French President Emmanuel Macron said French services received no CIA warning about a possible Russian drone attack from Mediterranean merchant ships, pushing back on an El Mundo report that US intelligence had alerted France, Italy, and Spain, RTL reported.

Macron’s denial comes amid drone attacks and sabotage cases that European governments have linked to Russia. France is preparing stronger defenses against that wider threat, even as Macron says its services received no specific CIA warning. Italy’s defense minister has also cautioned against fueling alarm over an unconfirmed report.

Asked about the report during a televised interview on 24 September, Macron said: “The CIA did not inform French services of such an attack.” He said Russia was multiplying hostile and sometimes criminal acts against European countries. Covert acts such as sabotage and cyberattacks are often described as hybrid warfare. Asked whether France itself could be attacked, Macron answered yes.

Italian Defense Minister Guido Crosetto separately wrote on X that El Mundo’s alert “finds no confirmation.” He said it served no one to add “more fuel to the fire” at an already tense time.

The Spanish newspaper reported that the possible operation would use Gerbera drones, small Russian aircraft capable of carrying several kilograms of explosives. The drones would be hidden in shipping containers aboard merchant ships and launched toward targets along Europe’s southern coast. El Mundo cited a source close to Lithuania’s Defense Ministry, and analysts familiar with a CIA report said to have circulated among European foreign ministries. Euromaidan Press covered the account on 24 September. Bythe time of publication, neither Spain’s government nor the CIA had publicly addressed it.

Macron pointed to the failed attack at Leipzig/Halle Airport in eastern Germany in August. A drone carrying explosives was found near a Ukrainian cargo aircraft. German officials attributed the attempt to Russia. Macron said France had not experienced a comparable incident.

The wider hybrid warfare threat

Beyond the disputed Mediterranean alert, authorities have investigated other incidents throughout Europe as possible Russian sabotage.

Germany followed its accusation over Leipzig with diplomatic measures against Moscow. Berlin ordered Russia’s last consulate in Germany closed and ended an agreement permitting a Russian cultural center. German investigators also identified two suspects, including a Russian man they linked to military intelligence. Moscow denied involvement.

Poland’s justice and interior ministers said Russian intelligence ordered the May 2024 arson of Warsaw’s Marywilska 44 shopping center.

Finnish President Alexander Stubb said Russia would continue such attacks to frighten Ukraine’s allies into reducing support. He urged vigilance without overreacting, saying Finnish intelligence saw no imminent military threat.

Within 24 hours of claiming Ukrainian troops were surrounded near Dobropillia, Russia’s Defense Ministry and pro-war channels expanded the narrative to several supposed encirclements in northern Kharkiv Oblast. Evidence supports none of that, the Institute for the Study of War (ISW) has said.

The claims come as Ukrainian forces make gains in several frontline sectors, according to ISW. Near Dobropillia, Russian bloggers described the ability to fire on supply roads rather than troops surrounding the town. At the same time, Ukrainian forces said they had prevented Russia from physically cutting the routes.

Russia’s Defense Ministry claimed its forces had captured Krasnyi Yar and Potykhonove northeast of Kharkiv. Pro-war bloggers then claimed Russian troops threatened to trap Ukrainian units near Riznykove and had already surrounded others near Rublene. One asserted that roughly 1,500 Ukrainian soldiers were encircled across 460 square kilometers.

ISW found no evidence for those claims. A Ukrainian brigade spokesperson said Russian forces were still shelling settlements they claimed to hold and described positions in the area as heavily intermingled, with no clear front line.

Around Dobropillia, the Kremlin-linked Rybar channel claimed Russian troops were infiltrating toward nearby settlements and making tactical gains south of the town. It did not claim Russian forces had secured those settlements or show an encirclement on its map, ISW noted.

Another Russian blogger said neither side currently had the forces needed to establish and sustain a genuine encirclement.

Russia’s push toward Dobropillia continues

Russia’s Defense Ministry had claimed on 22 September that its troops surrounded Dobropillia, a transport hub on the approach to Ukraine’s fortified cities in Donetsk Oblast.

ISW found no evidence for that claim and linked its timing to the UN General Assembly and Ukraine’s recent battlefield gains. A Ukrainian officer said Russian troops had made no major advances near the town.

Russian assaults continue despite that setback. A Ukrainian staff sergeant reported a sharp increase in the number of small groups trying to reach Dobropillia. On 23 September, Ukraine’s 1st Azov Corps said its forces had prevented Russian troops from physically cutting supply routes toward Dobropillia and Druzhkivka.

Moldova’s Defense Ministry reported four drone incursions, Romania’s Defense Ministry confirmed a drone crash, and Poland’s Operational Command scrambled fighters twice during Russia’s 24 September attack on Ukraine.

