Journalists from 17 European public service broadcasters, coordinated by the European Broadcasting Union’s (EBU) Eurovision News Spotlight network, published an interactive map on 23 October 2026. It documents hybrid incidents linked to Russia across 17 European countries between 1 April and 15 October. Journalists compiled a database of hundreds of reported incidents, categorizing each by type and the source and strength of its alleged links to Russia, then verifying them through open-source research.

The map comes as officials warn the campaign is growing. On 28 September, EU foreign policy chief Kaja Kallas said in Brussels that Russia was planning more acts of sabotage to divide societies and intimidate them into abandoning their support for Ukraine. The points on the map represent an incomplete list of publicly known cases attributed to Russia or suspected of being linked to it, the report states.

The map covers airspace violations, sabotage attempts, “disposable” agents with no formal intelligence training, migration used as a weapon, and Russian military activity near or across European borders. It excludes cyberattacks, influence operations, and espionage by trained intelligence officers.

The EBU calls the result a very conservative estimate, not an official tally. Russia has consistently denied responsibility for the incidents. Many single points represent several incidents of the same type in one area or in quick succession. In Moldova, for example, Defense Minister Anatolie Nosatîi said on 30 September that the government had recorded 84 drone incursions.

Four German incidents are on the map, out of many more

The map shows four incidents in Germany, according to BR.

• On 2 August, German authorities arrested a 33-year-old Ukrainian man in Thuringia on suspicion of photographing a Bavarian weapons manufacturer for a foreign intelligence service as part of an alleged sabotage plot.
• On 4 August, a drone carrying explosives and a detonator struck the wing of a Ukrainian An-124 cargo plane at Leipzig/Halle Airport but failed to explode.
• On 3 September, attackers threw firebombs from a car onto a construction site next to defense firms in Munich, and German security authorities suspect Russian intelligence.
• On 14 September, investigators learned of a crashed drone found near the Bundeswehr’s Wunstorf air base.

Internal papers from the new Joint Hybrid Defense Center, seen by Correctiv, record 163 suspected sabotage cases in 2026 up to 19 August. The targets included rail lines, military facilities, substations, and radio masts. The same papers record 1,034 drone overflights of critical infrastructure, military sites, and defense companies, and 25 espionage investigations. The papers cover possible attacks by Russia, China, and Iran, and media did not report a breakdown of the sabotage cases by country.

European leaders sound the alarm over Russian hybrid attacks

On 15 April, Swedish civil defense minister Carl-Oskar Bohlin said pro-Russian groups had moved from denial-of-service attacks to attempts at destructive cyberattacks, including one on a Swedish power plant in 2025. On 1 September, German Foreign Minister Johann Wadephul named Russia as the perpetrator of the Leipzig attack and accused Moscow of “blatant hostility” toward Germany.

On 18 September, French President Emmanuel Macron said Russia’s hybrid attacks would not go unanswered and ordered a plan to protect France’s critical infrastructure. On 1 October, German Chancellor Friedrich Merz said Germany was preparing for new hybrid attacks, “including serious ones.” NATO Secretary General Mark Rutte on 14 October called the attacks a sign of Russian weakness at a press conference in Tallinn and said NATO would react where needed without being “rattled.”

Patrol density along Lithuania’s border with Russia’s Kaliningrad exclave has practically doubled since soldiers joined the border guards there in early October. Lithuanian Armed Forces Commander Raimundas Vaikšnoras told LRT this in an interview. He linked the deployment to provocations and to what he described as Russian preparations for a large-scale mobilization.

Kaliningrad is a piece of Russia wedged between Lithuania and Poland on the Baltic Sea. Lithuanian Defense Minister Robertas Kaunas said people would naturally flee a Russian mobilization. Earlier, on 11 August, President of Ukraine Volodymyr Zelenskyy said that Russia planned to mobilize several hundred thousand people by the end of 2026, after its parliamentary vote.

Commander: Russia lacks troops for a breakthrough

Vaikšnoras said Russia is struggling in Ukraine and needs to fill gaps in its capabilities. Moscow would probably like a breakthrough but lacks people, he added. In July, Ukraine’s Foreign Intelligence Service estimated that Russia had signed about as many new military contracts this year as it had lost troops.

