Russia is expanding drone storage at the Hvardiiske military airfield in occupied Crimea, Ukrainian OSINT channel Dnipro Osint reported on 26 October, citing new satellite images. The channel did not say who took the images or when. Ukraine’s Security Service (SBU) said it struck drone hangars at the same airfield in July, and the military said strikes on 13 October damaged four drone storage sites nearby.

Hvardiiske has stayed in use since then. Ukraine’s General Staff has listed it among the sites Russia launched attack drones from in every daily report since 7 October. The airfield was on the list again on 24, 25, and 27 October, the night Russia aimed its main strike at Kyiv. The new construction, as the channel describes it, adds protected storage at a base Ukraine has already shown it can reach.

Shelters and “garages”

The images show more than 20 small shelters under construction, each protected by earth berms, the channel said. It also counted about 40 smaller structures it calls “garages.” It said they are meant for storing, servicing, and preparing Geran drones for launch.

Geran is the name Russia gives the Iranian-designed Shahed drones: the Shahed-136 became the Geran-2, which Russia now builds itself. The images show at least one hangar damaged by a Ukrainian drone hit, Dnipro Osint noted.

Launched from vehicles

Hvardiiske, north of Simferopol, uses mobile launch platforms instead of fixed installations, according to Dnipro Osint. Crews load drones onto specially equipped vehicles, which then launch them from the runway.

Struck repeatedly since June

On 24 June, the SBU said it hit infrastructure at Hvardiiske and at the Saky airbase. On 3 July, the SBU reported that its drones struck two hangars at Hvardiiske that stored Shaheds and aviation equipment. Ukraine’s General Staff said its forces struck the airfield again overnight on 5 July, and the SBU said a day later that it hit three hangars with aviation equipment there. A strike on 3 August destroyed nine aviation-fuel tanks and damaged two aircraft hangars, the General Staff said. Strikes on 13 October damaged four drone storage sites near Hvardiiske, with signs of secondary detonation, it reported two days later.

Not the only base Russia is building up

Hvardiiske is not the only Russian drone base Ukrainian OSINT channels have flagged this month. On 13 October, the anonymous channel Absolutely Reliable Source said Russia had nearly finished the first section of a launch site for jet-powered Geran-5 drones near Millerovo in Rostov Oblast, with eight launcher positions and 32 drone-preparation spots. Hvardiiske and Millerovo were both among the launch areas the General Staff listed for the night of 27 October, when Russia launched 280 Shahed-type drones, 69 of them jet-powered, with Kyiv as the main target.

Undercover reporters ordered 500 drone mesh modems from a Chinese firm, which billed them to Russia’s Alabuga drone plant, investigation by The Insider found. The outlet estimates the firm makes about half the high-power mesh modems that let Russia steer its drones deep into Ukraine. The firm’s director also named US company AMD as the source of a key chip, and AMD says it has not sold to the firm.

Geran drones and Banderol drone-missiles have become Russia’s main weapons against Ukraine’s energy grid. Russia began this winter’s strike campaign against that grid in late September, ISW assessed. Ukrainians’ survival this winter depends largely on how fast the West halts mesh modem sales to Russia, the outlet argued.

What a mesh modem does

A mesh modem links drones into one radio network. Each unit relays data for the others, so if one drone is shot down, traffic reroutes through the rest. Information keeps flowing even if nearly 80% of the drones are downed, Ukrainian defense adviser Serhii “Flash” Beskrestnov said in November 2025.

Range is the other half of the threat. One XK F-359 holds a line-of-sight link over 100–300 km, The Insider says. In theory, a couple of relay drones could keep a whole attack on Kyiv connected. Operators can then send new commands in flight and steer around air defenses. Russia’s Gerbera drones, first built as cheap decoys, increasingly carry these modems.

Explore further

Russia’s jam-resistant drones run on a Chinese modem no one has sanctioned

A modem from an upgraded Gerbera

To trace the part, The Insider’s correspondent in Ukraine examined an unmarked mesh modem from an upgraded Gerbera with a vertical tail fin, a version that appeared this summer. The outlet identified it as Xingkai’s XK F-359, the part Ukrainian intelligence and earlier reporting, Euromaidan Press included, had logged as the XK-F358. The Insider calls that label a misidentification.

