 4 October, President Zelenskyy said its Bars interceptors had shown the highest percentage among Ukrainian interceptors, about 30% of targets, according to Militarnyi. One unit destroyed five aerial targets with five Bars interceptors, Defense Minister Yevhenii Khmara later told journalists. He also called aviation one of the most effective tools against jet drones.

Hoffmann’s concern is scale. Jet engines are in short supply, he wrote, because too few European and US suppliers can meet demand. Ukraine’s Defense Industry Council flagged a shortage of such engines for its drones in April. In his view, gun systems and higher-end missile defenses are too scarce or too costly to fill the gap.

Two Romanian F-16s shot down two jet-powered Russian Geran attack drones over Romania’s territorial waters near Sulina on the evening of 17 October, Romania’s Defense Ministry said. The ministry released cockpit images of the mission the next day, as NATO allies prepare to discuss Black Sea security at a special session Romania requested.

This comes as Moscow continues its air attacks on Ukraine, while the US is trying to make deals with Russia over its diesel and lift sanctions. Russia keeps striking Ukraine’s energy system and cities, while its drones and suspected saboteurs keep turning up inside NATO, from tankers hit off Romania to a foiled arson attempt at a Starlink site in Lithuania.

Down within minutes

The F-16s took off from the 86th Air Base at Borcea at 17:43 after radar detected a group of air targets about 120 km east of Zmiinyi (Snake) Island, flying southwest, Ukrainian military outlet Militarnyi reported, citing the ministry. The first drone entered Romanian airspace at 17:59 and was shot down at 18:01 southeast of Sulina. The second entered at 18:01 and was downed at 18:05 east of Sulina.

Both were jet-powered attack drones of the Geran family, the ministry said. The Geran is Russia’s version of the Iranian-designed Shahed. When first detected, the drones were about 65 km from the coast of Russian-occupied Crimea and 140 km from the Ukrainian-held shore, and their southwest course may point to Russian origin, Militarnyi calculated.

The ministry posted the cockpit images on 18 October, showing a missile launch and a fireball over the sea. “Targets spotted, identified, engaged and neutralized!” it wrote.

Allies to meet on the Black Sea

A special session of the North Atlantic Council, NATO’s top decision-making body, will discuss defense and deterrence in the Black Sea on 20 October at Romania’s request. Romanian President Nicușor Dan has confirmed that the two tankers that caught fire near Sulina last week were hit by drones, and a NATO military source told Reuters they were Russian.

Romanian radar has logged 54 drone intrusions into the country’s air and sea space since Russia’s full-scale invasion, 35 of them this year, and the military has shot down six such targets in 2026, Defense Ministry data show.

Searches in Poland and Lithuania

Within hours, Poland’s Operational Command said it was checking a possible airspace violation by an unknown object overnight into 18 October. Troops, police, and military police searched for a possible crash site south of Lublin after residents reported the loud sound of a flying object around 02:00, Militarnyi reported.

On the morning of 18 October, an unknown drone entered Lithuania’s airspace and triggered air raid alerts, the country’s crisis management center said. NATO jets accompanied it but could not shoot it down because of bad weather, Defense Minister Robertas Kaunas said. Debris preliminarily identified as drone parts was later found in the village of Juodžioniai in Pasvalys district, and the army said the drone may have entered from the direction of Poland.

Romania moved from escorting Russia’s stray drones to firing on them in July, when its F-16s downed three in 72 hours.

Romania has proposed a joint NATO military command for the Black Sea, as drones hit four merchant ships in 24 hours, three of them off its coast, and its foreign minister said Russia "bears full responsibility." NATO ambassadors will discuss the attacks next week.

Russia’s strikes on merchant ships in the Black Sea have escalated this autumn and reached NATO shores. Drones have attacked at least eight merchant vessels near Romania and Bulgaria since 5 October, two of them inside Romania’s territorial waters. Until now, neither country had named the attacker, and Bulgaria still says it cannot prove who it was. Romania’s patience appears to have run out, and next week’s NATO meeting will show whether the alliance is ready to go further as Russia’s war spills beyond Ukraine’s borders.

