Finland shut more than 2,000 people into a rock-hewn shelter that is normally a sports hall in Kuopio on 2 September, with some remaining overnight to practice operating the facility, the Associated Press reported. The two-day exercise, Shelter 2026, was the largest civil defense drill in Europe since World War II, by AP's account. Its scenario had cyberattacks cutting power and water while the threat of Russian missile strikes grew.

What two hours underground exposed

Three colleges got the alarm at 11:30 on 2 September, and students had about half an hour to reach the shelter, called Luola, or the Cave, Yle reported that evening. Staff barred the doors behind them. Partitions divided the sports hall into rooms of about 200 people. There were not enough beds, so people rested in shifts, and 60 dry toilets served everyone. The internet worked poorly, and the air grew heavy after an hour. The site holds up to 7,000 people under emergency law.

Antti Haataja, preparedness chief at the North Savo Rescue Department, said the move underground went calmly and faster than he expected. A real emergency would put those inside to work, he added, including emptying the toilets. More than a hundred people stayed through the night into 3 September, Yle said, while AP described hundreds sleeping on trestle beds.

Explore further

Finland ends nuclear weapons ban as parliament approves major NATO-aligned defense shift

Finland is reading Ukraine's experience

Retired Finnish Army Colonel Asko Muhonen, who organized the drill, said Finland has to learn from Ukraine, where people sometimes have only minutes to reach a metro station. What matters is cover they can actually get to, not a shelter that survives a nuclear blast. Ukraine's parliament is advancing a Finnish-style bill that would put one within 10 minutes of everyone.

Dmytro Untila, 20, a Ukrainian student in Kuopio, was at home in Odesa when Russian missiles hit the city on 24 February 2022, and waited the strike out in his building's entrance hall, having nowhere better to go. Training like this would have helped in Ukraine, he said, "because nobody knew this could happen."

The pressure Finland and its neighbors are drilling against

Finland shares more than 1,300 km of border with Russia and joined NATO with Sweden after the full-scale invasion of Ukraine. Shelters answer only part of the pressure. Russia is running a campaign of sabotage across Europe, Western officials say, a Russian aircraft is suspected of having entered Finnish airspace on 20 August, and US intelligence has warned that Poland and the Baltic states may face wider Russian hybrid attacks for backing Kyiv.

EU foreign ministers have given broad backing to an entry ban on Russians who fought in Ukraine and to stricter tourist visa rules for Russian citizens, DW reported. The bloc's foreign policy chief announced that support on 2 September, after an informal meeting in Wicklow, Ireland, without setting out what the tightening would involve. She tied the visa question to the risk of sabotage in Europe.

"Broad support," and nothing pinned down

EU foreign policy chief Kaja Kallas spoke to reporters after the ministers finished. 

"There was broad support for moving ahead with a ban on entry to the EU for Russian ex-combatants and tougher visa restrictions for Russian tourists," she said.

She did not name the restrictions planned for Russian tourists, say when they might take effect, or say which categories of Russian citizens they would cover.

The bloc has no unified position on tightening visa rules further, Kallas acknowledged. Some member states have so far argued against additional steps in that direction, she said.

Explore further

Russia’s former soldiers may face a locked EU border—if France and Italy stop balking

Many EU countries say tourist visas serve sabotage preparation

Reporters asked Kallas about accounts that one suspect in the Leipzig attack may have entered the EU on a tourist visa issued by Italy. German authorities have to confirm or refute those accounts, she said. If the information is correct, it shows that visas can be used to enter the bloc by potential wrongdoers who intend to harm it, she added. Many EU countries pointed out that tourist visas are used in preparing sabotage, because the people who carry it out need to get onto EU territory, she said.

Explore further

Russia’s ex-combatants entering the EU is a risk flagged in a leaked threat assessment

"It is not normal": Russians in Europe while Russia bombs Ukraine

Many ministers raised the visa question while the meeting was discussing Russia's war against Ukraine, Kallas said.

