Journalists from 17 European public service broadcasters, coordinated by the European Broadcasting Union’s (EBU) Eurovision News Spotlight network, published an interactive map on 23 October 2026. It documents hybrid incidents linked to Russia across 17 European countries between 1 April and 15 October. Journalists compiled a database of hundreds of reported incidents, categorizing each by type and the source and strength of its alleged links to Russia, then verifying them through open-source research.

The map comes as officials warn the campaign is growing. On 28 September, EU foreign policy chief Kaja Kallas said in Brussels that Russia was planning more acts of sabotage to divide societies and intimidate them into abandoning their support for Ukraine. The points on the map represent an incomplete list of publicly known cases attributed to Russia or suspected of being linked to it, the report states.

The map covers airspace violations, sabotage attempts, “disposable” agents with no formal intelligence training, migration used as a weapon, and Russian military activity near or across European borders. It excludes cyberattacks, influence operations, and espionage by trained intelligence officers.

The EBU calls the result a very conservative estimate, not an official tally. Russia has consistently denied responsibility for the incidents. Many single points represent several incidents of the same type in one area or in quick succession. In Moldova, for example, Defense Minister Anatolie Nosatîi said on 30 September that the government had recorded 84 drone incursions.

Four German incidents are on the map, out of many more

The map shows four incidents in Germany, according to BR.

• On 2 August, German authorities arrested a 33-year-old Ukrainian man in Thuringia on suspicion of photographing a Bavarian weapons manufacturer for a foreign intelligence service as part of an alleged sabotage plot.
• On 4 August, a drone carrying explosives and a detonator struck the wing of a Ukrainian An-124 cargo plane at Leipzig/Halle Airport but failed to explode.
• On 3 September, attackers threw firebombs from a car onto a construction site next to defense firms in Munich, and German security authorities suspect Russian intelligence.
• On 14 September, investigators learned of a crashed drone found near the Bundeswehr’s Wunstorf air base.

Internal papers from the new Joint Hybrid Defense Center, seen by Correctiv, record 163 suspected sabotage cases in 2026 up to 19 August. The targets included rail lines, military facilities, substations, and radio masts. The same papers record 1,034 drone overflights of critical infrastructure, military sites, and defense companies, and 25 espionage investigations. The papers cover possible attacks by Russia, China, and Iran, and media did not report a breakdown of the sabotage cases by country.

European leaders sound the alarm over Russian hybrid attacks

On 15 April, Swedish civil defense minister Carl-Oskar Bohlin said pro-Russian groups had moved from denial-of-service attacks to attempts at destructive cyberattacks, including one on a Swedish power plant in 2025. On 1 September, German Foreign Minister Johann Wadephul named Russia as the perpetrator of the Leipzig attack and accused Moscow of “blatant hostility” toward Germany.

On 18 September, French President Emmanuel Macron said Russia’s hybrid attacks would not go unanswered and ordered a plan to protect France’s critical infrastructure. On 1 October, German Chancellor Friedrich Merz said Germany was preparing for new hybrid attacks, “including serious ones.” NATO Secretary General Mark Rutte on 14 October called the attacks a sign of Russian weakness at a press conference in Tallinn and said NATO would react where needed without being “rattled.”

NATO's Military Committee, the Alliance's highest military body, visited Kyiv on 6 October to reaffirm support for Ukraine, its chair, Admiral Giuseppe Cavo Dragone, said. It was the committee's first official visit to Ukraine's capital in eight years. The officers came to hear how Ukraine is fighting Russia and to draw lessons for NATO's own defense, and Dragone used the visit to warn Moscow.

Russia's war no longer stays inside Ukraine: its drones, saboteurs, and pressure campaigns increasingly reach NATO members. That turns Ukraine, the only European army facing Russia in combat, from a country the Alliance helps into one it learns from.

All 32 allies at the table

Dragone brought the military representatives of all 32 member states to hear the latest battlefield assessment directly from Ukraine's commander-in-chief, Mykhailo Drapatyi, and his staff. They also came to learn what more NATO can do to support Ukraine, he said in an address recorded in Kyiv.