Acting Defense Minister Radu Miruță wrote on Facebook on 14 October that "the Black Sea needs a joint military command of the NATO riparian states." "The Black Sea incidents, involving drones, sunk ships, and naval mines, oblige us to act, not wait," he wrote, after a call with his Bulgarian counterpart. Leadership and location would rotate among the member states. Romania is ready to host the command on its coast from 2028 and would accept a start on Türkiye's coast until then, he said. He proposed that Romania and Bulgaria send NATO a joint letter backing the idea.

The next day, Foreign Minister Oana Țoiu wrote on X that four commercial ships had been attacked over the previous day, including in Romania's territorial waters and exclusive economic zone, and that eight people had died. "Russia is turning the Black Sea into a dangerous area for civilian ships," she wrote. "Killing sailors from commercial ships, both in this region and anywhere in the world, is a crime. Russia bears full responsibility for these developments."

Earlier that day, as two tankers burned off Romania's coast, Bucharest had said it was still checking whether drones were involved.

Țoiu said NATO Secretary General Mark Rutte had agreed to convene the allies within days, after he met Romanian President Nicușor Dan and Bulgarian Prime Minister Rumen Radev in Brussels. NATO ambassadors will meet next week, France 24 reported. No date has been announced.

An escalating drone strike campaign

Drones have been hitting merchant ships for weeks on the route from Ukraine's Danube and Odesa ports to the Bosporus. Besides the latest strikes off Romania, Reuters counts at least five cargo ships hit near Romania and Bulgaria in the past 10 days, with 23 sailors dead or missing, most of them outside any NATO member's territorial waters. This week the strikes reached Romania's own waters.

• The Comoros-flagged tanker Yara J was hit inside Romanian territorial waters late on 14 October, off Sulina, the port at the mouth of the Danube. Its crew was unharmed, and it was towed to the Romanian port of Constanța.
• Early on 15 October drones struck the San Marino-flagged chemical tanker Wine Trader about a mile outside Romanian waters, also southeast of Sulina. Five of its 12 crew were rescued. Seven were still missing on 16 October, when rescuers returned to search the ship.
• Two more ships were also targeted, Reuters reported: the Marshall Islands-flagged Sea Destiny, inside Romanian waters according to NATO, and the Tanzania-flagged Dania J, moored at the Ukrainian Danube port of Izmail.

Țoiu did not say which ships her eight dead were from, and Reuters still lists the Wine Trader's seven as missing. A NATO military source told Reuters the drones that hit both tankers came from Russia.

Romania's president says too early to say

Romania's president has not gone as far as his foreign minister. Dan told reporters in Brussels it was "obvious" that the attacks were Russian attempts to destabilize Romania and Bulgaria and reduce support for Ukraine. But he also said it was too early to say definitively that Russia had launched the drones, according to Politico.

Bulgaria, Romania's partner on the command proposal, says it suspects Russia but cannot prove it. Two ships were hit off its coast on 13 October, and one, the HS Dignity, sank. The other, the Chelsea 3, is Ukrainian-owned.

Radev told parliament on 14 October that the attacks worked in Russia's favor and that "logic leads there." "The problem is that we cannot prove it," he told MPs. Sofia summoned the Russian ambassador. Radev also said EU leaders would discuss a moratorium on attacks on civilian ships in the Black Sea.

Bucharest has blamed Russia for drones before, though over its airspace, not its shipping. On 27 July it expelled a Russian diplomat after prosecutors confirmed that fragments of drones downed on Romanian territory were Russian. Russia, Romania's Foreign Ministry said then, "bears exclusive responsibility."

Ukraine ships most of its farm exports across the Black Sea. Euromaidan Press's David Axe has written on how the fight over shipping there has escalated.

Two tankers caught fire within about 12 hours off Sulina, Romania’s port at the mouth of the Danube, Romanian authorities reported. The crew of one said a drone hit it inside Romania’s territorial waters, while Bucharest says it is still checking whether drones were involved. Bulgaria, where drones sank ships in its economic zone this month, says it lacks proof that Russia launched them.

For months, Russia has struck civilian ships on the sea route that carries most of Ukraine’s farm exports, while its drones have repeatedly crossed into Moldova and Romania during attacks on Ukraine. As long as Bucharest and Sofia wait for drone wreckage before naming anyone, Russia, the party Bulgaria’s own prime minister says the logic points to, pays no price for extending its war on Ukraine’s trade routes into NATO members’ waters.