Next, The Insider and the Nordsint investigative project contacted Xingkai on WeChat, posing as a Russian military supplier based in Alabuga. A company employee who introduced himself as “Jack Jiang” confirmed the firm is the model’s sole maker. The Insider identified him as Jiang Qin, Xingkai’s director and owner.

500 modems, three banks

The reporters then ordered 500 units for delivery to Alabuga, home to the plant that makes most of Russia’s long-range drones. Jiang invoiced 19.5 million yuan, which The Insider put at about $2.87 million. He offered two ways to pay: dollars to Xingkai’s DBS Bank account in Hong Kong, or yuan to his personal Ping An Bank account.

Explore further

America has sided with Russia against Ukraine. Europe should stop pretending and build a coalition against Russia, China, and even the US

In the chat, the reporters said outright that the end user was a military production facility. Jiang raised no objection, The Insider reported.

Later, after the reporters asked to update the address, Xingkai sent a revised invoice with “Alabuga” spelled in Latin letters. This time, it routed payment to a China Merchants Bank account in the name of a former Xingkai manager. She left a management post at the company in 2025, according to Tesari corporate records cited by The Insider. None of the three banks answered The Insider’s requests for comment.

Jiang also claimed the modem’s programmable chip is made by AMD. Asked for an AMD license, he refused, saying Xingkai buys the chips through a middleman. AMD told The Insider that Xingkai “is not an AMD customer or authorized partner,” and said it had sold the company nothing. AMD added that it bars exports of its products to Russia that violate US export controls and sanctions.

Russia has started fitting its enlarged Gerbera-2 drones with a 10-kg warhead and an extra bag of incendiary mixture, Ukrainian military outlet Militarnyi reported on 18 October. The setup is designed to start a fire where the drone hits and is probably meant for attacks on critical infrastructure and warehouses, the outlet said.

Russia’s industry makes about 3,000 jet-powered Geran-4 and Geran-5 drones a month, Ukraine’s military intelligence has said, and Russian strikes have destroyed 2.1 million m² of Ukraine’s modern warehouse space since the full-scale invasion began. A cheap drone that carries fire adds one more threat for air defenses that already let nearly half of Russia’s jet-powered Shaheds through.

A fire bag behind the warhead

Ukrainian Telegram channel Polkovnyk HSh posted photos of the payload on 17 October. Gerbera-2 strike and reconnaissance drones had begun to appear with a 10-kg high-explosive fragmentation-incendiary warhead and an extra package of incendiary mixture, the channel wrote. They navigate with Kometa-M12, a 12-element antenna array designed to resist jamming, it added.

Explore further

Russian drones set their own detonators at altitude: Why cutting wires won’t save from new Gerberas?

In the photos, the incendiary mixture sits in a separate soft plastic tank behind the main warhead, Militarnyi said. Gerbera-2s have been seen with warheads of 4 to 10 kg depending on range, while strike versions of the original Gerbera usually carried up to 5 kg, the outlet noted.

Half a Shahed engine

Russia has mainly fielded the Gerbera, a cheap drone shaped like a Shahed, as a decoy and reconnaissance platform flying alongside Shahed-type strike drones. It has also used bigger Gerberas to drop FPV drones.

Serhii Beskrestnov, now an adviser to Ukraine’s president, flagged a much bigger Gerbera in Ukraine’s skies on 7 August. The Gerbera-2 has a larger airframe, a reshaped wing, and a bigger tail fin, Militarnyi said. In August, the outlet reported it had a stronger piston engine: half of the one in the Shahed-type Geran-2, at about 275 cm³. Production of these engines was set up at the Izhevsk Motorcycle Plant, according to preliminary information the outlet cited.

Explore further

Russia equips Geran attack drones with image-based navigation using Google map imagery, reducing reliance on satellite navigation that Ukraine can jam, defense adviser warns

Earlier versions ran on a Chinese DLE60 model-aircraft engine of about 61 cm³. The switch was likely possible because Geran-2 engine output partly freed up as jet-powered Geran-4s took a growing share of Russia’s drones, Militarnyi said. The Gerbera-2’s fuel tank also holds up to 63 liters, against 10 liters on the original.