The strike wave forced Moldova to close part of its airspace, Romania to warn residents and launch F-16 fighter jets, and Poland to activate aircraft, air defenses, and radar. No casualties were reported in the two confirmed crashes, and Poland detected no incursion during its first deployment. Moldova has recorded dozens of Russian drone incursions this year.

The drones approached from Ukraine’s Vinnytsia, Odesa, and Chernivtsi oblasts, according to Moldova’s Defense Ministry. Authorities temporarily closed part of the country’s northern airspace.

Near Cernița in northern Moldova, one drone struck a tree, fell into a field beside a farm, and exploded, police said. No casualties were reported.

Investigators preliminarily identified the camera-equipped wreckage as a Gerbera, a low-cost Russian drone often used during attacks on Ukraine. Police said it was the first device of that type found in Moldova.

Police also reported a resident’s account of another explosion near Vadul Rașcov, but said they were still investigating the location.

Romanian radar first tracked an aerial target over Ukraine near the border before it entered northern Romania, the Defense Ministry said. Romania launched two F-16s and sent emergency alerts to residents’ phones in the area. The drone remained in Romanian airspace for about four minutes before crashing near Solca, the ministry said. Officials reported no casualties or damage and had not identified the drone’s origin.

Poland’s Operational Command launched fighters twice in response to Russian strikes on western Ukraine. The first Polish deployment ended around 08:00 with no airspace violation detected; the command announced a second at 09:07. It also activated ground-based air defenses and radar.

The incursions came amid a wider assault. Ukraine’s Air Force said Russia launched 282 drones of various types, along with ballistic and other missiles, overnight into 24 September. Ukrainian officials reported detecting four drones over Chernivtsi Oblast, the Ukrainian region bordering Moldova and Romania, and shooting down three.

Moldova’s repeated airspace breaches

The latest incident followed several breaches in August. An unidentified drone exploded near Crocmaz on 9 August. Another object exploded near Talmaza on 17 August after Moldova briefly closed part of its airspace.

President Maia Sandu said Russian drones had entered Moldovan airspace 39 times in 2026, compared with 17 times throughout 2025. Moldova has portable air-defense weapons and electronic warfare equipment, but Sandu said these chiefly protect individual sites. Her government is working with partners to expand air-defense coverage and speed up threat warnings.

A court in Pula ruled that Ukrainian diving instructor Volodymyr Zhuravliov may be extradited to Germany over the September 2022 blasts that damaged the Nord Stream gas pipelines between Russia and Germany and caused major leaks in the Baltic Sea, RBC-Ukraine reported, citing his lawyers.

A Polish court refused to extradite Zhuravliov last year, but its ruling did not cancel Germany’s EU-wide arrest warrant. Croatia could therefore arrest him and decide Germany’s request for itself. The pipelines at the center of the case were built to carry Russian gas to Germany while bypassing Ukraine.

The firm Katerynchuk, Moor & Partners said it expected to receive the written ruling shortly and was preparing to challenge it in Croatia’s appellate court and before international judicial bodies. Zhuravliov also plans to announce an indefinite hunger strike. His lawyers said the Croatian court had disregarded the earlier Polish decision.

The Warsaw court refused to surrender Zhuravliov in October 2025, finding that the pipelines could be treated as a legitimate military target during an armed conflict. It released him from custody.

His Polish lawyer, Tymoteusz Paprocki, said Zhuravliov understood that the ruling applied only within Poland: under a European arrest warrant, the country where a suspect is arrested decides whether to send them to the country seeking them.

Germany amended the warrant in early September to add a war-crime classification, according to Zhuravliov’s lawyers. The change prompted the Croatian court to postpone an earlier hearing. The lawyers’ account of the amendment has not been independently confirmed.

How the Nord Stream case reached Croatia

Nord Stream 1 and 2 were built to carry Russian gas directly to Germany while bypassing Ukraine. Explosions on 26 September 2022 damaged three of their four lines; Nord Stream 2 had never entered service.

Germany issued a warrant for Zhuravliov in 2024. German prosecutors say he helped place explosives on the pipelines near Denmark’s Bornholm island. He denies involvement. Croatian police arrested him in Pula on 19 August 2026 under the European warrant.

Another Ukrainian suspect, Serhii Kuznietsov, was arrested in Italy in 2025 and later sent to Germany, where prosecutors have charged him over the explosions. He denies involvement. No court has established who ordered the attack.

Since Madagascar’s October 2025 coup, Russian military personnel have joined the parliament speaker’s security detail, and Russian instructors have begun training Malagasy soldiers, RFE/RL reported. OSINT investigators traced a flight carrying a senior Russian military intelligence officer and 40 of Russia's Africa Corps members to the island on 20 December 2025.