"It is not normal when a country bombs Ukraine, kills civilians—in July and August more than ever during this war—and at the same time Russians enter and enjoy the hospitality of European countries. That should not be," she said.

EU representatives said in July that the ban, kept separate from the tourist visa rules, was agreed in principle but still needed an evidence standard for refusing entry. The EU Council signs off after that, and the European Commission hoped at the time to finish by October.

Estonia is automatically diverting emails using Russia’s .ru internet domain into quarantine for additional security checks before they reach state institutions connected to the country’s secure government network, Justice and Digital Affairs Minister Liisa Pakosta told Estonia's public broadcaster ERR.

The measure is intended to protect Estonian government computer systems amid a post-2022 surge in cyberattacks that officials link to Russia. It applies only to institutions operating inside the secure state network, leaving local governments and some state bodies outside.

Many Estonian residents, particularly Russian speakers, still use .ru email services, ERR noted. Because the filter is triggered solely by the address ending, legitimate messages will be screened alongside potentially malicious ones and may take longer to arrive.

Pakosta said the safeguard was necessary because cyberattacks against Estonia had increased “exponentially” since 2022 and that many were linked to Russia. She said such attacks had not succeeded against Estonia, while major public-sector cyberattacks had succeeded in both Latvia and Lithuania.

The rerouting is automatic and handled centrally, so agencies do not need to take any action, Pakosta said. A large proportion of state institutions have already moved behind the government’s unified cyber shield, while the transition continues.

Pakosta described the quarantine as one small measure within Estonia’s wider cybersecurity work. Estonia’s courts have gone further, saying they will ask parties in legal proceedings to stop using .ru addresses for official communication, according to ERR.

How the Baltic states are hardening against Russia

Estonia's email quarantine forms part of a broader Baltic effort to limit Russian influence and strengthen defenses against military, cyber, and covert threats.

Estonia, Latvia, and Lithuania are constructing a Baltic Defense Line, a planned network of bunkers, anti-tank ditches, and other barriers, along their borders with Russia and Belarus. Latvia has also banned imports of Russian and Belarusian books, clothing, toys, and other goods.

The threat extends beyond cyberattacks: an Estonian court found that Russia’s military intelligence agency, the GRU, ordered the 2024 firebombing of a Ukrainian restaurant in Tallinn, part of a wider Russian sabotage campaign targeting European supporters of Ukraine.

An explosives-laden drone aimed at a Ukrainian cargo aircraft at Leipzig/Halle Airport was part of a Russian state operation, Interior Minister Alexander Dobrindt said on 1 September.

Germany has moved from suspecting foreign sabotage to formally blaming Russia for the Leipzig attack. The finding has prompted diplomatic and security measures against Moscow while the criminal investigation continues.

Police investigations, the attack pattern, and intelligence findings established Russian responsibility, Dobrindt said. The drones' configuration, components, explosives, and detonation systems resembled those used in other Russian hybrid operations—covert sabotage and disruption below the threshold of open war—and in Russia's war against Ukraine, Foreign Minister Johann Wadephul said.

The first drone, carrying explosives, was found near a Ukrainian cargo aircraft on the evening of 4 August and defused. Investigators believe a DHL freighter may have collided with a second drone while aborting its landing after the airport closed; that drone was never recovered. A third drone was found on 14 August in a field at Kabelsketal, where investigators subsequently discovered roughly 50 grams of suspected military explosive.

Leipzig/Halle is an international freight hub used by Ukrainian Antonov aircraft and NATO's strategic airlift program, through which allies charter heavy transport aircraft to move oversized military cargo.

Berlin will close the Bonn consulate on 18 September, end the operating agreement for the Russian House, a Moscow-backed cultural center, tighten entry controls for Russian nationals, seek to add more targets to EU sanctions lists, and pressure Russia's shadow fleet—opaquely owned tankers used to move Russian oil outside Western restrictions. Wadephul also summoned the Russian ambassador. Russia's Berlin embassy will remain open.