He also cited provocations. In Latvia, armed men recently tried to push migrants across the border, he noted, leaving open whether they were bandits or criminals. Belarusian ruler Alyaksandr Lukashenka denies everything, he added. On 6 October, Latvian Interior Minister Jānis Dombrava wrote that the escorts stood on the Belarusian side, were armed, and threatened Latvian soldiers.

Mission extended to mid-November

Lithuania decided to send troops after that Latvian incident. On 7 October, Interior Minister Martynas Katelynas asked Defense Minister Kaunas for troops to help the State Border Guard Service. Kaunas then approved up to 100 soldiers until 16 October, LRT reported.

On 16 October, Kaunas extended the mission to mid-November at Katelynas’s request. The Defense Ministry cited possible flows of people fleeing Kaliningrad and related illegal border crossings. It also said military intelligence sees no significant changes in military activity in Kaliningrad. Katelynas had earlier called the step preventive, BNS noted. He cited public, non-intelligence reports of a call-up planned after Russia’s parliamentary elections and said the threat level at the border had not risen.

Commander doubts Moscow’s intentions

Vaikšnoras said Russia and Belarus may not want open incidents that leave their traces right now. He added that he does not believe in their good intentions. He noted it has been said publicly that Russia’s capability in Kaliningrad is sharply reduced, because most of its forces are committed to Ukraine. Back in June 2025, Poland’s foreign minister said that, from what he knew, Russia had withdrawn a large part of its troops from the exclave.

Instead, hybrid attacks and sabotage that cannot be traced at once will probably continue, Vaikšnoras said. LRT noted the interview took place before a Ukrainian drone crashed in Pasvalys district on Sunday and before an attempted arson at premises used by SpaceX in Vilnius.

German industry expects Russian sabotage against the country’s companies to persist and take more forms, the deputy head of the Federation of German Industries (BDI) told Handelsblatt. His warning follows alarms from Germany’s intelligence services, which describe the country as a main target of Russia’s covert campaign in Europe.

Russia keeps striking Ukrainian cities and power plants every day while trying to weaken the European support that keeps Ukraine fighting. Germany is home to arms makers producing with and for Ukraine, so pressure on its companies targets the supply behind Ukraine’s defense.

Industry expects attacks to last and change form

The warning came from Holger Lösch, the BDI’s deputy managing director.

“German industry is preparing for the threat to persist and for attack methods to become more varied,” he told Handelsblatt. “Companies don’t end up in the crosshairs by chance,” he added.

Russian influence and sabotage operations are no longer an abstract scenario, and companies, critical infrastructure, and defense supply chains are already among their targets, Lösch said. Companies now receive more threat warnings, and their cooperation with the authorities has improved significantly, he noted. “What is still missing are joint procedures to quickly derive concrete measures from warnings,” Lösch said, calling the protection of the economy a cornerstone of national security.

German intelligence describes a Russian shadow war

The warning comes a week after a public hearing of the intelligence oversight panel of the Bundestag, Germany’s parliament, on 5 October. There, Martin Jäger, head of Germany’s Federal Intelligence Service (BND), said Russia was waging a shadow war against Germany. “Germany has become a main obstacle to Russian hegemonic power projection in Europe and thus a target of Russian action,” Jäger said. “The danger of attacks against targets in Germany remains real and present,” he warned.

Sinan Selen, head of the Federal Office for the Protection of the Constitution (BfV), Germany’s domestic intelligence agency, told the same hearing that Russia was showing a readiness for sabotage and killings.

German Chancellor Friedrich Merz said on 1 October that Germany was preparing for further hybrid attacks, “including serious ones,” and would respond “quickly and very clearly,” as it did after the drone attack at Leipzig airport.

Drone bombs, arson, and paid saboteurs on German soil

In August, a drone carrying Semtex explosives hit the wing of a Ukrainian An-124 cargo plane at Leipzig/Halle Airport but did not explode. Germany blamed Russia on 1 September, and German Foreign Minister Johann Wadephul said Germany was not at war with Russia but was a “target of war.”