Seven sailors missing after the second fire

The San Marino-flagged chemical tanker Wine Trader reported a fire in its superstructure around 07:00 on 15 October while anchored in Romanian territorial waters about 13 nautical miles southeast of Sulina, Romania’s Naval Authority said. By midday, five of its 12 crew had been recovered and seven were still missing.

Hours earlier, at 01:34, a drone entered Romanian airspace over the country’s waters southeast of Sulina for about a minute before vanishing from radar, the Defense Ministry said. Authorities have not named a cause for the fire, though unnamed sources

Ukraine plans 135 basic mobile shelters for civilians at 28 of its border crossings, the State Agency for Restoration and Infrastructure Development said on 7 October.

Since the start of September, Russian drones have repeatedly struck crossings on Ukraine's borders with Moldova and Romania. Since mid-September, strikes have also reached the Polish border near the Yahodyn crossing in Volyn Oblast. On 13 September, a Russian drone strike set a gas station near the crossing on fire. On 28 September, the blast wave from another strike damaged the checkpoint building. On 25 September, First Deputy Minister for Restoration, Infrastructure and Transport Serhii Derkach said Ukraine is exploring with its neighbors whether some checkpoints could move onto their territory. No agreement has been reported. On 2 October, Moldovan Interior Minister Daniella Misail-Nichitin said Moldova had set up shelters next to its crossings with Ukraine and started relocating staff from joint checkpoints.

135 shelters for travelers and border staff

The shelters will stand at the crossings and on the roads leading to them. Regional recovery services in Vinnytsia, Odesa, Chernivtsi, Zakarpattia, and Volyn oblasts are running the purchases. The agency said the shelters will make the border safer for people crossing it and for checkpoint staff.

In Chernivtsi Oblast, one of the 10 tenders the agency lists on Prozorro, Ukraine's public procurement system, covers eight shelters for 50 people each and three for 20 each, Ukrinform reported. They will stand on the approach road to the Porubne–Siret international crossing on the Romanian border. The work is expected to cost UAH 38.5 million (about $855,000), excluding VAT.

Russian strikes on crossings

On 5 October, at about 09:38, a projectile fell near the Palanca–Maiaky–Udobne crossing on the Moldovan border. It ricocheted off the ground into a shuttle bus parked by the barrier and also damaged a control booth. One Moldovan border officer suffered light injuries, and the crossing was suspended, Moldova's Border Police said, linking the incident to Russia's attacks on Ukrainian infrastructure. Moldovan authorities did not specify the projectile's type or origin.

Overnight on 9 September, Russian drones struck the Starokozache crossing with Moldova, killing two people and injuring three. On 1 September, Russian Shahed drones hit the Orlivka ferry crossing on the Danube, opposite Romania's Isaccea, and temporarily shut it down. Another Russian strike on 6 September halted the crossing again.

Drones sank two merchant ships and set a third on fire in the Black Sea economic zones of NATO members Romania and Bulgaria on 5 and 6 October, killing at least two seafarers, Romanian and Bulgarian authorities reported. Ukraine blamed Russia for the first attack. Neither Bucharest nor Sofia has said who launched the drones.

Russia has spent months striking ships bound to and from Ukrainian ports while denying responsibility or staying silent. Now merchant vessels are sinking inside NATO members' economic zones without either government naming the attacker, so Moscow pays no political price for hitting allied waters.

Grain ship sinks off Romania

The Royad Mammadov, a Turkish-owned ship carrying grain from Ukraine's port of Izmail to Italy, sank on 5 October near Romania's Pescăruș offshore platform, 20 nautical miles from the Romanian coast, Digi24 reported. The Romanian Naval Authority described the incident as a fire on board. Romania's Interior Ministry said 11 crew members were rescued and two people died.

Three injured sailors aged 22 to 50 were taken to the Constanța county hospital, conscious and stable, with multiple injuries. Adrian Mihălcioiu, the leader of Romania's Free Seafarers' Union, said the ship was attacked by Russian sea and aerial drones in waters Romanians consider safe.

"It is a commercial ship, a ship that is not part of the war… people who have nothing to do with the war, it is not their war," he said.

Ukrainian President Volodymyr Zelenskyy blamed the attack on "two Russian drones" and said the ship was in neutral waters carrying corn. Citizens of Azerbaijan and India were on board, and the captain was killed, he said. Romanian authorities have not attributed the sinking to Russia.