Russian Foreign Ministry spokesperson Maria Zakharova told Interfax that Moscow would respond to Germany's “anti-Russian action,” without specifying how.

NATO Secretary General Mark Rutte said the alliance stood in full solidarity with Germany, and European Commission President Ursula von der Leyen described Berlin's measures as a strong response.

Dobrindt said Germany expects further Russian hybrid attacks. The Leipzig incident follows a widening campaign of suspected Russian sabotage across Europe, including a 2024 incendiary-device attack at the same airport that Western security officials suspected Russian intelligence organized.

How the Leipzig attack unfolded

Euromaidan Press reported on 12 August, citing Die Zeit, that footage showed an explosives-laden quadcopter striking the wing of a parked Ukrainian Antonov An-124 before falling without detonating. The article also noted that a US Defense Department official told CNN that Washington assessed the drone belonged to Russian intelligence.

On 25 August, EP reported, citing Tagesschau’s NDR/WDR/SZ investigation, that investigators had expanded the case to three drones and found the third with suspected military explosive nearby in Kabelsketal, 10 days after the original attempt.

Wolfgang Kubicki, chair of Germany’s pro-business liberal Free Democratic Party (FDP), proposed that Berlin summon Russia’s ambassador and use the prospect of Taurus missiles for Ukraine as leverage against further hybrid attacks during an appearance on German broadcaster ntv.

Kubicki’s proposal does not change German policy. The FDP has no seats in the Bundestag, Germany’s federal parliament, while Chancellor Friedrich Merz has ruled out supplying the missiles. However, it recasts military aid to Ukraine as a potential cost Moscow would face for hybrid attacks inside Germany. Berlin has since formally blamed Russia for the Leipzig/Halle operation that prompted his remarks.

Kubicki said “a reasonable person” would tell the ambassador that Germany had so far withheld Taurus missiles. If the hybrid threat continued, Berlin should do everything possible to ensure Ukraine received the weapons it needed to defend itself against Russia, he added.

Taurus, the weapon Kubicki spoke about, is a German-Swedish cruise missile launched from military aircraft, with a range exceeding 500 kilometers. Ukraine has sought it for years to strike military targets far behind Russian lines.

Germany refused to supply Taurus missiles in 2025 while funding hundreds of Ukrainian-made long-range systems. Merz again ruled out a transfer in March, arguing that Ukrainian weapons were more effective.

Leipzig sharpens Germany’s hybrid-war debate

Germany formally blamed Russia on 1 September for the attempted drone attack at Leipzig/Halle Airport and said it would close the Russian consulate in Bonn and terminate the agreement under which the Russian House cultural center operates in Berlin, DW reported. Interior Minister Alexander Dobrindt cited evidence from German and allied intelligence services, as well as investigations across Europe. Russia has denied involvement.

The operation that prompted Kubicki’s warning involved an explosives-laden drone that struck the wing of a Ukrainian Antonov An-124 heavy cargo aircraft on the evening of 4 August but failed to detonate, Die Zeit reported. The airport handles civilian freight and NATO logistics, while Ukraine’s Antonov Airlines uses it as a base.

Investigators later found evidence that three drones were involved and discovered about 50 grams of suspected military explosive near the runways.

German investigators now count three drones around the failed 4–5 August attack on a Ukrainian cargo plane at Leipzig airport, Tagesschau reported on 25 August. Officers found the third machine and a suspected military explosive in a field near the runways. Security circles assume Russian intelligence services helped plan the attempt, and Russia denies any role.

A third drone and about 50 grams of suspected hexogen

Investigators found the third drone on the early evening of 14 August in a field in Kabelsketal, security circles told NDR, WDR, and the newspaper Süddeutsche Zeitung (SZ). The area borders the airport's western edge in Saxony-Anhalt. Forensic technicians from Germany's Federal Criminal Police Office (BKA) arrived that day, and the next day they reportedly found a substance at the site. First assessments put it at about 50 grams of hexogen, a military explosive known internationally as RDX. The perpetrators may have had a far larger attack in mind than what has become public, according to Tagesschau. 