German authorities suspect Russian intelligence of commissioning an arson attack near two Munich defense firms, and a confidential Federal Criminal Police Office (BKA) assessment counted more than 165 suspected sabotage cases in Germany between January and August. The same assessment recorded 747 suspicious drone incidents involving 1,068 drones over critical infrastructure, military sites, and defense companies.

Explore further

The throwaway agents Moscow sent after a Bavarian drone boss arming Ukraine—and how Germany stopped them

Germany’s Military Counterintelligence Service (MAD) warns that the threat from low-level agents, locals paid small sums for one-off jobs such as arson or photographing military sites, has increased significantly. European intelligence agencies also report that Russia is increasingly targeting defense company executives, including at smaller drone makers, and the BfV has advised some German firms to hire close protection.

As long as Germany keeps backing Ukraine, Russian pressure on its companies is unlikely to ease, and the gap between warnings and action that industry flagged leaves smaller firms, with fewer resources for security, the most exposed.

Russia is expanding efforts to target European defense industry leaders as part of a broader campaign of sabotage and hybrid operations aimed at weakening support for Ukraine, the Financial Times reported on 11 October, citing officials from five European intelligence agencies.

The warnings come amid a wider increase in Russia-linked sabotage and other covert operations targeting European defense companies and critical infrastructure. Moscow is expanding its so-called hybrid warfare campaign against European countries as they continue to support Ukraine, using covert networks, intimidation, and suspected sabotage to undermine security and deter further assistance to Kyiv.

The FT reported that assassinations of civilian targets in Europe, once considered "taboo" even within Russian intelligence services, are becoming an increasingly prominent part of the Kremlin’s plans.

Russian operatives target defense industry leaders

European intelligence officials told the FT that Russian operatives are targeting chief executives and senior employees at defense companies, including smaller firms manufacturing drones and drone components. 

The campaign comes as Russia seeks to undermine European backing for Ukraine amid a battlefield stalemate and mounting pressure on the Russian economy.

The warnings have prompted defense companies to strengthen security around senior executives. Some have increased personal protection, while others have relocated production sites in response to suspected Russian threats, according to the FT.

Germany's domestic intelligence service, the BfV, has stepped up contact with employees and management at German defense companies and recommended that some use privately contracted close-protection teams, an agency official told the newspaper.

BfV chief Sinan Selen warned German lawmakers that Russia was deliberately planning acts of violence against individuals through state or state-controlled actors. He said the operations were evolving in their targets, methods, and use of organized crime networks.

Russia adapts its methods to carry out attacks

According to the intelligence officials cited by the FT, Russia's military intelligence agency, the GRU, has adapted its methods by working more closely with criminal groups and dividing surveillance, logistics, planning, and execution among different operatives.

Officials said some plots had been disrupted, while other cases involved surveillance of targets at home and at work.

The campaign's intended effect extends beyond any individual attack. One European intelligence official told the FT that the threat is psychological, designed to make people reconsider doing business with Ukraine.

Although some Russian operations remain amateurish and have been detected early, the resulting uncertainty forces companies to devote more resources to security. Smaller firms, which may have fewer resources to protect their personnel and facilities, could be particularly vulnerable.

Plot against Rheinmetall CEO raised alarm in 2024

European defense executives have been on heightened alert since 2024, when US and German intelligence agencies uncovered a Russian plot against Rheinmetall CEO Armin Papperger, a prominent advocate of supplying weapons to Ukraine.

Papperger has said he now receives round-the-clock protection from private security personnel and police.

The FT reported that European intelligence agencies now view threats against defense industry leaders as part of a broader effort to disrupt the production and supply of weapons to Ukraine, rather than isolated plots against individual executives.

Montenegro has ordered the expulsion of Mikhail Zvynchuk, head of the pro-Kremlin military information network Rybar, and four other Russian citizens over national security concerns following a security operation targeting suspected Russian hybrid influence activities, Vijesti reported on 9 October.

Zvynchuk is the founder and head of Rybar, a prominent Russian military-focused information network known for its Telegram channels covering Russia's war against Ukraine. The network promotes pro-Kremlin narratives and has been associated with Russian propaganda and influence operations.

Montenegrin police announced on 9 October that the five Russians had their residence rights revoked and were ordered to leave the country on national and internal security grounds. 