Madagascar’s new leadership has welcomed Russian military assistance, while Moscow has pursued media projects, energy talks, and the possible recruitment of Malagasy workers. RFE/RL says the prospective destination is Alabuga, a plant producing drones used against Ukraine. Elsewhere in Africa, Russia has sent troops, sought access to resources, and opened cultural centers.

Major General Andrei Averyanov, who oversees Russian military intelligence operations in Africa, was on the December flight. He traveled with members of Africa Corps, a Russian Defense Ministry unit that absorbed some Wagner forces. Madagascar's National Assembly speaker Siteny Randrianasoloniaiko announced the unit’s arrival that month.

Russian intelligence officer Anton Papshev attended the January launch of training for Madagascar’s 1st Airborne Battalion. The program also included a transfer of Russian weapons, though RFE/RL did not specify which ones. In February, interim President Michael Randrianirina met Vladimir Putin in Moscow and welcomed wider cooperation on defense, energy, and other areas.

Russian authorities signed a deal with Randrianasoloniaiko to open a Russia House, a Kremlin cultural center. Ukraine’s military intelligence said Moscow plans to expand the network across Africa to influence young people. Madagascar also authorized a branch of African Initiative, a Russia-linked media organization that helped National Radio launch a “Russ-Mada” program.

RFE/RL said Russian authorities appear to intend to recruit Malagasy workers for Alabuga, a drone assembly plant in Russia’s Tatarstan region.

The plant has recruited thousands of workers, mainly young women from Africa and Central and South Asia, for relatively high-paying jobs. Richard Rakotonirina, head of Madagascar’s Friends of Russia association, visited Alabuga in February. RFE/RL did not establish that any Malagasy workers had been recruited.

Explore further

Moscow recruits African women to produce drones in horrific conditions — investigation exposes large-scale fraud

During a visit to Moscow, Madagascar’s prime minister discussed Russian fuel supplies, oil storage on the island, and military training.

A Russian delegation also visited an abandoned naval base that Madagascar and France had already agreed to study restoring. RFE/RL did not report any agreement giving Russia access to the base.

Russia’s wider reach in Africa

Madagascar’s emerging ties resemble security arrangements Moscow has built elsewhere in Africa. In the Central African Republic, Russian mercenaries guarded officials and trained troops in exchange for access to gold, diamonds, and timber, RFE/RL reported. Russia's Africa Corps protects the Republic of the Congo’s president, Denis Sassou-Nguesso, who has ruled since 1979, apart from a brief interruption.

In Mali, the force backs a military government and has deployed a drone of a type developed for Russia’s war against Ukraine. Residents and a rights group told RFI that Russian and Malian forces killed four civilian herders. Ukrainian drone specialists are reportedly supporting forces fighting Russian troops there.

US intelligence has warned Spain, France, and Italy that Russia may be preparing to launch drones at one of them from merchant ships in the Mediterranean, El Mundo reported on 23 September, citing sources familiar with the alert. Neither the CIA nor the three governments have confirmed it.

Russia has intensified a campaign of sabotage, airspace incursions, and other provocations against European states supporting Ukraine while keeping its actions below the threshold of open conflict with NATO. A maritime drone attack would extend that campaign into southern Europe, turning the Mediterranean into a launch zone for deniable strikes on civilian or military infrastructure.

El Mundo based its account on a source close to Lithuania's Defense Ministry and analysts familiar with a CIA report circulated among European foreign ministries. The reported plan would hide small Russian Gerbera drones inside shipping containers aboard merchant ships and launch them from the Mediterranean.

According to El Mundo, a Gerbera drone can travel up to 600 kilometers depending on payload and wind, potentially putting targets along NATO's southern coast within reach of a ship offshore.

The Gerbera drone's reported 4–5 kilogram explosive payload would be unlikely to destroy a large facility, the newspaper said, but could start a fire, damage exposed equipment, or temporarily close an airport or port.

All three countries hold elections in 2027 and have political forces capable of exploiting fear and fatigue with Ukraine, with connections to Kremlin interests especially visible in France and Italy, El Mundo reported. Keir Giles, a British defense analyst, said frontline states are not necessarily the targets—the target will be wherever Europe's weakest point is, naming the UK and Spain as countries that have not invested in air and missile defense adequate to the Russian threat.

El Mundo placed the warning alongside earlier Russian drone incidents on NATO territory. In September 2025, 19 unarmed drones strayed into Polish airspace. German authorities later attributed an explosive-carrying drone incident at Leipzig airport to Russia.

The war has reached Mediterranean shipping

Russia's oil shipments and naval presence, alongside reported Ukrainian operations, have brought the conflict into the region in several ways.