The target was a Ukrainian plane

The drone found on the tarmac was meant to hit a Ukrainian Antonov cargo aircraft that moves military goods, according to the investigation cited by the public broadcasters NDR and WDR and SZ. The bomb never went off, because its detonator was apparently defective. The plane had been apparently loaded with ammunition the previous day. Leipzig/Halle carries military freight for the German armed forces and NATO allies, and Ukraine's Antonov Airlines uses it as a base, Euronews reported the same day.

Explore further

A bomb-laden drone hit a Ukrainian An-124 in Germany, then lay unnoticed for hours

The first drone turned up on the airport grounds at around 23:42 on 4 August. Shortly afterward, at about 00:03, a second drone reportedly collided with a cargo plane of the delivery company DHL. That aircraft had broken off its landing because the first find shut the airport, and it probably hit the drone at fence height at several hundred kilometers per hour. Neither that drone nor parts of it have turned up, NDR, WDR, and SZ reported. The German broadcasters placed the damage on the tail unit, while Bild gave a different account, putting the collision about six kilometers out with minor damage to the nose, Euronews said.

Camera footage analyzed after the attempt showed a quadcopter carrying Semtex plastic explosive fly into the wing of a parked An-124 Ruslan without detonating, and Washington assessed that the drone belonged to Russian intelligence. The same airport saw a parcel ignite in July 2024, before crews could load it onto a DHL cargo plane, in what security services treated as a suspected Moscow-linked arson plot.

State-protection officers at the BKA work under orders from Federal Prosecutor General Jens Rommel to establish how the attack was meant to run and who is responsible. Investigators are following several leads, among them recovered DNA. Germany ranks among Ukraine's biggest military backers, and its authorities suspect Russia of orchestrating many of the drone incidents as part of a campaign of sabotage, espionage, and disinformation, Euronews said.

Polish officers have detained a Ukrainian accused of trying to murder a figure from Ukraine's weapons sector on Moscow's orders, Reuters reported. Investigators say his homemade explosive failed to detonate, and he fled to Poland, where officers detained him. The case is the latest in a run of Russian-directed plots targeting people tied to Ukraine across Europe.

A car bomb that failed

The suspect, named only as Serhii P. under Polish privacy rules, allegedly went after a figure in Ukraine's weapons sector in Irpin, a town in Kyiv Oblast just northwest of the capital. The ABW, Poland's Internal Security Agency, said he planted an improvised explosive device under a car used by the potential victim. The device was meant to be set off remotely with a cellphone, but it "did not detonate due to a malfunction," the agency said.

The suspect, a 63-year-old Ukrainian, fled to Poland after the attempt collapsed and was arrested in Warsaw on 5 August 2026, the Ukrainian outlet NV says. Polish authorities announced the arrest on 20 August and said it kept him from using Poland as a hideout while he dodged investigators. Prosecutors charged him with trying to kill with a bomb and with holding explosives without a permit. The charges carry a floor of 15 years behind bars and a ceiling of life, they said.

Explore further

Ukraine detains organizer of defense industry event struck by Russian missile that killed 10, charged with negligence

The ABW framed the case as proof that Russian intelligence runs operations far beyond its own borders, using people who move between countries to do the work. For years, Kyiv and Western capitals have said Moscow enlists people — Ukrainians among them — to run sabotage and spying missions, a charge Russia keeps rejecting.

A pattern across Europe

The plot fits a wider Russian campaign. Weeks earlier, Warsaw detained a Russian man whom Moscow had allegedly recruited to murder a Ukrainian-American in the same city. 

Earlier this year, Ukrainian investigators recently exposed a coordinated scheme to kill a Russian dissident and Ukraine supporter in Lithuania, German prosecutors filed sabotage charges against a Ukrainian and a Latvian, and an earlier plot targeted the chief of German arms-maker Rheinmetall.

