Ukrainian partisans say they have sabotaged the railway signaling that keeps Russian troops supplied on the Lyman front. The ATESH movement reports that its agents disabled four relay cabinets on a line through Voronezh Oblast that carries military cargo to Russian forces there, delaying ammunition to three regiments.

The strike was timed to help Ukraine's Operation Vivaldi, the counteroffensive the Third Army Corps is running near Lyman in northern Donetsk. In its first phase, the operation cleared 75 square kilometers of Russian infiltrators and de-occupied another 10.

Cutting the rail line that feeds the Russian units facing that offensive is, by ATESH's account, part of the same fight, targeting the supply line rather than the front.

Four cabinets go dark

The sabotage hit a rail corridor running through the Voronezh, Novovoronezh, Liski, and Ostrogozhsk areas of Voronezh Oblast, a route ATESH says Russia uses to move military cargo toward the Lyman axis.

Relay cabinets house the switching gear that runs a line's automatic signals. Knocking them out can freeze traffic on a stretch of track without a single explosion, and ATESH says its agents disabled four of them. As with the movement's other claims, the account could not be independently verified.

Ammunition backs up

By ATESH's telling, the signaling failure delayed shipments of ammunition and engineering materiel to the 1st and 15th Guards regiments and the 254th Motor Rifle Regiment. Russian commanders, it said, had to rush in repair crews and divert resources to guard the infrastructure. A delayed shipment, far behind the front, can be felt at it, where an assaulted position waits for the ammunition that does not arrive.

ATESH hunts the supply lines

ATESH is a network of pro-Ukrainian agents operating inside Russia and Russian-occupied territory, and it has increasingly gone after the rail and power infrastructure that sustains Moscow's war. This month, the group also said it knocked out the power supply of a plant in Voronezh that makes components for Russian missiles.

Investigators found what they believe is explosives meters from a crashed drone near the Bundeswehr's Wunstorf air base in Lower Saxony, Germany, and the device matches the construction of drones used in the GRU-attributed Leipzig airport attack, Süddeutsche Zeitung, NDR, and WDR reported on 22 September. Germany's federal prosecutor and the Federal Criminal Police Office (BKA) have taken over the investigation, and the same reporting traced one of the Leipzig suspects to a sanctioned GRU colonel who directs sabotage against countries arming Ukraine.

Russia's sabotage campaign against countries supporting Ukraine has escalated from arson packages and recruited proxies to explosives-laden drones targeting military infrastructure inside NATO. Germany's military counterintelligence has attributed repeated sabotage on German soil to Russia, while Finnish President Stubb called the broader alarm about Russian threats an "overreaction"—a position the accumulating evidence from Germany and Poland does not support.

Explosives found days after the drone crash

A farmer discovered the drone, broken into several pieces, on the evening of 14 September, about one kilometer from the Wunstorf air base, Militarnyi reported. Days later, police found a suspicious substance just meters from the crash site. Security sources told SZ, NDR, and WDR they believe it is an explosive, though forensic analysis has not yet been completed.

The drone's design is similar to the devices used in the Leipzig airport attack on 4 August, when attackers tried to destroy Ukrainian cargo planes with explosives-laden drones. At least one component was manufactured using a 3D printer, the reporting found. Investigators believe the drone may have been near the military airfield for a long time—possibly up to two years.

Wunstorf air base houses the Bundeswehr's entire A400M transport fleet. The facility is Germany's central hub for moving troops and materiel worldwide. An explosives-laden drone near this base would represent a direct threat to the Bundeswehr's central global logistics hub.

The Wunstorf find was discussed at the weekly intelligence briefing in the Chancellery on 22 September, the outlets reported.

Leipzig suspect linked to sanctioned GRU colonel

The federal prosecutor's investigation connects the Wunstorf case to the Leipzig attack. In that case, Germany's government has officially blamed Russia. Two suspects were identified: Oleg L., a Latvian with a Russian passport, and Andrei K., a dual Belarusian-Russian citizen whose DNA was found at the Leipzig scene.

SZ, NDR, and WDR reported that Oleg L. maintained years-long contacts with GRU Colonel Denis Smolyaninov. The EU sanctioned Smolyaninov for directing sabotage operations against countries supporting Ukraine. Andrei K. had previously been noticed for minor offenses in the Baltic states and Finland and entered Germany on an Italian tourist visa. Moscow denied involvement in the Leipzig attack.

A drone violated the no-fly zone around NATO's missile shield base in Poland

The Wunstorf case came to light in the same week that a drone violated the no-fly zone around the US-operated Aegis Ashore missile defense base in Redzikowo, northern Poland, on 15 September.

Polish troops guarding the facility called civilian emergency services instead of neutralizing the drone, TVP World reported. Poland's defense ministry said the drone was a civilian device that "posed no threat" and remained under military surveillance, but Defense Minister Władysław Kosiniak-Kamysz ordered a full report into the incident.

Russia is trying to "scare Europe" through hybrid attacks so that it provides less support to Ukraine, but Moscow has neither an interest in nor the capability to escalate to a full-scale military confrontation with NATO, Finnish President Alexander Stubb told Politico on 21 September during an interview on the sidelines of the UN General Assembly—even as other European leaders warn that Russian strikes on NATO territory could come within months.