A source cited by Ukrainian media said Ukraine's Security Service struck a Russian shadow-fleet tanker there in December 2025. Such vessels carry Russian oil outside Western sanctions, making the sea a route for Moscow's war revenue and a target for Kyiv.

The French outlet RFI later reported that Ukraine may have established a drone launch site in Libya for strikes on Russian shipping. Kyiv has not confirmed the reported site.

Russia's military position in the region has also shifted. British intelligence assessed in January 2025 that its Mediterranean naval force lacked access to its Syrian base at Tartus after Bashar al-Assad's fall.

Russia’s Defense Ministry claimed on 22 September 2026 that it had surrounded Dobropillia, but the Institute for the Study of War (ISW) found no evidence to support the announcement. Dobropillia is a small town in Donetsk Oblast, known as the "pearl of the Donbas" for its coal industry, which has helped make Ukraine's Fortress Belt cities, holding the region from Russians since 2014, per RBC Ukraine.

Ukraine’s Vivaldi counteroffensive in Donetsk Oblast broke the northern arm of Russia’s plan to surround the fortified cities. ISW says Moscow’s Dobropillia claim diverts attention from that setback and portrays Ukrainian defenses as collapsing during the 81st session of the UN General Assembly, held on 21-28 September. The institute says Russia is likely spreading such claims to support its push for Ukraine’s capitulation.

Meanwhile, Ukrainian officers say Russian assault groups are still trying to break through toward Dobropillia, but have made no major gains.

Russia’s encirclement claim clashes with Ukrainian battlefield reports

Russia’s Ministry of Defense has claimed its troops were advancing toward Oleksandrivka, a village northwest of Dobropillia, but published no map to support its account.

At the same time, Ukrainian military observer Kostyantyn Mashovets said Ukrainian troops still held positions south and northeast of the city, which the experts said was inconsistent with the claimed encirclement.

ISW reported that a Ukrainian artillery reconnaissance battalion chief of staff said on 22 September that Russia had made no major advances near Dobropillia. He said Russian commanders kept postponing deadlines because of heavy losses and a gap between their plans and battlefield conditions.

A Ukrainian battalion officer said Russian troops were still trying to slip through Ukrainian lines in small groups.

How Dobropillia fits Russia’s plan to surround the fortress belt

Dobropillia is a transport hub on the southwestern approach to Ukraine’s “fortress belt,” which includes Kostiantynivka, Druzhkivka, Kramatorsk, and Sloviansk. These cities have anchored Ukraine’s defense in Donetsk Oblast since 2022.

Ukraine’s Third Army Corps commander, Andrii Biletskyi, whose corps is conducting the Vivaldi counteroffensive north of Lyman, explained that Russian forces advancing through Dobropillia were meant to join another force coming from north of Lyman, behind the fortified cities, encircling them rather than attacking them head-on.

ISW had already assessed on 16 September that Vivaldi had made the two-sided plan infeasible. In its 22 September report, ISW said Russia’s false claim about Dobropillia partly aims to divert attention from those Ukrainian gains.

Russian assaults toward Dobropillia continue

The setback north of Lyman has not stopped Russia’s push toward Dobropillia. Ukrainian staff sergeant Dmytro Davydenko reported on 14 September a sharp increase in assault groups moving toward the city, sometimes more than his unit could engage. He said Ukrainian troops had mined, blocked, or destroyed the main approaches.

ISW reported that Russia was preparing armor and drone support for possible assaults using armored vehicles this fall. A Ukrainian battalion officer said fog might help Russia move that equipment, although Ukrainian reconnaissance and drones would make it difficult. He said Russian glide bombs continued to strike infrastructure in the area.

Ukraine's Vivaldi counteroffensive rolled back a Russian advance north of Lyman in Donetsk Oblast. However, Moscow shifted part of its forces south, Roman Pohorilyi, co-founder of the Ukrainian battlefield mapping project DeepState, told Radio NV. Russian troops are now infiltrating Mykolaivka, a key strongpoint on the approach to the fortress city of Sloviansk, Pohorilyi said.

The halted advance was one arm of Russia's plan to encircle Ukraine's Donetsk fortress belt—the fortified cities of Sloviansk, Kramatorsk, Druzhkivka, and Kostiantynivka. Pohorilyi warned that losing Mykolaivka would create serious problems for Sloviansk's defenders. Russia is still pressing toward Dobropillia on the belt's southwestern flank.

Pohorilyi said Russia formed a "claw" north of Lyman by exploiting Ukrainian brigades short of personnel and pushing small groups into their lines. Ukraine's Third Army Corps stabilized the area, built up forces, and counterattacked. The push "multiplied all [Russia's] previous efforts by zero," he said.

Russian forces had repeatedly tried to capture or bypass Lyman, Pohorilyi said. Russian groups still infiltrate the approaches to the city, although Ukrainian forces have stabilized the situation there.