Poland and the Baltic States have been named prime targets for Russian sabotage over their backing for Kyiv.

A deliberately set fire at a Tallinn building used by Milrem Robotics did not disrupt its deliveries of military ground robots to Ukraine, CEO Kuldar Väärsi told Reuters on 19 August 2026. Estonian prosecutors said three suspects had been detained in Latvia.

The Milrem arson case fits in a broader pattern of suspected or confirmed sabotage against Ukraine’s military supply chain. Similar attacks throughout Europe have hit plants making drones, thermal optics, and other equipment for the front. Milrem supplies unmanned ground vehicles (UGVs) that help Ukrainian units move supplies and evacuate wounded without putting drawing upon valuable manpower.

The fire broke out overnight on 15 August in Tallinn’s Lasnamäe district after a resident reported suspicious activity. Nobody was injured, and Milrem has not disclosed what was damaged.

Milrem says it is one of only two foreign suppliers with unmanned ground vehicle (UGV) fleets in active Ukrainian service and expects more than 200 of its systems to be operating there by year-end.

The Netherlands is funding more than 150 additional Milrem vehicles for Ukraine. In June, Milrem and VDL Defentec opened a Dutch production line to support the delivery of more than 100 THeMIS UGVs. Väärsi the fire had not affected production, supply chains, or delivery schedules for this year or next.

Unmanned ground vehicles (UGVs) are tracked or wheeled machines with no crew aboard. ArmyInform reported that Ukrainian troops use them to carry ammunition, fuel, and food along exposed routes. A Ukrainian commander identified only as Nazar told ArmyInform that frontline units still rely mainly on UGVs for logistics, although some robots carry explosives.

Three suspects detained as investigators examine possible Russian role

State Prosecutor Gardi Anderson said prosecutors suspect all three detainees of taking part in the arson. Latvian authorities are holding them while the two countries arrange their transfer to Estonia. An Estonian court approved prosecutors’ requests to place two in pretrial detention. A decision on the third remained pending.

Estonian Prime Minister Kristen Michal said investigators were examining whether the fire was the result of sabotage and whether Russia was involved. Authorities have not disclosed the suspects’ alleged motive, whether anyone directed them, or released evidence connecting the attack to Moscow.

Arson has hit other European suppliers to Ukraine

In March, a fire destroyed nearly all of the production capacity at a Czech plant that makes drones and thermal optics for Ukraine. Authorities detained four suspects while investigating possible terrorism and Russian involvement.

Lithuania also charged six people over an attempt to burn a factory supplying radio-wave scanners to Ukraine. Investigators said Russia-based organizers with GRU links coordinated the operation and connected the network to attempted attacks elsewhere in Europe.

Russia has denied Western accusations that it conducts sabotage in Europe.

Estonia is investigating whether Russia was behind a suspected arson attack at a Tallinn building used by Milrem Robotics, Prime Minister Kristen Michal said on 18 August.

Officials have not released evidence yet connecting Moscow to the fire.

The fire hit a site used by a defense contractor that makes unmanned ground vehicles, including THeMIS vehicles used in Ukraine. The Estonian investigation into the Milrem fire comes amid suspected or confirmed arson plots against other European factories supplying Ukraine.

Estonian prosecutors said the fire, which began overnight into 15 August, may have been deliberately set. A resident reported suspicious activity nearby. Investigators identified suspects and asked a court to detain them. No one was injured, and Milrem CEO Kuldar Väärsi told the Estonian outlet Postimees that it was too early to assess the damage.

The company executive said the site was not an office building but declined to identify its contents or what was damaged, including whether unmanned ground vehicles were inside. The company has not said whether production or deliveries were affected.

Milrem’s THeMIS vehicles have operated in Ukraine since 2022. By 2023, the company had delivered 15 of the vehicles to Ukrainian forces and border guards. A Dutch-funded order for more than 150 additional vehicles followed in 2025. A new Dutch production line began making them in June 2026 and handed over its first vehicles for Ukraine.