Montenegro investigates suspected Russian hybrid activity

The operation involved Montenegro's police and National Security Agency (ANB), which seized drones, high-resolution recording equipment, cameras, and several mobile phones for further examination, according to Vijesti.

According to Montenegrin authorities, the five had arrived in the country less than two days before the operation. The investigation is being conducted with support from international partners.

Montenegrin police identified the five Russian citizens as Zvynchuk, his wife Valeria Zvynchuk, Sergei Belous, Pavel Lekatorchuk, and Kira Doroshenko. Authorities said the case had been referred to prosecutors in Podgorica and Kotor.

The European Union has sanctioned Zvynchuk over activities that undermine or threaten Ukraine's territorial integrity, sovereignty, and independence. He has also been sanctioned by the United Kingdom, Switzerland, Australia, and Ukraine, according to Vijesti.

Suspected influence operation targeting EU integration

Vijesti reported, citing security sources, that Montenegrin authorities suspected the group of planning a documentary intended to undermine public support for the country's European integration.

According to the outlet, the planned material would portray Montenegro's expected alignment of its visa policy with EU standards as a politically imposed measure that threatens tourism, economic stability, and national interests.

Security services had monitored the group's arrival before carrying out the operation in Risan, in the Bay of Kotor area, Vijesti reported. The equipment seized from the group will undergo expert analysis to establish its intended purpose and use in Montenegro.

Medvedev threatens imprisoning “European and American idiots” for prisoner exchanges

Former Russian President Dmitry Medvedev responded to the operation by suggesting Moscow might need to expand its pool of prisoners to exchange for Europeans and Americans to secure Zvynchuk's return.

“We will probably have to replenish our pool of prisoners for exchange with European and American idiots,” Medvedev said, according to Vijesti.

Montenegro, a NATO member and EU candidate, has aligned itself with EU sanctions against Russia following Moscow's full-scale invasion of Ukraine in 2022. The expulsion comes amid broader European concerns over Russian intelligence activity, propaganda, and other forms of hybrid interference. 

Lithuania plans to deploy up to 100 soldiers to support border guards along its frontier with Russia's Kaliningrad Oblast, Defense Minister Robertas Kaunas said on 7 October.

Lithuanian Interior Minister Martynas Katelynas has described the deployment as a preventive measure linked to possible Russian mobilization and a recent incident on the Latvia-Belarus border, where masked, armed escorts tried to push a group of migrants into Latvia. Katelynas said Lithuania could face people trying to avoid mobilization and seeking asylum.

Kaunas said he had granted permission to use Lithuanian soldiers to strengthen border protection for the next several weeks.

 “The order starts being implemented immediately,” he wrote on Facebook.

Russia denies a new mobilization

The Kremlin denies a new mobilization is coming. In early September, Russian President Vladimir Putin called reports of one "complete nonsense" and "an information attack on Russia." Ukraine's military and foreign intelligence services say Russia's General Staff has prepared a scenario to mobilize 600,000 people over 2026 and 2027. On 28 September, President Volodymyr Zelenskyy said that "in effect, the Russians have already begun additional mobilization."

Frontier-station patrols for a couple of weeks, possibly longer

On 8 October, the Lithuanian army said soldiers were being brought in to help the State Border Guard Service from that day. A company-sized unit was planned for the assignment, initially for two weeks, with the option to extend. Soldiers will patrol with border guards in frontier-station areas, while mobile patrols, mobile observation posts, and military police crews may be added as needed. The army described the deployment as preventive and a normal form of interagency cooperation.

Kaunas had told LRT TV the soldiers would stay until 16 October. On the morning of 8 October, he said the deployment "was supposed to start" overnight and that he would check with the army. On 8 October, the Lithuanian army said soldiers were being brought in to help the State Border Guard Service from that day. Kaunas also said that “on the Kaliningrad side” there were no physical barriers, unlike the border with Belarus.

Lithuania says its border guards are stretched

On 8 October, Katelynas said the border guard service’s capacity was insufficient, with shifts growing while officer numbers were not increasing. He said the threat level had not changed. In a Facebook post the previous day, he said the situation at Lithuania’s border was calm and there was no reason to panic. He said Russia was planning mobilization after the elections and that Lithuania may face people trying to avoid it and seeking asylum.