The corps says Vivaldi's first two phases regained control of 125 square kilometers, including 50 that had been under Russian occupation. It reported liberating Shandryholove and Derylove, securing Drobysheve, and inflicting more than 3,000 Russian personnel losses. Those battlefield figures have not been independently verified.

Explore further

Vivaldi’s secret weapon was the targeting, not the robots: Third Corps reconnaissance mapped Russian command nodes, then hit them to cause panic

Pohorilyi noted that the area around Mykolaivka had, until recently, been under the responsibility of Ukraine's 11th Army Corps and is now under the Third Army Corps.

Ukrainian troops must now find and stop infiltrating Russian groups before they establish control, he said. Personnel shortages on the Lyman axis persist, although he said reinforcements are being distributed more evenly.

Operation Vivaldi and the wider fight for Donetsk's fortress belt

The Third Army Corps first disclosed Operation Vivaldi on 15 September after conducting the counteroffensive north of Lyman under information silence. Commander Andrii Biletskyi said the announced gains were only the first phase; the corps said its attacks had disrupted Russian supply routes.

A 60th Mechanized Brigade captain said Ukrainian units quietly assembled near Derylove and Drobysheve, then struck Russian drone launch sites at planned times so infantry could advance. The corps disclosed a second phase on 20 September.

Farther southwest, Dobropillia faces even heavier pressure, Pohorilyi said. Russia has concentrated large forces there and is pushing with relentless infantry across a wide front, backed by thousands of drones each month—reconnaissance, strike, FPV, and Lancets—with numbers still rising. Russian troops are moving on settlements south of Dobropillia to establish a strongpoint and push deeper into Donetsk Oblast.

The pressure is not new: Biletskyi said Ukrainian troops halted a Russian incursion there last year. After Moscow claimed on 22 September to have encircled the town, the Institute for the Study of War found no evidence to support the claim.

A Kremlin-backed program aimed at primary-school children claims 10,154 participants in occupied Zaporizhzhia, nearly 30 times Yunarmia's 355 members—Russia's uniformed military youth organization—Petro Andryushchenko, head of the Center for the Study of Occupation, said. Cadet classes in the same region account for another 387, according to Andryushchenko.

Yunarmia may represent only a fraction of Moscow’s system for militarizing Ukrainian children under occupation. Movement of the First, a Kremlin-backed mass youth group covering ages 6 to 18, claims about 65 times Yunarmia's membership in occupied Zaporizhzhia—over 23,000 by the end of 2025, up from about 14,000 a year earlier, according to Andryushchenko's breakdown of the series. A separate infographic in the same series puts the figure at over 19,000. Moscow has sustained the broader campaign throughout the full-scale invasion, combining classroom indoctrination, Kremlin youth movements, military games, and weapons training.

Andryushchenko explains why: Movement of the First is not a military organization, and that is precisely its function—a mass base that enrolls children without their joining any military-patriotic structure, then moves some into specialized programs. Through it, Zarnitsa stopped being a school game and became part of Russia's military-patriotic system. The movement functions as a gateway, not an endpoint.

In Kherson Oblast, the pattern repeated: over 2,700 children and young people passed through Movement of the First events in 2024, and by spring 2025, the registered count had reached 6,200, with primary cells growing from about 70 to 114–115.

From Eaglets to Zarnitsa: programs across occupied Zaporizhzhia

Andryushchenko said Eaglets of Russia, a program aimed at primary-school children aged 6 to 10, claims 10,154 participants across 97 schools and 626 class-teams in occupied Zaporizhzhia, while more than 2,000 children aged 11 to 17 have passed through the Zarnitsa 2.0 military game. In May 2026, children from all four occupied oblasts appeared at a federal Eaglets session alongside children from Russian regions—a sign the occupied territories are already integrated into the system.

He said military-applied instruction now fills about half of the OBZR course, Russia’s “Fundamentals of Security and Defense of the Motherland” subject, in occupation schools. He described a broader system stretching from kindergarten and mass children's organizations through military games and cadet structures to practical training in drones, tactics, weapons, and military medicine.

Military training center claims thousands across four occupied territories

Beyond Zaporizhzhia, Andryushchenko said the Russian military-sports training center VOIN claims 14,450 trained cadets across four occupied Ukrainian territories in his overview post. A later infographic in the series gives 10,381 for the same four territories, suggesting the figures may count differently.

That cannot be read as a count of children because VOIN programs accept participants aged 14 to 35, according to the Center's own website, and no age breakdown was provided. VOIN says it has trained more than 100,000 cadets across 21 Russian regions overall.