Ukraine critically needs Western support as Russia's full-scale invasion continues. NATO's PURL program has provided about 75% of all Patriot battery missiles and 90% of the missiles used in other air defense systems since its launch last summer, according to NATO Secretary General Mark Rutte on 3 February. Some countries are also hubs for defense companies that produce weapons for Ukraine. Russia is trying to pressure such countries, including through hybrid attacks. Polish Prime Minister Donald Tusk and the head of the Czech security service have warned that Russia could strike NATO territory within months. The Finnish president says his own intelligence sees activity but no imminent military threat, and calls it an "overreaction" when intelligence services tell their neighbors they are next for a Russian invasion.

Finnish intelligence sees Russian activity but no imminent military threat, Stubb says

Stubb calls claims by some intelligence services that Europe is next for a Russian invasion an "overreaction" and says he sees no evidence of this.

"We think we have to be vigilant and awake. But, you know, we have the longest border in NATO with Russia, it's half the border. In our intelligence we see that there is activity but no imminent military threat right now," Stubb added.

He says Russia will continue hybrid attacks, so Europe must be prepared and support Ukraine

Europe should prepare for Russia's "continued hybrid and sabotage attacks," but should not "overreact" to them, as Russia wants to scare its allies so that they slow down their support for Ukraine, the Finnish president said.

"And any time we overreact to a hybrid attack, they have actually won the battle in that particular way," Stubb told Politico.

Europe should remain "cool, calm and collected" during such Russian intimidation, the Finnish president said.

Germany's recent decision to officially hold Russia responsible for an attempted drone attack in Leipzig is "exactly what you need to do," Stubb said.

"You need to point the finger and say, we know what you're doing, and these are the consequences," he added.

A pro-Kremlin group, Global Citizens Against War 1984, issued an ultimatum to Latvia, Poland, and Portugal to stop supplying weapons to Ukraine by 7 October, threatening to disrupt defense companies in those countries.

Warnings from Warsaw and Prague paint a different picture

Russia could carry out "accidental" drone or missile strikes against NATO countries supporting Ukraine in an attempt to weaken the Alliance's integrity and persuade members that Article 5 is more theoretical than practical, Polish Prime Minister Donald Tusk said in parliament on 17 September, citing NATO, Ukrainian, and Polish intelligence assessments.

"There is a real risk that drones or other types of missiles could enter the territory of one or several NATO countries on the eastern flank," Tusk said.

The head of the Czech security service warned separately that Russia could undertake a limited incursion, false-flag provocations, and a massive influence campaign in a matter of months rather than years.

Illia Bilyk, a 21-year-old Ukrainian national, admitted five counts of racially and religiously aggravated criminal damage on 17 September over graffiti at five Muslim institutions in east London, the BBC reported.

The BBC and Hope Not Hate linked Bilyk’s attacks to the same Russian network behind arsons targeting properties connected to former UK Prime Minister Keir Starmer. The network operated Direct Action UK, a fake British far-right group that recruited people through Telegram and shared images of the resulting vandalism. Investigations have documented the same recruitment model across Europe for surveillance, sabotage, and other criminal assignments.

The Metropolitan Police said Bilyk sprayed offensive graffiti at three mosques, Noor Ul Islam Primary School, and the Islamic Shariah Council on 23 and 25 January 2025. Images then appeared in a Direct Action UK Telegram group. Russian operators created the group to pose as a British far-right movement, the BBC reported. Bilyk will be sentenced on 19 October.

The handler, known as EL or “El Money,” also recruited through Telegram groups used by Ukrainians seeking work, the BBC found. Ukrainian builder Roman Lavrynovych was paid in cryptocurrency and steered from posters and graffiti to arson.

In May 2025, Lavrynovych set fire to a car and properties connected to Starmer. Nobody was injured. Lavrynovych was jailed for seven years, while Ukrainian-born Romanian national Stanislav Carpiuc was also convicted.

The BBC identified EL as Yevgeny Lyukshin, a 23-year-old Russian diplomat and son of a senior Foreign Ministry official. It cited matching personal details, his presence in the Direct Action UK chat, family connections, and information-warfare training from Rybar, a sanctioned pro-Kremlin Telegram outlet.

However, the BBC could not conclusively establish that Lyukshin was EL, while British police said they had no evidence the attacks were state-sponsored. Lyukshin did not respond. The Russian Embassy denied any connection between Russia or its Foreign Ministry and unlawful activity.

Paid local recruits make Russia-linked attacks look homegrown

The London operation is one of several cases across Europe and other continents.

UK intelligence warned that Moscow increasingly relies on non-state actors, meaning hired civilians and criminals outside its formal services, for espionage, sabotage, assassination, and information operations.

This month, US prosecutors alleged that another Russian network recruited local residents for surveillance, sabotage, and murder-for-hire.

A US-based recruit was promised up to $1,500 to surveil a prominent Russian dissident before being offered $40,000 to “eliminate” or “disappear” the target, the US Justice Department (DOJ) said on 15 September.

The charges connect that alleged plot to what prosecutors describe as a wider Russian assassination network operating since at least 2024 against dissidents, defectors, and countries perceived as supporting Ukraine.

A federal grand jury in Manhattan indicted five alleged members of what prosecutors call the “RIS Network”:

• Yuri Khrameev, 63: A Russian national and former colonel in the Russian intelligence services who allegedly recruited people to kill Russian dissidents.
• Kirill Khrameev, 27: Yuri Khrameev’s son and an officer in the FSB, Russia’s principal security service and a successor to the Soviet KGB.
• Oemis Romagoza Durruthy, 35: A Cuban national living in Russia who allegedly coordinated attacks and arranged travel for operatives.
• Yaidel Delgado Suarez, 35: A Cuban national accused of recruiting people in the US for surveillance and murder.
• Angel Eduardo Castro, 22: A Venezuelan national accused of helping Suarez recruit US residents to spy on and kill a Russian dissident.