Lithuania's State Border Guard Service had turned back 1,693 people trying to cross illegally from Belarus this year and about 26,300 since the migration crisis began, as reported by ELTA on 8 October. Katelynas said 43 migrants tried to enter southern Lithuania last week and were turned back.

Armed escorts in masks pushed a group of migrants from Belarus toward Latvia and threatened Latvian soldiers, and hours later masked people crossed into Latvia and stole border surveillance cameras, Latvian Interior Minister Jānis Dombrava said on 6 October. Latvia's military described the incident as part of a continuing hybrid campaign on the border, and Ukraine's foreign minister blamed Moscow.

Russia keeps probing the EU's eastern defenses with migrants pushed from its own soil and through its ally Belarus, alongside drone incursions and sabotage that ISW has linked into one Russian pattern across Europe.

Armed escorts threatened Latvian soldiers

Latvian soldiers stopped at least 20 migrants trying to cross the border illegally from Belarus, the Latvian National Armed Forces said. Masked escorts led the group, and this time they were armed, threatened the soldiers, and urged and drove the migrants toward Latvia, the military said.

"Unlike many previous incidents, this time the provocation was particularly demonstrative and aggressive," Dombrava said.

The incident confirms that deliberate provocations and hybrid threats on the border will continue, the armed forces said. Illegal migration is being used as a tool to pressure Latvia's border and, with it, the external border of the EU and NATO, they added.

Belarus began funneling migrants toward the EU in 2021, a campaign Poland's government called a hybrid attack in which the migrants end up as weapons. In 2023, Finland closed its border crossings with Russia, accusing Moscow of the same tactic, and by mid-July Latvia had logged 111 straight days of migrants pushed across from Belarus.

Masked people stole the cameras

Several hours after the standoff, people in masks entered Latvian territory, damaged a distribution cabinet, and stole surveillance cameras, Dombrava said. They returned to Belarus before the border guard patrol could arrive.

"Belarus should understand that such incidents could lead to more serious consequences for Belarus itself," he said.

Ukrainian Foreign Minister Andrii Sybiha said Ukraine stands in full solidarity with Latvia. "Make no mistake: Moscow is behind it," he wrote, adding that Russian President Vladimir Putin "deliberately weaponizes migration, with the help of Lukashenka, to destabilise Europe."

Tunnels, tear gas, and damaged cameras on the border

Latvia's border guards stopped 11,384 attempts to cross illegally from Belarus between the start of 2026 and 24 September. In January, Latvia's armed forces and border guard published evidence that Belarusian security agencies were organizing illegal migration across the border. Latvia has also recorded deliberate damage to cables, distribution cabinets, and camera poles on its eastern border, aimed at slowing the rollout of an automated border control system.

Explore further

Stop arming Ukraine or we shut down your defense firms, pro-Kremlin group tells Latvia, Poland, and Portugal

On 22 July, Latvian soldiers fired warning shots and used tear gas against migrants trying to cross. The next day, Prime Minister Andris Kulbergs said Russia and Belarus were stepping up their hybrid war against the Baltic States to distract from Russia's failures in Ukraine. Latvia temporarily halted crossings on the Belarus border on 31 July. In August, Latvian guards found the first tunnel dug from Belarus and turned back 15 migrants who used it.

French President Emmanuel Macron said French services received no CIA warning about a possible Russian drone attack from Mediterranean merchant ships, pushing back on an El Mundo report that US intelligence had alerted France, Italy, and Spain, RTL reported.

Macron’s denial comes amid drone attacks and sabotage cases that European governments have linked to Russia. France is preparing stronger defenses against that wider threat, even as Macron says its services received no specific CIA warning. Italy’s defense minister has also cautioned against fueling alarm over an unconfirmed report.

Asked about the report during a televised interview on 24 September, Macron said: “The CIA did not inform French services of such an attack.” He said Russia was multiplying hostile and sometimes criminal acts against European countries. Covert acts such as sabotage and cyberattacks are often described as hybrid warfare. Asked whether France itself could be attacked, Macron answered yes.