One reached Poland’s Baltic coast

In September, a drone preliminarily identified as a Gerbera-2 was recovered from the Baltic Sea near Rusinowo, on Poland’s coast. It carried a high-explosive fragmentation warhead of about 4 kg, a Polish military prosecutor said.

Polish SIM cards were found inside some of the Russian drones that entered Polish airspace during a mass incursion in September 2025, Polish outlet RMF24 reported, citing findings from a Polish prosecution investigation.

SIM cards can allow drones to connect to local cellular networks for functions such as communications, data transmission, telemetry, or navigation-related services. However, investigators have not said what the Polish SIM cards found in the Russian drones were used for. The details remain classified.

The SIM cards were discovered in some of the Russian Gerbera drones recovered after the incursion, RMF24 reported.

Investigators have not disclosed whether the SIM cards were stolen or obtained illegally.

The investigation into the September 9–10, 2025 incursion was ultimately closed after prosecutors failed to identify those responsible for violating Polish airspace.

More than 30 drones entered Poland

The incursion took place overnight on September 9–10, 2025, during a large Russian missile and drone attack on Ukraine. More than 30 Russian Gerbera drones entered Polish airspace from the east and came down at 27 locations across the country, according to RMF24.

Polish forces intercepted and shot down multiple drones, with the Territorial Defense Forces deployed to search for wreckage and other objects that came down on Polish territory. Poland also maintained contact with NATO command throughout the operation.

The incident prompted Poland to close four airports – Warsaw Chopin, Warsaw-Modlin, Rzeszów-Jasionka and Lublin – because of the military activity. 

Polish officials described the airspace violations as unprecedented and a serious threat to national security. The incident marked the first time since Russia's full-scale invasion of Ukraine that Polish forces had used weapons against Russian aerial objects that entered the country's airspace.

The mass incursion subsequently became the subject of a criminal investigation into the violation of Polish airspace and the threat to public safety.

Investigation closed without identifying perpetrators

After months of investigation, Polish prosecutors closed the case because they were unable to identify the perpetrators, according to Lublin District Prosecutor’s Office spokesman Marcin Kozak, as cited by RMF24.

Most of the case files, including the justification for the decision, are classified.

Explore further

Last September, Poland downed four of 19 Russian drones. This September, drone reached NATO’s missile shield in Redzikowo, and troops guarding it called 112

Prosecutors cleared Poland's military response

Investigators also examined whether the Polish military had responded properly to the drone incursion.

According to RMF24, prosecutors concluded that the military acted in accordance with procedures. Polish troops had the right to use force and shoot down hostile objects, and prosecutors found no irregularities in their response.

The investigation was therefore closed both over the failure to identify the perpetrators and over the assessment of the Polish military's actions.

A Russian drone struck near the Yahodyn border crossing on the Ukrainian-Polish border, the Ukrainian Border Service and the Polish Armed Forces Operational Command reported on 28 September. Geolocated footage of the attack shows the jet-powered Geran-5 striking near the facility. Following the incident, Poland is reviewing its air security measures.

Russia systematically strikes Ukraine’s border crossings to complicate logistics. Russian strikes near the Ukrainian-Polish border have increased over the past month. Yahodyn is one of the largest border crossings with Poland, on a route leading, among other destinations, to Warsaw, and has repeatedly been used by senior foreign officials visiting Ukraine.

The blast wave damaged the checkpoint building at the terminal entrance, Ivan Romaniuk, head of the Volyn Regional Military Administration, reported on 28 September. It was a jet-powered drone, but there was “preliminarily no direct hit” on the border crossing, BBC Ukraine reported, citing its own sources in the State Border Guard Service of Ukraine.

Russian drone strikes near Yahodyn

On the afternoon of 28 September, Poland reported the involvement of Polish military aviation because of Russian drone attacks against Ukraine. That day, it was also reported that the airports in Rzeszów and Lublin suspended operations.

Jacek Horyszewski, a spokesperson for the Polish Armed Forces Operational Command, said on TVN24 that a Russian drone had struck near the Yahodyn border crossing in Volyn Oblast on the border with Poland.

Romaniuk confirmed the attack in the village of Starovoitove, Kovel district, Volyn Oblast, where the Yahodyn international border crossing is located.

“There have been no reports of injuries or fatalities,” he said.

Videos that appeared online show the drone falling in a forest near people and border infrastructure.