Suarez sent the US resident two locations associated with the dissident, according to the indictment. After the resident delivered photographs and videos, prosecutors say, Suarez and Castro made the $40,000 offer. When the resident declined to carry out the killing, they allegedly asked whether he knew “someone [who] can do the work.”

In 2025, the indictment alleges, Kirill Khrameev recruited a US citizen to photograph a target in Lithuania for a promised $200. Yuri Khrameev then offered approximately $25,000 to kill the man. When the recruit refused, Khrameev allegedly proposed a “simpler job”: burning a warehouse or attacking an electrical substation. He said the purpose was to target countries helping Ukraine, according to prosecutors.

Prosecutors also allege that Durruthy coordinated travel and logistics for attacks in Prague, Czechia, in June 2024 and in Lithuania that September. The Justice Department did not specify what either attack involved.

All five defendants are charged with conspiracy to finance terrorism, carrying up to 20 years in prison. Yuri Khrameev, Suarez, and Castro also face a murder-for-hire conspiracy charge carrying up to 10 years.

All five remain at large. Kremlin spokesperson Dmitry Peskov said Moscow saw no need to comment without “credible evidence,” Reuters reported. An indictment is an allegation, and the defendants are presumed innocent.

From military espionage to alleged murder plots

Since Russia’s full-scale invasion, its covert campaign against Ukraine’s Western allies has combined intelligence gathering with escalating sabotage. CSIS found that suspected Russian attacks in Europe nearly tripled from 2023 to 2024, often using locally recruited agents against infrastructure and industries supporting Ukraine.

In August 2025, US prosecutors charged active-duty soldier Taylor Adam Lee with trying to transmit Abrams tank information and deliver hardware to someone he believed represented the Russian government, allegedly in exchange for Russian citizenship. That case involved an American insider allegedly offering military secrets, not a proven Russian recruitment operation.

Pro-Ukrainian partisan movement ATESH says it sabotaged the power supply to a Russian semiconductor plant in Voronezh that produces electronic components used in Russia’s missiles and air defense systems.

Targeting such suppliers can hit Russia’s ability to sustain its missile campaign: disrupting production of critical electronic components can slow the replenishment of weapons used to strike Ukrainian cities.

In a statement published on 16 September, ATESH said one of its agents infiltrated an electrical substation near the Voronezh Semiconductor Devices Plant-Sbor­ka (VZPP-S) and destroyed the main distribution cabinet supplying the facility. The movement said the agent escaped the city after the operation.

VZPP-S is a Russian producer of semiconductor devices, integrated circuits and power modules. Ukraine’s military intelligence lists the company as part of Russia’s defense-industrial supply chain and says it has produced electronic components for Kh-101 cruise missiles, Iskander-K missiles and Pantsir-S1 air defense systems.

ATESH claimed the sabotage caused a major voltage surge and shut down production workshops. The movement said full power was not restored for several weeks, causing delays in deliveries of components for Russian weapons and, consequently, delays in missile and air defense production.

The movement’s claims have not been independently verified.

ATESH is a pro-Ukrainian partisan movement operating in Russian-occupied territories and inside Russia. It says it recruits local residents and Russian military personnel to conduct sabotage, gather intelligence and pass information to Ukraine. The movement regularly publishes claims of attacks and acts of sabotage against Russian military and defense-industrial targets, though individual operations are often difficult to independently verify.

The plant has already been targeted

The reported sabotage comes after the VZPP-S facility was struck in a Ukrainian attack in June.

Ukraine’s military intelligence says VZPP-S produces components for the Kh-101, including transistor assemblies and matrices used in the missile’s electronic systems. It also says the company supplies semiconductor components for the onboard computer of the 9M727 cruise missile used by the Iskander-K system, as well as components for the Pantsir-S1’s television channel.

The company itself describes VZPP-S as a major Russian producer of electronic components, with more than 900 products in serial production.

ATESH said it delayed publication of its claim to protect its agent.

Russia has made Germany a priority espionage target, and the threat from cheap, deniable sabotage carried out by civilians paid for one-off jobs is rising, Germany's Military Counterintelligence Service (MAD) said in its 2025 annual report—the first published under a new law obliging annual disclosure. MAD blamed Germany's geostrategic position in Europe and NATO, the expansion of the Bundeswehr, and the introduction of new weapons systems. Repeated sabotage cases on German soil last year were "with high probability" Russian-run, MAD said.

For two years Berlin has publicly warned about a Kremlin campaign of arson, surveillance, and drone incursions run through cheap local proxies—mostly at press briefings and closed sessions. A January 2026 transparency law now forces that warning onto the statutory public record, sharpening the burden of an operational answer. Germany hosts NATO's logistics spine for arming Ukraine—the very hub Moscow's proxies keep aiming at.

Sabotage on the cheap

"Hybrid attacks have increased in Germany," MAD said.