Italian Defense Minister Guido Crosetto separately wrote on X that El Mundo’s alert “finds no confirmation.” He said it served no one to add “more fuel to the fire” at an already tense time.

The Spanish newspaper reported that the possible operation would use Gerbera drones, small Russian aircraft capable of carrying several kilograms of explosives. The drones would be hidden in shipping containers aboard merchant ships and launched toward targets along Europe’s southern coast. El Mundo cited a source close to Lithuania’s Defense Ministry, and analysts familiar with a CIA report said to have circulated among European foreign ministries. Euromaidan Press covered the account on 24 September. Bythe time of publication, neither Spain’s government nor the CIA had publicly addressed it.

Macron pointed to the failed attack at Leipzig/Halle Airport in eastern Germany in August. A drone carrying explosives was found near a Ukrainian cargo aircraft. German officials attributed the attempt to Russia. Macron said France had not experienced a comparable incident.

The wider hybrid warfare threat

Beyond the disputed Mediterranean alert, authorities have investigated other incidents throughout Europe as possible Russian sabotage.

Germany followed its accusation over Leipzig with diplomatic measures against Moscow. Berlin ordered Russia’s last consulate in Germany closed and ended an agreement permitting a Russian cultural center. German investigators also identified two suspects, including a Russian man they linked to military intelligence. Moscow denied involvement.

Poland’s justice and interior ministers said Russian intelligence ordered the May 2024 arson of Warsaw’s Marywilska 44 shopping center.

Finnish President Alexander Stubb said Russia would continue such attacks to frighten Ukraine’s allies into reducing support. He urged vigilance without overreacting, saying Finnish intelligence saw no imminent military threat.

A Russian academic and an ultranationalist media owner have drawn up a menu of ways to knock out Starlink, the satellite network keeping Ukraine's drones and troops online, the Ukrainian defense outlet Militarnyi reported. The ideas run from jamming to a nuclear blast in space, and come as Poland investigates a suspicious fire at a Starlink ground station serving Ukraine.

Satellite internet is the nervous system of the drone war. Since a terminal cutoff early this year gutted Russian frontline coordination, Moscow's search for a workaround has widened from the spectrum to orbit—and from the battlefield toward the infrastructure that keeps the network alive.

The scenarios

Sergei Glazyev of the Russian Academy of Sciences and Konstantin Malofeyev, founder of the Russian outlet Tsargrad, laid out the proposals. Glazyev's list runs from cutting communication cables on land and undersea to crippling data centers and downing reconnaissance and command aircraft, whatever their nationality. Without American and British spotters, planners, and analysts, he claims, Ukraine's army would go blind. Glazyev's core argument is that Starlink satellites are not geostationary—nothing hangs over Ukraine, so the entire constellation must be struck at once.

For electronic warfare, they push wider use of the Volna Kupol Garant, a roughly $1.5 million system that beams a signal to briefly deafen a passing Starlink satellite over what its developers claim is up to 20 km². Kinetic options follow—the A-235 Nudol and S-500 Prometheus interceptors—though they call spending one costly missile on one cheap satellite "insane extravagance." A third idea scatters metal pellets to spark what the authors call the Kessler effect—a debris cascade that would destroy everything at that altitude.

The bluntest proposal detonates a nuclear device in space, its pulse frying electronics on low-orbit satellites. The authors admit this would also wreck Russia's own Rassvet network, which orbits at a similar altitude. "We can no longer hit Musk's creation for free," they write, "but it's still the optimal option. The legal consequences are unimportant."

Explore further

Russia’s answer to Starlink was written off as a failure—its satellites are still climbing

A station burns in Poland

On 23 September, fire destroyed the distribution panel of a ground Starlink station in Wola Krobowska that feeds Poland and Ukraine. Poland's Deputy Prime Minister Krzysztof Gawkowski said sabotage could not be ruled out and that the pattern matched Russian services' modus operandi. A bottle of flammable liquid was found beside the burned distribution panel, according to sources cited by RMF24. Exatel, which the minister named as the station's operator, said it only subleases the land and transmits data there, and neither operates nor owns the infrastructure.