"After eight years, the NATO Military Committee comes back to Kyiv for an official visit. But while we were not physically present here, Ukraine is in our thoughts, in our discussions, in our decisions and following action every single day," Dragone said.

The visit fulfilled a promise he made to Drapatyi during their last conversation in August, the admiral said. It also follows a June visit to Kyiv by the North Atlantic Council, NATO's main political decision-making body. "We are here in full strength with a clear message. The bond between NATO and Ukraine is stronger and stronger," he said.

Lessons from Ukraine's commanders

The talks with Drapatyi focused on Ukraine's military priorities and lessons learned to strengthen Allied preparedness for current and future threats, Dragone wrote on X. The delegation also paid respects at the Wall of Remembrance of the Fallen for Ukraine in Kyiv.

Explore further

14 dead in Pryluky, two each in Kyiv, Kremenchuk, and Oleksandriia: Russia’s night of 70 missiles

In his address, Dragone said Ukraine's courageous and resilient spirit remains unbreakable and serves as an example to other nations.

"An example that combines with all the lessons we can learn from your commanders, from their experience, which will ultimately help our Alliance too to better face today's and tomorrow's threats," he said.

To Russia: "You are failing"

Dragone also addressed Russia directly. NATO stands unwavering with Ukraine in the face of Russia's continued aggression and its reckless hybrid activities in member countries, he said.

"To those who think that by perpetrating acts of sabotage, cyberattacks, and violation of the airspace in national NATO territory they will undermine this support and our resolve, I will respond: You are failing. NATO support for Ukraine continues to grow, and our unity is stronger than ever."

Russia bears full responsibility for such dangerous and unacceptable behavior, and allies will keep sharpening their tools and strengthening deterrence and defense, the admiral added.

Drapatyi became Ukraine's commander-in-chief in July, when President Volodymyr Zelenskyy replaced Oleksandr Syrskyi after a week of political turmoil.

Kyiv under fire, Russian troops pushed back near Lyman

The day after the visit, Russia struck Kyiv and 12 oblasts with about 70 missiles. In recent weeks, Russian attacks have cratered the capital's bridges and hit a school, a café, and warehouses, as well as a maternity hospital. Ukrainian troops also retook ground near Lyman in the Vivaldi counteroffensive.

Only the US and Israel were hit by more cyberattacks than Ukraine this year. Ukraine ranked third in the world and first in Europe among the countries whose organizations and users were most often targeted by cyberattacks in the first half of 2026, accounting for 4.8% of all victims worldwide, up from fifth in the world and third in Europe a year earlier, Microsoft said in its Digital Defense Report 2026.

Microsoft processes more than 165 trillion security signals a day, which lets it show how often attackers go after customers in each country. Russian state hackers aimed 14% of their recorded activity at Ukraine, more than at any country except the US.

The era of machine-speed cyberattacks is here

Government agencies and services were the most targeted sector worldwide at 27%, up from 17% in 2025. Phishing drove 23% of intrusions Microsoft investigated, up from 7% a year earlier, and the median time from finding a vulnerability to weaponizing it has fallen well below 24 hours.

The use of artificial intelligence is pushing cyberspace into an era of “machine-speed” attacks that operate continuously and without fatigue, according to Dev.

“Many AI agents act on behalf of users and with their access rights, so a compromised agent combines user-level access with machine-scale actions,” Natalia Burlakova, Security Sales and Engineering Lead at Microsoft, says.

Deception beats code in attacks on Ukraine

Ukraine's own agency data show a similar pattern. Malware accounted for 33% of cyber incidents in the first half of 2026, and social engineering 31%, the State Service of Special Communications and Information Protection reported on 30 September. System infections made up 15%, and system compromises 4.5%.

Attackers rely less on technical complexity than on trust, according to the report by Ukraine's computer emergency response team, CERT-UA. Hacker groups create fake pages that mimic CERT-UA, Ukraine's Parliament's document management system, and the Brave1 defense technology platform.

Microsoft urges five government steps

Microsoft asks governments to prepare for faster-moving threats by assigning roles and coordinating agencies in advance of a crisis, and to treat AI security as part of national resilience. It also asks them to plan for incidents that spread, noting that 52.2% of intrusions involving valid accounts led to additional credential theft.