The threat from "low-level agents"—residents paid small sums to plant fires or photograph military sites—has significantly increased. Recent incidents match the model: a bomb-laden drone found in August beside a Ukrainian cargo aircraft at Leipzig/Halle airport was traced this month to a Russian intelligence operative and a Belarusian petty criminal, and two Bulgarian nationals were arrested over a September suspected arson near defense-electronics firm Rohde & Schwarz in Munich. Russia's Legalresidenturen — intelligence outposts inside embassies, semi-state bodies, and press agencies—remain a central instrument of Moscow's information-gathering.

Explore further

A masked figure got into a Polish drone-parts plant—Poland now suspects a foreign spy service set the fire

Chinese drones over bases, blackmail risk for soldiers

Some drone overflights and unauthorized entries at Bundeswehr sites are attributable to Chinese intelligence, MAD said, which is also drawing on parts of the Chinese diaspora in Germany.

The service flagged travel by German soldiers to Russia and Belarus: personnel with family ties there kept visiting despite the security climate, drawing the attention of Russian and Belarusian intelligence services and creating particular exposure to blackmail and threats.

Sabotage preparation, remote recruitment, and data collection on military sites account for a significant share of Poland's espionage docket, and public arrests have not dented the pace, RBC-Ukraine reported on 15 September. The published figures cover only the highest-complexity investigations, so with district prosecutors' cases counted in, the real scale of Russian activity is larger still.

Russia's covert campaign inside the EU has escalated from online disinformation into physical attacks since the full-scale invasion of Ukraine—arson at defense plants, assassination plots, and bomb-rigged drones found at European airports.

Recorded sabotage incidents across Europe tripled between 2023 and 2024 alone. Poland, as NATO's primary overland corridor for Western military aid to Ukraine, sits at the center of that pressure—its railway routes near the Rzeszów logistics hub have drawn particular attention.

What the prosecutors count as espionage

Poland's National Prosecutor's Office opened 67 criminal cases under Article 130 of the Criminal Code—espionage and activity on behalf of a foreign intelligence service—during 2025, spokesperson Przemysław Nowak told RBC-Ukraine. In the first eight months of 2026 alone, prosecutors added at least 40 more.

At that pace, 2026 could yield roughly 60 new cases, RBC-Ukraine noted, concluding that the tempo of recruitment and sabotage preparation is not slowing but staying steadily high despite public detentions and strengthened counterintelligence.

Courier bombs and expendable operatives

Earlier, Polish law enforcement exposed two Russian citizens prosecutors say worked for Russian special services. One of them planned to send an explosive device through a delivery service—part of a wider Russian sabotage campaign that recruits low-cost, expendable operatives for arson and disruption across the EU.

German security services can now name two suspects in the drone attack on Leipzig/Halle airport with high probability, one of them attributed to Russian military intelligence, Welt am Sonntag reported, citing secret investigation files it obtained. The paper says that evidence is what allowed Berlin to blame Russia publicly a week and a half ago. Russia has denied any involvement.

The two men

The main suspects are a Belarusian citizen, Andrei Ka., and a Russian, Oleg Le., according to security sources cited by the paper. German investigators believe Le. was responsible for the preparation and logistics of the attack, and attribute him to the GRU, Russia's military intelligence agency.

Le. entered Germany through Türkiye, landing at Berlin Brandenburg airport, and later left from the same airport for Serbia. He is now back in Russia. Investigators knew at the point of entry that he was tied to the GRU's circle, and he was not surveilled afterward.

Explore further

A drone beside a Ukrainian cargo plane is costing Russia its last consulate in Germany

What was on the drone

The attack used three drones at Leipzig/Halle airport on the evening of 4 August, and two were destroyed at launch for reasons still unclear. The third landed beside a Ukrainian transport aircraft and sat there for hours. About 1.8 kg of Semtex, built into a vegetable can, failed to fire because a detonator tore loose. The Antonov it reached held 25,000 liters of kerosene, and investigators estimate a detonation would have destroyed parts of the airport.

How the trail was found

Forensic technicians recovered glove remains with DNA traces from the antenna used to fly the drone, and those traces were already on file in Finland and Lithuania, where Ka. has a record for ordinary criminal offenses, including theft in Finland. Polish prosecutors separately link him to a hardware-store fire in Łódź in the summer of 2024 that they treat as sabotage directed from Russia, which fits the pattern European authorities have documented since 2022: Russian services hiring residents, often migrants, to burn warehouses and malls. The Leipzig explosives are thought to have crossed from Bulgaria through Serbia in truck cavities and gone into buried caches, and police found several suspected hiding places after examining the suspects' rental-car data.

Explore further

Germany suspects Russian intelligence behind arson attack as hybrid warfare threat grows across Europe

What Berlin has done about it

German Foreign Minister Johann Wadephul and Interior Minister Alexander Dobrindt blamed Russia at a joint press conference on 1 September, ordering the closure of Russia's last consulate in the country and scrapping the agreement behind Moscow's cultural center in Berlin. Russia's embassy claims more than 150 of its mission staff and their families must now leave Germany, and Moscow answered by closing the German consulate in St Petersburg and the Goethe institutes.

Four days after the attribution, German investigators suspected Russian intelligence behind an arson attack on a defense company.

Fire tore through an ammunition depot belonging to the Bulgarian arms maker EMCO overnight on 12 September, according to RFE/RL. Nobody was hurt, and the interior minister says sabotage is among the versions being examined. It was the second fire at a site of the company, which supplies ammunition to Ukraine, in little over a month.