The Russians carry out such attacks on Ukraine’s western regions using repeaters on Belarusian territory that amplify signals for Shahed- and Gerbera-type drones, BBC Ukraine reported, citing State Border Guard Service data.

Poland is already considering changes to its air security rules after the incident

The same day, Polish Deputy Defense Minister Cezary Tomczyk said Poland will change its engagement rules "in the coming days." Currently, helicopter and fighter jet pilots can use weapons only after visually identifying a target: the aircraft must approach the object and determine what it is. After the rules are changed, however, a pilot or operational commander will be able to make a decision to engage based solely on radar data.

“It is notable that Polish authorities have taken this step as NATO states attempt to find an adequate response to Russian drones nearing or entering their airspace from Ukraine, often leaving NATO air defense insufficient time to identify and target such threats before they have entered allied airspace,” the Institute for the Study of War noted in its 28 September report.

Recent strikes near the Polish border

On 10 September, Polish Prime Minister Donald Tusk said that Poland had prevented a threat to one of its border crossings with Ukraine overnight and expected its border crossings to be attacked as Moscow targets trade routes in an attempt to economically weaken Kyiv. He made the statement after drones struck a border crossing between Ukraine and Moldova on the previous day, killing two people.

On 13 September, Russian forces struck the locomotive of a passenger train two kilometers from the Polish border and hit a gas station near the Yahodyn international border crossing on the Ukrainian-Polish border.

The drone attack forced passengers on a train from Ukraine to leave the carriages for safety. Those evacuated included Boris Johnson, security advisers to European governments, German Bundestag lawmakers, diplomats, and academics.

After the Russian attacks, Poland deployed military units on the border with Ukraine and strengthened infrastructure near the border crossings, Polish Defense Minister Władysław Kosiniak-Kamysz said on 15 September.

On 17 September, Russian forces struck near the Yahodyn border crossing with a jet-powered drone.

French President Emmanuel Macron said French services received no CIA warning about a possible Russian drone attack from Mediterranean merchant ships, pushing back on an El Mundo report that US intelligence had alerted France, Italy, and Spain, RTL reported.

Macron’s denial comes amid drone attacks and sabotage cases that European governments have linked to Russia. France is preparing stronger defenses against that wider threat, even as Macron says its services received no specific CIA warning. Italy’s defense minister has also cautioned against fueling alarm over an unconfirmed report.

Asked about the report during a televised interview on 24 September, Macron said: “The CIA did not inform French services of such an attack.” He said Russia was multiplying hostile and sometimes criminal acts against European countries. Covert acts such as sabotage and cyberattacks are often described as hybrid warfare. Asked whether France itself could be attacked, Macron answered yes.

Italian Defense Minister Guido Crosetto separately wrote on X that El Mundo’s alert “finds no confirmation.” He said it served no one to add “more fuel to the fire” at an already tense time.

The Spanish newspaper reported that the possible operation would use Gerbera drones, small Russian aircraft capable of carrying several kilograms of explosives. The drones would be hidden in shipping containers aboard merchant ships and launched toward targets along Europe’s southern coast. El Mundo cited a source close to Lithuania’s Defense Ministry, and analysts familiar with a CIA report said to have circulated among European foreign ministries. Euromaidan Press covered the account on 24 September. Bythe time of publication, neither Spain’s government nor the CIA had publicly addressed it.

Macron pointed to the failed attack at Leipzig/Halle Airport in eastern Germany in August. A drone carrying explosives was found near a Ukrainian cargo aircraft. German officials attributed the attempt to Russia. Macron said France had not experienced a comparable incident.

The wider hybrid warfare threat

Beyond the disputed Mediterranean alert, authorities have investigated other incidents throughout Europe as possible Russian sabotage.

Germany followed its accusation over Leipzig with diplomatic measures against Moscow. Berlin ordered Russia’s last consulate in Germany closed and ended an agreement permitting a Russian cultural center. German investigators also identified two suspects, including a Russian man they linked to military intelligence. Moscow denied involvement.

Poland’s justice and interior ministers said Russian intelligence ordered the May 2024 arson of Warsaw’s Marywilska 44 shopping center.

Finnish President Alexander Stubb said Russia would continue such attacks to frighten Ukraine’s allies into reducing support. He urged vigilance without overreacting, saying Finnish intelligence saw no imminent military threat.