Two more ships hit in Bulgaria's zone

A day later, drones struck two merchant ships in Bulgaria's exclusive economic zone east of the town of Byala, the first known attack on ships there, Maritime.bg reported. The Togo-flagged Alfa Watan, sailing from Al-Arish, Egypt, to Sulina, Romania, suffered critical hull damage and sank, Militarnyi said. The Bulgarian ferry Dioscuria found only an overturned lifeboat and life jackets at the scene, and the search for the crew continues, Euronews reported.

The Palau-flagged Able, sailing from Galați, Romania, to Istanbul, caught fire, and the Dioscuria rescued its 18 crew members. Both ships are Turkish-owned, Türkiye Today reported. Two sailors with severe injuries were flown to a hospital in Varna, Prime Minister Rumen Radev said, according to AP. Sea and aerial drones hit the ships at about 3 a.m., he said, calling the attack "a blatant violation of international law and maritime law."

Radev called an emergency meeting of four ministries, the presidency, and the security services. No one from the Alfa Watan has been found, he said, warning that if the war is not ended in time, it "will continue to expand its spatial scope." The origin of the drones is still being clarified, Maritime.bg said. Several Bulgarian media outlets cited sources as saying the drones were Russian, Sofia Globe reported.

Russia's war on Black Sea shipping

Russia had already killed the captain of a Tanzanian-flagged ship in September, and days later it struck another civilian vessel, killing its captain too. Ukraine says that route carries 90% of its farm exports.

Romania has destroyed a sea drone near its Neptun Deep gas project and found Russian drones floating in its economic zone. In September, ISW linked drone crashes in Romania and Moldova to a wider Russian pattern of pressure on NATO.

EU foreign policy chief Kaja Kallas called for a moratorium on Black Sea attacks. Turkish President Recep Tayyip Erdoğan said Ankara was stepping up diplomacy to restore grain exports. Türkiye and the UN are organizing new Black Sea truce talks between Russia and Ukraine, Bloomberg reported, citing a diplomat. Russia earlier dismissed Kyiv's offer of a Black Sea ceasefire.

Ukraine may soon receive a multimillion package of 20-mm rounds for its F-16 fighter jets, Foreign Minister Andrii Sybiha told journalists, Hromadske reported. He called the ammunition critical for shooting down Russia's jet-powered drones and said several partners have already begun transferring it. He expects the larger package after an upcoming high-level visit.

Russia now strikes Kyiv and other Ukrainian cities daily, increasingly with jet-powered drones that outrun the cheap interceptors built for slower Shaheds. Fighter jets are among the tools Ukraine uses against them, while its overall interception rate for jet drones still trails its rate against propeller drones.

"Critically important" ammunition

Sybiha said Ukraine has yet to build up its capability to repel jet drones.

"Given that we have not yet built up the capability to repel jet drones, and given the preparations for new strikes, it was critically important to help our military shoot down these drones. Apart from air defense systems, which are too expensive to use constantly against drones, the most effective tools right now are F-16 fighter jets," Sybiha said.

He thanked Spain, Belgium, and Poland, which have begun the process of transferring the ammunition, and said that thanks to them Ukraine will "very soon" have the rounds it needs.

A "very serious visit" ahead

Sybiha linked the larger package to a visit he did not name.

"We will soon have one very serious visit. We think that one of the decisions following this visit will be a multimillion package of this ammunition for Ukraine," he said.

Talks on buying the rounds from private manufacturers are also underway, he added.

Ukraine has already received urgent batches of F-16 ammunition from Belgium, Spain, and other partners, and Belgium plans to send three more F-16s by the end of 2026 under an accelerated procedure. The jets' air-to-air missiles and cannon rounds are imported and not always in stock.

Another night of Russian strikes

Overnight on 2 October, Russia launched 108 drones at Ukraine, 47 of them jet-powered, and air defenses downed 88 of them. In Kyiv, a Russian strike on a 25-story residential building in the Darnytskyi district killed one person and injured two. Russia also targeted the Southern Bridge again, after striking it three times the previous day, and the city restricted public transport across several bridges.

In Kharkiv Oblast, a Russian FPV drone hit a car in the Solonytsivka hromada on the afternoon of 1 October, injuring a man and a boy. A Russian strike damaged a civilian enterprise in Rivne Oblast and started a fire that forced an evacuation of nearby homes, regional head Oleksandr Koval said, and drones attacked Cherkasy Oblast.