The warehouses burned one after another

The blaze started near the village of Gorni Varpishta, between Tryavna and Tsareva Livada in Dryanovo municipality. It was visible from Veliko Tarnovo, whose mayor, Daniel Panov, said the fire began around 23:00 on Friday. Gabrovo provincial governor Kristina Sidorova told reporters the fire had taken the depot base and was moving from one store to the next, and she had residents of nearby settlements warned through the BG-Alert emergency system.

Residents nearby heard a series of explosions. Two security guards were the only people on the site and both left in time, Bulgarian media reported. The nearest settlement lies more than a kilometer away, and firefighters ringed the area. EMCO production manager Slavcho Dimiev confirmed to Bulgarian National Television that the store held ammunition and powder, and he told Reuters it mainly contained ammunition, including a small quantity of medium-caliber rounds.

Explore further

Russia rehearsed how to disable Europe’s undersea communications cables near Svalbard. NATO forces drove them off

Sabotage among the versions

Interior Minister Ivan Demerdzhiev said on Saturday the fire was under control and an investigation was running.

"We will review previous cases in which similar fires occurred in the warehouses of this company, as well as at other companies, in order to look for a possible connection or a similar pattern," he said. "We are not ruling out outside interference."

Every ammunition depot in the country will now be inspected, Demerdzhiev said, because storage and security at such sites have been neglected. Dimiev also called for extra protection, saying that if the depots were being targeted, the attack was on the national interest rather than on one company. Lawmaker Bozhidar Bozhanov said the fires are too many and are aimed at one firm, whose owner Russian military intelligence tried to kill, and asked when the state would act.

The owner Russia tried to poison

EMCO belongs to Bulgarian arms trader Emilian Gebrev. He and his plants have been targeted repeatedly in operations attributed to Russian military intelligence over his ammunition deliveries to Ukraine. Gebrev, his son, and a colleague survived a Novichok poisoning attempt in 2015. In 2020 prosecutors charged three Russians whom investigators identified as officers of Russian military intelligence, the GRU.

Explore further

Italy joins Bulgaria in resisting EU sanctions on Patriarch Kirill

In 2024 Bulgaria issued arrest warrants for six Russians over EMCO depots destroyed between 2011 and 2020, which held rounds bound for Ukraine and Georgia. Prosecutors said they had grounds to suspect links between those blasts, the poisoning, and the 2014 explosions in Vrbětice, Czechia, that killed two. Moscow denies all of it. Bulgaria supplied Ukraine with weapons until this year's government moved to stop the transfers.

A month earlier, another EMCO site

Explosions and fire hit another EMCO depot on 10 August. Demerdzhiev said at the time that the preliminary version pointed away from external factors.

Founded in 1992, EMCO produces, repairs, and modernizes ammunition and military equipment. The Telegraph reported in late August, citing Western intelligence sources, that Russia had launched a fresh wave of attacks on European defense plants using local criminal groups.

Germany's authorities suspect Russian intelligence behind an arson attack on a defense firm last week, Estonia investigated a suspected arson at a military robot maker supplying Ukraine in August, and Czech police arrested four suspects over a fire at a plant making drones and thermal optics for Ukraine.

More than 150 Russian mission staff and their family members must leave Germany after Berlin ordered Russia's last consulate in the country to close, The Moscow Times reported, citing the Russian embassy. The German government published no figure of its own and expelled nobody by name. What it did was close institutions, a step ZDF judges the hardest-hitting of the German diplomatic measures. Berlin ordered the earlier closures for a different reason: Russia had restricted German missions first.

The response Berlin chose, and the one it did not

German Foreign Minister Johann Wadephul announced the measures on 1 September with Interior Minister Alexander Dobrindt, after Berlin blamed Russian services for an explosive-laden drone at Leipzig/Halle airport. The Bonn consulate closes on 18 September, and the agreement covering the Russian House of Science and Culture, Moscow's state-run cultural center in Berlin, is rescinded. Germany will also propose more Russians for EU sanctions lists, tighten entry checks, and press harder on the shadow fleet of tankers moving sanctioned Russian oil, he said.

Measured against what was on the table, the package is restrained. Berlin declined to expel individual diplomats, rejected a blanket entry ban for Russian citizens, refused to designate Russia a terrorist state, and kept Moscow's ambassador in Berlin. Wadephul called the closure a serious restriction of Russian capabilities in Germany, and said he had thought it through.

Explore further

Germany suspects Russian intelligence behind arson attack as hybrid warfare threat grows across Europe

Where the figure of 150 comes from

The embassy's statement is where the number originates, and it counts families alongside staff. It described the Leipzig find as a broken drone of unclear origin that harmed nobody, and said hundreds of thousands of German citizens and Russians living in Germany lose access to consular services because of it.

German officials had put the scope differently, describing a double-digit number of affected staff. Every registered consulate employee must go, along with every Russian House worker seconded from Russia, and Berlin refused to let consulate staff transfer to the embassy.

Why the Bonn consulate

The target was not chosen at random. Citing internal information from Brussels circles, Bild reported that EU diplomats regarded it as a support point for hybrid operations against the Benelux countries, EU institutions, and NATO headquarters in Belgium. Citing security circles, the paper put 15 to 20 intelligence officers at the consulate under diplomatic cover. Germany withdrew the operating permits of four other Russian consulates in May 2023, which leaves Moscow with its embassy alone. The Bonn site stays in Russian ownership after the staff leave.