Andryushchenko's post opened a six-part series tracing the system "from first grade to cadet"—though the series itself showed the pipeline actually begins in kindergarten, with "Conversations about Important Things" starting at age 5. Part two, published on 22 September, broke down Movement of the First's role as a gateway, with Zarnitsa 2.0 next. The participation totals cited in his post are claims by Russian-run organizations relayed by the Center. They may overlap, have not been independently verified, and do not show how many individual children participated or whether children move from one program to another.

Militarization has continued throughout the full-scale invasion

These latest participation claims are the newest snapshot of a campaign that has expanded steadily throughout Russia’s full-scale invasion. In 2023, occupation schools were already teaching children to use assault rifles and provide battlefield first aid.

By late 2024, Putin had ordered the expansion of military-sports camps and youth indoctrination programs.

Reports published in 2025 and 2026 described mandatory “patriotism” lessons from first grade and documented Ukrainian orphans who entered cadet schools and later appeared in Russian military uniforms.

Illia Bilyk, a 21-year-old Ukrainian national, admitted five counts of racially and religiously aggravated criminal damage on 17 September over graffiti at five Muslim institutions in east London, the BBC reported.

The BBC and Hope Not Hate linked Bilyk’s attacks to the same Russian network behind arsons targeting properties connected to former UK Prime Minister Keir Starmer. The network operated Direct Action UK, a fake British far-right group that recruited people through Telegram and shared images of the resulting vandalism. Investigations have documented the same recruitment model across Europe for surveillance, sabotage, and other criminal assignments.

The Metropolitan Police said Bilyk sprayed offensive graffiti at three mosques, Noor Ul Islam Primary School, and the Islamic Shariah Council on 23 and 25 January 2025. Images then appeared in a Direct Action UK Telegram group. Russian operators created the group to pose as a British far-right movement, the BBC reported. Bilyk will be sentenced on 19 October.

The handler, known as EL or “El Money,” also recruited through Telegram groups used by Ukrainians seeking work, the BBC found. Ukrainian builder Roman Lavrynovych was paid in cryptocurrency and steered from posters and graffiti to arson.

In May 2025, Lavrynovych set fire to a car and properties connected to Starmer. Nobody was injured. Lavrynovych was jailed for seven years, while Ukrainian-born Romanian national Stanislav Carpiuc was also convicted.

The BBC identified EL as Yevgeny Lyukshin, a 23-year-old Russian diplomat and son of a senior Foreign Ministry official. It cited matching personal details, his presence in the Direct Action UK chat, family connections, and information-warfare training from Rybar, a sanctioned pro-Kremlin Telegram outlet.

However, the BBC could not conclusively establish that Lyukshin was EL, while British police said they had no evidence the attacks were state-sponsored. Lyukshin did not respond. The Russian Embassy denied any connection between Russia or its Foreign Ministry and unlawful activity.

Paid local recruits make Russia-linked attacks look homegrown

The London operation is one of several cases across Europe and other continents.

UK intelligence warned that Moscow increasingly relies on non-state actors, meaning hired civilians and criminals outside its formal services, for espionage, sabotage, assassination, and information operations.

This month, US prosecutors alleged that another Russian network recruited local residents for surveillance, sabotage, and murder-for-hire.

Belarus sent tank and mechanized battalions to training grounds near Poland and Lithuania for four-day drills that Minsk says focus on border security, counter-sabotage operations, and defense against drones and light aircraft, Militarnyi reported on 17 September, citing the Belarusian Defense Ministry.

The exercise includes tank and mechanized infantry battalions, units typically used in conventional ground warfare. Minsk says their tasks include guarding checkpoints and infrastructure and defending against drones. Some drills are taking place near the Suwałki Gap, the only land route connecting Lithuania, Latvia, and Estonia to the rest of NATO. The corridor lies between Belarus and Russia’s Kaliningrad region, which is separated from the rest of Russia. Belarus denies any offensive intent.

What Belarus says it is practicing

Belarus’s Western Operational Command is holding the exercises from 15 to 18 September under Chief of the General Staff Pavel Muraveyko, according to the ministry’s schedule outlined by Militarnyi.

The drills are taking place at the Gozha range near Lithuania and at the Brest and Ruzhany ranges near Poland. RBC-Ukraine wrote that mechanized and tank battalions are taking part and that the Brest and Ruzhany sites lie about 15 and 60 kilometers from the Polish border, respectively. Reservists have also been called up to local territorial-defense units, the ministry said.

Militarnyi cited the ministry as saying that one unit guarded a water intake, another directed traffic with police, and a mechanized brigade manned a checkpoint with border guards. The ministry also said truck-mounted fire teams were posted around the clock to defend against drones and practiced firing at targets imitating surveillance drones.