Several recent incidents across Europe were conducted by Russia or are likely attributable to Russia, ISW assessed in its 24 September report, though authorities have not officially linked the Polish and German incidents to Moscow.

Russia's full-scale war against Ukraine has expanded into a parallel campaign of provocations against European defense and logistical infrastructure. The Kremlin is using drones, arson, and undersea cable sabotage to degrade Europe's will and ability to support Ukraine, while deliberately intensifying the frequency of airspace violations to erode the boundary between hybrid and kinetic war.

Drones over Moldova and Romania

Four Russian drones flew over Bukovyna and targeted an energy facility and border crossings with Moldova and Romania, Chernivtsi Oblast Military Administration head Ruslan Osypenko reported. Ukrainian forces shot down three. The fourth flew toward Suceava County in northeastern Romania.

A drone crashed in Cernița, Florești district, Moldova—preliminarily identified as a Russian Gerbera type, the first such device found in the country. It carried an onboard camera, hit a tree, and exploded, Moldovan police said. Romania's Defense Ministry reported a second aerial vehicle entered Romanian airspace for four minutes and crashed near Solca in the same border region; geolocated footage confirmed it was also a Gerbera, ISW noted. Poland evacuated the Hrubieszów and Dorohusk border crossings for 30 minutes, Prime Minister Donald Tusk said. Three countries were put on alert by a single night of Russian strikes.

"Intentional and accidental Russian drone incursions into NATO and Moldovan airspaces are likely part of the Kremlin's efforts to normalize airspace violations by intensifying their frequency," ISW assessed.

Sabotage in Poland and Germany

A fire engulfed the power system and backup generator at a Starlink ground station in Wola Krobowska, central Poland, on the evening of 23 September. Deputy Prime Minister Krzysztof Gawkowski confirmed it was sabotage aimed at cutting internet access, including for Ukraine's military. Authorities have not identified who was responsible, but the act aligns with Russia's "new" doctrine of attacks, Gawkowski said. The station is now operating normally.

German authorities suspended operations at Berlin-Brandenburg airport for 45 minutes the same evening after staff reported a drone sighting, Die Zeit reported. Federal police could not confirm it. ISW assessed both incidents fit Russia's wider pattern of sabotage against European defense assets, though neither has been officially attributed to Russia.

Explore further

Russian attack puts three countries on alert as drones enter Moldova and Romania

Western intelligence warnings

A Lithuanian Defense Ministry source reported on 23 September that Russia could launch Gerbera drones from a shipping container in the Mediterranean against Spain, France, and Italy. Danish Defense Intelligence assessed on 24 September that Russia will intensify its hybrid war in coming months, including destructive cyber attacks and sabotage carrying a high risk of casualties, and that there is a low but growing risk of a limited Russian military attack on a NATO border state. It sees no indications of an outright invasion. The CIA reportedly warned Poland that Russia may sabotage underwater cables to disrupt its banking system, according to Newsweek Polska journalists.

NATO tracked and confronted Russian submersibles rehearsing deployment of a new cable-disabling weapon near Svalbard in spring 2026—no cables were damaged, but the operation demonstrated Moscow's intent, Reuters reported. Shadow fleet vessels likely served as drone-launch platforms for incursions into NATO airspace, ISW noted.

"The increasing frequency of such warnings suggests that Western intelligence agencies are picking up indicators that the Kremlin is looking to diversify its platforms and means for conducting attacks against NATO and European states and is considering conducting such attacks," ISW assessed.

ISW said it has not yet seen evidence that Russia has conducted the attacks the warnings describe.

Denmark's assessment—that a limited Russian military strike on a NATO border state could come in the coming months—suggests the boundary between hybrid provocations and military action is narrower than European policy has assumed. ISW's synthesis reframes what governments have treated as separate incidents into one campaign.

"Intentional and accidental Russian drone incursions into NATO and Moldovan airspaces are likely part of the Kremlin's efforts to normalize airspace violations by intensifying their frequency," ISW assessed.

"The increasing frequency of such warnings suggests that Western intelligence agencies are picking up indicators that the Kremlin is looking to diversify its platforms and means for conducting attacks against NATO and European states and is considering conducting such attacks," ISW assessed.