Moscow's answer

Russia's foreign ministry withdrew consent for Germany's consulate general in St Petersburg on 7 September, matching the deadline Berlin had set for Bonn. The Goethe-Institut branches in Russia close as well—Germany's state cultural institute, the counterpart to Moscow's Russian House—and their seconded staff must leave by 13 September.

Five weeks from a drone near a runway to two consulates ordered shut

• On the night of 4 August and into 5 August, a drone carrying explosives turned up beside a Ukrainian An-124 at Leipzig/Halle, where it lay unnoticed for hours.
• Four weeks later, on 1 September, Berlin blamed Moscow and set out its measures.
• The next day German officials gave their own order of magnitude at a government briefing, and it was a double-digit number rather than three figures.
• On 4 September the closure order and its 18 September deadline were public, with the Russian embassy confirming them.
• On 5 September, with the attribution four days old, German investigators suspected Russian intelligence behind an arson attack on a defense company.
• Two days after that, on 7 September, Moscow ordered the closure of the German consulate in St Petersburg and the Goethe institutes.
• On 9 September, Romania revealed it had tracked a Russian agent filming NATO bases and Ukrainian Antonov cargo planes for seven months.
• On 10 September, the Russian embassy put its own number on the outcome: more than 150 people leaving.

Russia rehearsed an operation to disable critical undersea cables near Norway’s Svalbard archipelago this spring, according to two Western officials cited by Reuters.

The exercise comes as Russia continues a broader hybrid campaign against European countries, using covert sabotage, cyberattacks, espionage, and surveillance of critical infrastructure alongside its war against Ukraine.

The operation involved Russia’s Main Directorate of Deep-Sea Research, known as GUGI, which used deep-sea submersibles to simulate deploying technology designed to disable undersea cables.

British, Norwegian, and US forces tracked the Russian vessels and confronted them at sea, preventing them from completing the exercise, the officials told Reuters. The vessels eventually left the area.

No cables were damaged.

Russian forces rehearsed cable attacks

The operation took place near two 1,400-kilometer fiber-optic cables connecting Svalbard with mainland Norway. The cables carry satellite data from SvalSat, the world’s largest satellite ground station and part of NASA’s Near Space Network.

Britain and Norway disclosed in April that they had uncovered covert Russian activity in Arctic waters, but the details of the operation, including the technology involved and US participation, had not previously been reported.

Norwegian Defense Minister Tore Sandvik said the joint operation sent Russia a message that covert activity would be detected and face consequences.

The US and UK have sanctioned GUGI over its activities in European waters.

Explore further

“Will not be tolerated” – UK exposes Russian spy submarine operation targeting its undersea cables

Europe watches its undersea infrastructure

European governments have become increasingly concerned about Russian activity around telecommunications cables, power lines, and pipelines. Reuters reported that since 2023, vessels have increasingly been observed moving slowly over or near sensitive infrastructure, raising concerns that they could be mapping potential targets.

NATO has expanded monitoring in response. Its Baltic Sentry operation increases surveillance around critical infrastructure in the Baltic Sea, while the UK-led Nordic Warden monitors northern European waters.

Windward data cited by Reuters showed that vessels classified as “drifting” in the North Sea increased 52% in 2025, to 13,079. At least 11 subsea cables were damaged or cut in the Baltic between October 2023 and the end of 2025.

Western officials are increasingly concerned that Russia could use sabotage against European infrastructure to test NATO's response without immediately triggering open conflict. Some US intelligence officials have raised the possibility that Moscow could eventually test the alliance’s Article 5 mutual-defense commitment, according to Reuters.

Russia’s Defense Ministry did not respond to Reuters’ request for comment. The Kremlin has repeatedly denied conducting sabotage operations in NATO countries.

The Svalbard exercise did not damage infrastructure, but it involved rehearsing capabilities that could be used against critical European infrastructure in a future conflict.

Romania's domestic intelligence service says it prevented a Russia-coordinated sabotage operation on its soil, Militarnyi and Radio Svoboda reported. For months, it watched a Russian citizen who was filming military sites across the country—including, it says, Ukraine's Antonov cargo planes.

A wave of arson, drone incursions, and covert surveillance blamed on Russian handlers has spread across the continent, aimed at the logistics that keep Ukraine armed.

What the suspect was told to film

The Romanian Intelligence Service (SRI) announced on Tuesday that it had prevented the plot with national and international partners. The man had been under SRI monitoring since February 2026, part of a wider investigation into sabotage attempts on Romanian soil.

An intermediary instructed him to make photos and videos of targets of strategic military interest, SRI said. The list ran from NATO-used bases and communications nodes to defense institutions, critical infrastructure, and Ukraine's Antonov cargo planes.

SRI says the pattern matches saboteur networks run by Russian entities across Europe. It points to similar cases foiled in Romania in 2024 and 2025. The service added that Russia keeps leaning on people from vulnerable groups to carry out this work.

The Leipzig link

The case recalls an incident in Germany. On 4 August, workers found a drone rigged with explosives and a detonator beside an An-124 Ruslan at Leipzig airport. The Ruslan is a giant Antonov cargo plane. Ukraine's Antonov fleet moves oversized loads few other planes can carry, a standing target for a Kremlin trying to slow Western support without firing a shot.

Germany's government blamed Russia, and the attempt sharpened tensions between Berlin and Moscow. Russia denies any role in Europe's sabotage wave and has not addressed Romania's findings.