Muraveyko said the army was not considering offensive action and called allegations of preparations for an attack baseless, according to remarks quoted by Militarnyi. Belarus has not disclosed the total number of troops involved, and the exercise’s scale has not been independently verified.

The Moscow Times reported that the ministry also claimed the exercise remained below the notification thresholds set by the 2011 Vienna Document, an international agreement requiring advance notice of large military exercises.

How Russia could exploit the Suwałki Gap

In December 2025, security analyst Taras Zhovtenko warned that Russian propaganda had laid the groundwork to cite an alleged blockade of Kaliningrad to justify a limited incursion and the establishment of temporary checkpoints.

A German war game later modeled Russia staging border incidents before seizing key routes, although Baltic officials said the scenario severely underrated their armed forces.

Separately, French open-source analyst Clément Molin found that defenses along the Polish and Baltic borders with Russia and Belarus remained patchy and shallow, with Lithuania the most exposed. These assessments describe possible vulnerabilities, not evidence that an attack is planned.

ZVS Holding evacuated its ammunition factory in Snina, a town in eastern Slovakia, on 16 September after a fire broke out on the roof of a production building. Work stopped temporarily in the affected section, but nobody was injured, Militarnyi reported.

The Snina plant has an annual capacity of roughly 100,000 shells and plans to triple it, Noviny reported. The blaze briefly disrupted part of a facility under expansion for Europe’s ammunition buildup, although co-owner CSG expects no impact on customer deliveries. Authorities across Europe are investigating suspected Russian sabotage against defense companies, but no evidence links the Snina fire to that campaign.

ZVS Holding is owned equally by the Slovak state and the Czech defense conglomerate Czechoslovak Group (CSG). It makes 155 mm artillery shells, 120 mm tank rounds, and 30/35 mm cannon ammunition.

In December 2025, ZVS signed a seven-year framework agreement with Slovakia’s Defense Ministry to supply EU states. Purchases under the agreement may be financed through the bloc’s SAFE defense-loan program. Its Euro 58 billion ceiling represents the maximum possible value of future orders, not guaranteed purchases.

Firefighters brought the blaze under control during the afternoon. As thick black smoke rose over Snina, town officials advised nearby residents to limit time outdoors, close windows and doors, and switch off ventilation systems drawing in outside air.

Slovak Defense Minister Robert Kaliňák said the fire had not reached the plant’s production equipment and that the affected part of the building was not being used for manufacturing at the time. That section makes metal projectiles, he said.

Kaliňák said welding during the renovation may have sparked the fire, but stressed that investigators had not established the cause.

CSG said the fire started during roof repairs conducted by an external contractor. The company said the damage and cause still had to be assessed, but it did not expect the incident to affect customer deliveries, STVR reported.

Why sabotage fears shadow Europe’s arms plants

The Snina blaze was at least the fourth fire or explosion at a European ammunition facility since 10 August, after two fires struck a Bulgarian company and an explosion hit an Italian factory. No common cause has been established.

Preliminary findings pointed away from outside interference in the first Bulgarian fire. No evidence of sabotage, however, was reported after the Italian blast, and only the second Bulgarian fire remains under investigation for possible sabotage.

Czech authorities are examining a possible Russian trail behind an arson attack on a factory making drones and thermal optics for Ukraine.

Estonia has also probed suspected arson at a military-robot maker after courts documented earlier attacks directed by Russian military intelligence.

A US-based recruit was promised up to $1,500 to surveil a prominent Russian dissident before being offered $40,000 to “eliminate” or “disappear” the target, the US Justice Department (DOJ) said on 15 September.

The charges connect that alleged plot to what prosecutors describe as a wider Russian assassination network operating since at least 2024 against dissidents, defectors, and countries perceived as supporting Ukraine.

A federal grand jury in Manhattan indicted five alleged members of what prosecutors call the “RIS Network”:

• Yuri Khrameev, 63: A Russian national and former colonel in the Russian intelligence services who allegedly recruited people to kill Russian dissidents.
• Kirill Khrameev, 27: Yuri Khrameev’s son and an officer in the FSB, Russia’s principal security service and a successor to the Soviet KGB.
• Oemis Romagoza Durruthy, 35: A Cuban national living in Russia who allegedly coordinated attacks and arranged travel for operatives.
• Yaidel Delgado Suarez, 35: A Cuban national accused of recruiting people in the US for surveillance and murder.
• Angel Eduardo Castro, 22: A Venezuelan national accused of helping Suarez recruit US residents to spy on and kill a Russian dissident.

Suarez sent the US resident two locations associated with the dissident, according to the indictment. After the resident delivered photographs and videos, prosecutors say, Suarez and Castro made the $40,000 offer. When the resident declined to carry out the killing, they allegedly asked whether he knew “someone [who] can do the work.”