In neighboring Romania, an object believed to be a drone crashed near the village of Plauru in Tulcea County during the attack, starting a fire that caused no casualties, Romania's Defense Ministry said.

Several recent incidents across Europe were conducted by Russia or are likely attributable to Russia, ISW assessed in its 24 September report, though authorities have not officially linked the Polish and German incidents to Moscow.

Russia's full-scale war against Ukraine has expanded into a parallel campaign of provocations against European defense and logistical infrastructure. The Kremlin is using drones, arson, and undersea cable sabotage to degrade Europe's will and ability to support Ukraine, while deliberately intensifying the frequency of airspace violations to erode the boundary between hybrid and kinetic war.

Drones over Moldova and Romania

Four Russian drones flew over Bukovyna and targeted an energy facility and border crossings with Moldova and Romania, Chernivtsi Oblast Military Administration head Ruslan Osypenko reported. Ukrainian forces shot down three. The fourth flew toward Suceava County in northeastern Romania.

A drone crashed in Cernița, Florești district, Moldova—preliminarily identified as a Russian Gerbera type, the first such device found in the country. It carried an onboard camera, hit a tree, and exploded, Moldovan police said. Romania's Defense Ministry reported a second aerial vehicle entered Romanian airspace for four minutes and crashed near Solca in the same border region; geolocated footage confirmed it was also a Gerbera, ISW noted. Poland evacuated the Hrubieszów and Dorohusk border crossings for 30 minutes, Prime Minister Donald Tusk said. Three countries were put on alert by a single night of Russian strikes.

"Intentional and accidental Russian drone incursions into NATO and Moldovan airspaces are likely part of the Kremlin's efforts to normalize airspace violations by intensifying their frequency," ISW assessed.

Sabotage in Poland and Germany

A fire engulfed the power system and backup generator at a Starlink ground station in Wola Krobowska, central Poland, on the evening of 23 September. Deputy Prime Minister Krzysztof Gawkowski confirmed it was sabotage aimed at cutting internet access, including for Ukraine's military. Authorities have not identified who was responsible, but the act aligns with Russia's "new" doctrine of attacks, Gawkowski said. The station is now operating normally.

German authorities suspended operations at Berlin-Brandenburg airport for 45 minutes the same evening after staff reported a drone sighting, Die Zeit reported. Federal police could not confirm it. ISW assessed both incidents fit Russia's wider pattern of sabotage against European defense assets, though neither has been officially attributed to Russia.

Western intelligence warnings

A Lithuanian Defense Ministry source reported on 23 September that Russia could launch Gerbera drones from a shipping container in the Mediterranean against Spain, France, and Italy. Danish Defense Intelligence assessed on 24 September that Russia will intensify its hybrid war in coming months, including destructive cyber attacks and sabotage carrying a high risk of casualties, and that there is a low but growing risk of a limited Russian military attack on a NATO border state. It sees no indications of an outright invasion. The CIA reportedly warned Poland that Russia may sabotage underwater cables to disrupt its banking system, according to Newsweek Polska journalists.

NATO tracked and confronted Russian submersibles rehearsing deployment of a new cable-disabling weapon near Svalbard in spring 2026—no cables were damaged, but the operation demonstrated Moscow's intent, Reuters reported. Shadow fleet vessels likely served as drone-launch platforms for incursions into NATO airspace, ISW noted.

"The increasing frequency of such warnings suggests that Western intelligence agencies are picking up indicators that the Kremlin is looking to diversify its platforms and means for conducting attacks against NATO and European states and is considering conducting such attacks," ISW assessed.

ISW said it has not yet seen evidence that Russia has conducted the attacks the warnings describe.

Denmark's assessment—that a limited Russian military strike on a NATO border state could come in the coming months—suggests the boundary between hybrid provocations and military action is narrower than European policy has assumed. ISW's synthesis reframes what governments have treated as separate incidents into one campaign.

"Intentional and accidental Russian drone incursions into NATO and Moldovan airspaces are likely part of the Kremlin's efforts to normalize airspace violations by intensifying their frequency," ISW assessed.

"The increasing frequency of such warnings suggests that Western intelligence agencies are picking up indicators that the Kremlin is looking to diversify its platforms and means for conducting attacks against NATO and European states and is considering conducting such attacks," ISW assessed.