The disclosure comes days after Russian Shahed attack drones struck the Orlivka ferry crossing in Odesa Oblast, overnight on 1 September. The crossing sits on the Ukrainian-Romanian border.

Finland shut more than 2,000 people into a rock-hewn shelter that is normally a sports hall in Kuopio on 2 September, with some remaining overnight to practice operating the facility, the Associated Press reported. The two-day exercise, Shelter 2026, was the largest civil defense drill in Europe since World War II, by AP's account. Its scenario had cyberattacks cutting power and water while the threat of Russian missile strikes grew.

What two hours underground exposed

Three colleges got the alarm at 11:30 on 2 September, and students had about half an hour to reach the shelter, called Luola, or the Cave, Yle reported that evening. Staff barred the doors behind them. Partitions divided the sports hall into rooms of about 200 people. There were not enough beds, so people rested in shifts, and 60 dry toilets served everyone. The internet worked poorly, and the air grew heavy after an hour. The site holds up to 7,000 people under emergency law.

Antti Haataja, preparedness chief at the North Savo Rescue Department, said the move underground went calmly and faster than he expected. A real emergency would put those inside to work, he added, including emptying the toilets. More than a hundred people stayed through the night into 3 September, Yle said, while AP described hundreds sleeping on trestle beds.

Explore further

Finland ends nuclear weapons ban as parliament approves major NATO-aligned defense shift

Finland is reading Ukraine's experience

Retired Finnish Army Colonel Asko Muhonen, who organized the drill, said Finland has to learn from Ukraine, where people sometimes have only minutes to reach a metro station. What matters is cover they can actually get to, not a shelter that survives a nuclear blast. Ukraine's parliament is advancing a Finnish-style bill that would put one within 10 minutes of everyone.

Dmytro Untila, 20, a Ukrainian student in Kuopio, was at home in Odesa when Russian missiles hit the city on 24 February 2022, and waited the strike out in his building's entrance hall, having nowhere better to go. Training like this would have helped in Ukraine, he said, "because nobody knew this could happen."

The pressure Finland and its neighbors are drilling against

Finland shares more than 1,300 km of border with Russia and joined NATO with Sweden after the full-scale invasion of Ukraine. Shelters answer only part of the pressure. Russia is running a campaign of sabotage across Europe, Western officials say, a Russian aircraft is suspected of having entered Finnish airspace on 20 August, and US intelligence has warned that Poland and the Baltic states may face wider Russian hybrid attacks for backing Kyiv.

EU foreign ministers have given broad backing to an entry ban on Russians who fought in Ukraine and to stricter tourist visa rules for Russian citizens, DW reported. The bloc's foreign policy chief announced that support on 2 September, after an informal meeting in Wicklow, Ireland, without setting out what the tightening would involve. She tied the visa question to the risk of sabotage in Europe.

"Broad support," and nothing pinned down

EU foreign policy chief Kaja Kallas spoke to reporters after the ministers finished. 

"There was broad support for moving ahead with a ban on entry to the EU for Russian ex-combatants and tougher visa restrictions for Russian tourists," she said.

She did not name the restrictions planned for Russian tourists, say when they might take effect, or say which categories of Russian citizens they would cover.

The bloc has no unified position on tightening visa rules further, Kallas acknowledged. Some member states have so far argued against additional steps in that direction, she said.

Explore further

Russia’s former soldiers may face a locked EU border—if France and Italy stop balking

Many EU countries say tourist visas serve sabotage preparation

Reporters asked Kallas about accounts that one suspect in the Leipzig attack may have entered the EU on a tourist visa issued by Italy. German authorities have to confirm or refute those accounts, she said. If the information is correct, it shows that visas can be used to enter the bloc by potential wrongdoers who intend to harm it, she added. Many EU countries pointed out that tourist visas are used in preparing sabotage, because the people who carry it out need to get onto EU territory, she said.

Explore further

Russia’s ex-combatants entering the EU is a risk flagged in a leaked threat assessment

"It is not normal": Russians in Europe while Russia bombs Ukraine

Many ministers raised the visa question while the meeting was discussing Russia's war against Ukraine, Kallas said.

"It is not normal when a country bombs Ukraine, kills civilians—in July and August more than ever during this war—and at the same time Russians enter and enjoy the hospitality of European countries. That should not be," she said.

EU representatives said in July that the ban, kept separate from the tourist visa rules, was agreed in principle but still needed an evidence standard for refusing entry. The EU Council signs off after that, and the European Commission hoped at the time to finish by October.

Estonia is automatically diverting emails using Russia’s .ru internet domain into quarantine for additional security checks before they reach state institutions connected to the country’s secure government network, Justice and Digital Affairs Minister Liisa Pakosta told Estonia's public broadcaster ERR.

The measure is intended to protect Estonian government computer systems amid a post-2022 surge in cyberattacks that officials link to Russia. It applies only to institutions operating inside the secure state network, leaving local governments and some state bodies outside.

Many Estonian residents, particularly Russian speakers, still use .ru email services, ERR noted. Because the filter is triggered solely by the address ending, legitimate messages will be screened alongside potentially malicious ones and may take longer to arrive.

Pakosta said the safeguard was necessary because cyberattacks against Estonia had increased “exponentially” since 2022 and that many were linked to Russia. She said such attacks had not succeeded against Estonia, while major public-sector cyberattacks had succeeded in both Latvia and Lithuania.

The rerouting is automatic and handled centrally, so agencies do not need to take any action, Pakosta said. A large proportion of state institutions have already moved behind the government’s unified cyber shield, while the transition continues.