Several recent incidents across Europe were conducted by Russia or are likely attributable to Russia, ISW assessed in its 24 September report, though authorities have not officially linked the Polish and German incidents to Moscow.

Russia's full-scale war against Ukraine has expanded into a parallel campaign of provocations against European defense and logistical infrastructure. The Kremlin is using drones, arson, and undersea cable sabotage to degrade Europe's will and ability to support Ukraine, while deliberately intensifying the frequency of airspace violations to erode the boundary between hybrid and kinetic war.

Drones over Moldova and Romania

Four Russian drones flew over Bukovyna and targeted an energy facility and border crossings with Moldova and Romania, Chernivtsi Oblast Military Administration head Ruslan Osypenko reported. Ukrainian forces shot down three. The fourth flew toward Suceava County in northeastern Romania.

A drone crashed in Cernița, Florești district, Moldova—preliminarily identified as a Russian Gerbera type, the first such device found in the country. It carried an onboard camera, hit a tree, and exploded, Moldovan police said. Romania's Defense Ministry reported a second aerial vehicle entered Romanian airspace for four minutes and crashed near Solca in the same border region; geolocated footage confirmed it was also a Gerbera, ISW noted. Poland evacuated the Hrubieszów and Dorohusk border crossings for 30 minutes, Prime Minister Donald Tusk said. Three countries were put on alert by a single night of Russian strikes.

"Intentional and accidental Russian drone incursions into NATO and Moldovan airspaces are likely part of the Kremlin's efforts to normalize airspace violations by intensifying their frequency," ISW assessed.

Sabotage in Poland and Germany

A fire engulfed the power system and backup generator at a Starlink ground station in Wola Krobowska, central Poland, on the evening of 23 September. Deputy Prime Minister Krzysztof Gawkowski confirmed it was sabotage aimed at cutting internet access, including for Ukraine's military. Authorities have not identified who was responsible, but the act aligns with Russia's "new" doctrine of attacks, Gawkowski said. The station is now operating normally.

German authorities suspended operations at Berlin-Brandenburg airport for 45 minutes the same evening after staff reported a drone sighting, Die Zeit reported. Federal police could not confirm it. ISW assessed both incidents fit Russia's wider pattern of sabotage against European defense assets, though neither has been officially attributed to Russia.

Explore further

Russian attack puts three countries on alert as drones enter Moldova and Romania

Western intelligence warnings

A Lithuanian Defense Ministry source reported on 23 September that Russia could launch Gerbera drones from a shipping container in the Mediterranean against Spain, France, and Italy. Danish Defense Intelligence assessed on 24 September that Russia will intensify its hybrid war in coming months, including destructive cyber attacks and sabotage carrying a high risk of casualties, and that there is a low but growing risk of a limited Russian military attack on a NATO border state. It sees no indications of an outright invasion. The CIA reportedly warned Poland that Russia may sabotage underwater cables to disrupt its banking system, according to Newsweek Polska journalists.

NATO tracked and confronted Russian submersibles rehearsing deployment of a new cable-disabling weapon near Svalbard in spring 2026—no cables were damaged, but the operation demonstrated Moscow's intent, Reuters reported. Shadow fleet vessels likely served as drone-launch platforms for incursions into NATO airspace, ISW noted.

"The increasing frequency of such warnings suggests that Western intelligence agencies are picking up indicators that the Kremlin is looking to diversify its platforms and means for conducting attacks against NATO and European states and is considering conducting such attacks," ISW assessed.

ISW said it has not yet seen evidence that Russia has conducted the attacks the warnings describe.

Denmark's assessment—that a limited Russian military strike on a NATO border state could come in the coming months—suggests the boundary between hybrid provocations and military action is narrower than European policy has assumed. ISW's synthesis reframes what governments have treated as separate incidents into one campaign.

"Intentional and accidental Russian drone incursions into NATO and Moldovan airspaces are likely part of the Kremlin's efforts to normalize airspace violations by intensifying their frequency," ISW assessed.

"The increasing frequency of such warnings suggests that Western intelligence agencies are picking up indicators that the Kremlin is looking to diversify its platforms and means for conducting attacks against NATO and European states and is considering conducting such attacks," ISW assessed.