Other factories supplying Ukraine have faced arson

In March, a fire damaged a Czech facility belonging to LPP Holding, which had supplied hundreds of AI-guided drones to Ukraine. Czech authorities investigated possible terrorism and later detained a fourth suspect.

In January, Lithuania charged six people over an attempt to burn a factory supplying radio-wave scanners to Ukraine. Investigators said Russia-based organizers with GRU links coordinated the operation and connected the network to attempted attacks elsewhere in Europe.

Estonia has traced earlier attacks to Russian intelligence

Estonia has also uncovered Russian-directed attacks on its own territory. In 2024, Estonia’s security service detained 10 people over a Russian-coordinated operation that included damaging cars belonging to then-Interior Minister Lauri Läänemets and a journalist and defacing monuments. Officials said the operation sought to spread fear and tension. Journalists from The Insider, Re:Baltica, and Delfi reported how the GRU recruited Baltic residents for vandalism and arson.

In 2025, an Estonian court found that a Moldovan national working for the GRU burned a supermarket as a trial run before firebombing a Ukrainian restaurant in Tallinn. His cousin filmed the second attack.

Those cases explain why investigators are examining a possible Russian role in the Milrem fire, but they do not establish who caused it.

Russia may expand hybrid attacks against Poland and the Baltic states, including infrastructure sabotage or false-flag attacks, Bloomberg reported on 12 August, citing an unnamed European intelligence official. 

The warnings come amid concern that Moscow wants to intimidate Ukraine’s supporters. The CIA warning follows Russian threats, incursions, alleged sabotage plots, and disinformation against Poland and the Baltic states. Most Western military aid reaches Ukraine through Poland, while the Baltic states rank among Kyiv’s strongest supporters. Sabotage of transport, energy, or communications can slow aid delivery and test NATO while hiding Russia’s role.

Separately, a European government official told Bloomberg that the CIA had warned countries in the region of a possible future Russian attack. The CIA declined to comment.

The same official said Russia might instead be creating the impression of an impending attack to sow fear as part of an information operation. The official saw no signs that Moscow was preparing a conventional attack or invasion.

Moscow tests NATO’s eastern flank

Poland and Lithuania had already raised similar concerns. In July, Poland said it had credible intelligence that Russia was planning new provocations. Lithuania later warned that Moscow might rebuild captured Ukrainian drones for false-flag strikes on critical infrastructure.

In September 2025, between 19 and 23 Russian drones entered Polish airspace, shutting down airports and damaging buildings. Poland closed four airports as NATO aircraft responded.

Meanwhile, five people are on trial in Lithuania over attacks allegedly organized for Russian military intelligence in 2024, Bloomberg reported. Lithuania has reinforced infrastructure sites and deployed troops since June.

These warnings and incidents place the CIA alert within a wider pattern of pressure on NATO’s eastern flank and Ukraine’s supporters. 

How Russia strikes without starting a war

Bloomberg cited several recent unexplained drone incidents in Germany alongside the CIA warning. Citing Die Zeit, Euromaidan Press reported that an explosive-laden drone struck the wing of a parked Ukrainian An-124 at Leipzig-Halle airport and failed to detonate. A US Defense Department official in Europe told CNN that Washington assessed the drone belonged to Russian intelligence. 

Bloomberg also reported that a cargo plane hit an unidentified object and that drones appeared over a military base the following day. It did not connect either incident to Russia.

More broadly, Russian hybrid operations have grown sharply since the full-scale invasion. CSIS found that attacks in Europe tripled from 2023 to 2024, after quadrupling the previous year. Separately, the US Helsinki Commission mapped nearly 150 operations in NATO territory attributed to or suspected of Russia between February 2022 and November 2024.

Retired Lt. Gen. Ben Hodges told Euromaidan Press in February that attacks on ports, railways, and cables can probe routes needed for NATO reinforcements. Their deniability raises the political cost of responding.

By hiding its role, Moscow can disrupt support for Ukraine and test NATO without openly starting a war.