In 2025, the indictment alleges, Kirill Khrameev recruited a US citizen to photograph a target in Lithuania for a promised $200. Yuri Khrameev then offered approximately $25,000 to kill the man. When the recruit refused, Khrameev allegedly proposed a “simpler job”: burning a warehouse or attacking an electrical substation. He said the purpose was to target countries helping Ukraine, according to prosecutors.

Prosecutors also allege that Durruthy coordinated travel and logistics for attacks in Prague, Czechia, in June 2024 and in Lithuania that September. The Justice Department did not specify what either attack involved.

All five defendants are charged with conspiracy to finance terrorism, carrying up to 20 years in prison. Yuri Khrameev, Suarez, and Castro also face a murder-for-hire conspiracy charge carrying up to 10 years.

All five remain at large. Kremlin spokesperson Dmitry Peskov said Moscow saw no need to comment without “credible evidence,” Reuters reported. An indictment is an allegation, and the defendants are presumed innocent.

From military espionage to alleged murder plots

Since Russia’s full-scale invasion, its covert campaign against Ukraine’s Western allies has combined intelligence gathering with escalating sabotage. CSIS found that suspected Russian attacks in Europe nearly tripled from 2023 to 2024, often using locally recruited agents against infrastructure and industries supporting Ukraine.

In August 2025, US prosecutors charged active-duty soldier Taylor Adam Lee with trying to transmit Abrams tank information and deliver hardware to someone he believed represented the Russian government, allegedly in exchange for Russian citizenship. That case involved an American insider allegedly offering military secrets, not a proven Russian recruitment operation.

After the Russian convoy docked in Tobruk, a column including armored personnel carriers, mine-resistant vehicles, and at least three Tornado-U armored trucks was seen heading west from the port in imagery published by the open-source intelligence project Russia Maritime Watch, as reported by Militarnyi.

The armor delivery comes as Russian forces have lost more than 10,000 armored and protected vehicles in Ukraine since the start of the full-scale invasion, Britain’s defense chief said. Africa Defense Forum reported that Moscow is funding work at six Libyan air bases, some of which support the movement of weapons and personnel toward Sudan and the Sahel. Russia’s Africa Corps already supports military governments in the Sahel, including Mali’s, while a Russian-operated base in Libya has supplied Sudan’s paramilitary Rapid Support Forces.

The cargo ships Anastasiia and Yuriy Arshenevskiy carried the shipment, while the Aleksandr Shabalin, a Russian Navy landing ship capable of transporting vehicles and troops, provided an armed escort, according to Militarnyi.

All three vessels crossed the Mediterranean without broadcasting Automatic Identification System data, the signal normally used to reveal a ship’s position.

This was at least the second Russian military shipment to reach Tobruk under naval escort this year. Both cargo ships are under sanctions and have previously carried military cargo. Satellite imagery showed equipment being loaded onto them in August at Baltiysk, a naval base in Russia’s Baltic exclave of Kaliningrad, Militarnyi reported.

In January 2026, the sanctioned Mys Zhelaniya delivered military cargo to Tobruk under escort by a large Russian anti-submarine warship.

Tobruk lies in eastern Libya, which is controlled by forces loyal to commander Khalifa Haftar. The six bases under development host Russian personnel, air defenses, combat aircraft, and drones.

Maaten al-Sarra, one of the six bases, lies near Libya’s borders with Chad and Sudan and supports Russian operations extending toward Sudan and the Sahel, the belt of countries immediately south of the Sahara.

Russian and Libyan authorities have not said who will receive the latest cargo, so there is no confirmation that the vehicles are intended for the Africa Corps, the Russian Defense Ministry-run force that took over much of Wagner’s former role in Africa.

Africa Defense Forum reported that Moscow pivoted toward Libya after the fall of Bashar al-Assad in December 2024, having previously used Syria as a transit hub. Moving the vehicles under naval escort as Russian forces absorb continuing battlefield losses in Ukraine underscores the importance Moscow appears to place on keeping its African corridor supplied.

How Russia expands its reach across Africa

Libya is one node in Russia’s wider African system. Through the Africa Corps, Moscow supports autocracy-minded military governments and armed groups throughout the continent in exchange for political influence and access to natural resources. Human rights groups and local residents have accused Russian personnel and their partners of killings and other abuses against civilians, including in Mali.

Ukraine’s military intelligence says Kremlin-backed Russian Houses seek to cultivate young Africans with pro-Moscow views. Moscow also invests in education programs and cultural events across the continent to spread a positive image of Russia, its politics, and its culture.

Ukraine’s Foreign Ministry said in August that nearly 500 Africans recruited into Russia’s military had died. Ukrainian drone specialists are also helping forces fighting Russian troops in Mali and operating in Sudan and Libya, CNN reported.