Pakosta described the quarantine as one small measure within Estonia’s wider cybersecurity work. Estonia’s courts have gone further, saying they will ask parties in legal proceedings to stop using .ru addresses for official communication, according to ERR.

How the Baltic states are hardening against Russia

Estonia's email quarantine forms part of a broader Baltic effort to limit Russian influence and strengthen defenses against military, cyber, and covert threats.

Estonia, Latvia, and Lithuania are constructing a Baltic Defense Line, a planned network of bunkers, anti-tank ditches, and other barriers, along their borders with Russia and Belarus. Latvia has also banned imports of Russian and Belarusian books, clothing, toys, and other goods.

The threat extends beyond cyberattacks: an Estonian court found that Russia’s military intelligence agency, the GRU, ordered the 2024 firebombing of a Ukrainian restaurant in Tallinn, part of a wider Russian sabotage campaign targeting European supporters of Ukraine.

A fire at a Polish plant that makes drone parts for Ukraine's and Poland's militaries is being investigated as possible sabotage by a foreign intelligence service, Militarnyi reported. Poland's National Prosecutor's Office opened the case on two counts: foreign-intelligence activity against the country and a terrorist offense.

Fires and break-ins like this fit a widening pattern — the factories and supply lines that keep Ukraine armed are increasingly targets far from the front line. Across the continent, prosecutors keep opening the same kind of arson case against plants tied to Ukraine's defense.

A masked intruder and a two-hour fire

The fire started shortly after midnight on 31 August in the assembly hall of the WB Electronics plant in Skarżysko-Kamienna and spread to the storage rooms. Five crews put it out in under two hours. No one was hurt, but the storage rooms were destroyed, leaving at least 15 million zloty ($4 million) in damage. The plant had no permanent guards on site; a security company monitoring it remotely reported the fire.

Prosecutors say the blaze was set deliberately with a planted charge of flammable material, and no one has been charged. Security cameras recorded a masked person who climbed a fence and got onto the site.

Why Poland is looking at Moscow

Czesław Mroczek, deputy head of Poland's Interior Ministry, told RMF FM radio that many signs point to arson, and that a Russian trail is the obvious inference. An attack on the defense industry can suggest Russian involvement, he said, since European states have faced sabotage for years while backing Ukraine. Mroczek said protection plans for key defense plants must be richer than what this site had. No one has been detained, and investigators are still tracing how the intruder got in and who may have ordered it.

Explore further

After CIA head’s visit to Moscow, Poland’s PM warns Russia is preparing to escalate war. He puts critical window at seven or eight months

What the plant actually makes

WB Electronics is the core of WB Group, Poland's biggest private arms holding, whose firms build reconnaissance and strike drones such as the FlyEye and the Warmate. The Skarżysko-Kamienna site itself makes drone components for unmanned systems, used by both Polish and Ukrainian forces. Ukraine received FlyEye drones back in 2022 under its Army of Drones program, and in 2025 WB Group launched drone production inside Ukraine.

An explosives-laden drone aimed at a Ukrainian cargo aircraft at Leipzig/Halle Airport was part of a Russian state operation, Interior Minister Alexander Dobrindt said on 1 September.

Germany has moved from suspecting foreign sabotage to formally blaming Russia for the Leipzig attack. The finding has prompted diplomatic and security measures against Moscow while the criminal investigation continues.

Police investigations, the attack pattern, and intelligence findings established Russian responsibility, Dobrindt said. The drones' configuration, components, explosives, and detonation systems resembled those used in other Russian hybrid operations—covert sabotage and disruption below the threshold of open war—and in Russia's war against Ukraine, Foreign Minister Johann Wadephul said.

The first drone, carrying explosives, was found near a Ukrainian cargo aircraft on the evening of 4 August and defused. Investigators believe a DHL freighter may have collided with a second drone while aborting its landing after the airport closed; that drone was never recovered. A third drone was found on 14 August in a field at Kabelsketal, where investigators subsequently discovered roughly 50 grams of suspected military explosive.

Leipzig/Halle is an international freight hub used by Ukrainian Antonov aircraft and NATO's strategic airlift program, through which allies charter heavy transport aircraft to move oversized military cargo.

Berlin will close the Bonn consulate on 18 September, end the operating agreement for the Russian House, a Moscow-backed cultural center, tighten entry controls for Russian nationals, seek to add more targets to EU sanctions lists, and pressure Russia's shadow fleet—opaquely owned tankers used to move Russian oil outside Western restrictions. Wadephul also summoned the Russian ambassador. Russia's Berlin embassy will remain open.

Russian Foreign Ministry spokesperson Maria Zakharova told Interfax that Moscow would respond to Germany's “anti-Russian action,” without specifying how.

NATO Secretary General Mark Rutte said the alliance stood in full solidarity with Germany, and European Commission President Ursula von der Leyen described Berlin's measures as a strong response.

Dobrindt said Germany expects further Russian hybrid attacks. The Leipzig incident follows a widening campaign of suspected Russian sabotage across Europe, including a 2024 incendiary-device attack at the same airport that Western security officials suspected Russian intelligence organized.

How the Leipzig attack unfolded

Euromaidan Press reported on 12 August, citing Die Zeit, that footage showed an explosives-laden quadcopter striking the wing of a parked Ukrainian Antonov An-124 before falling without detonating. The article also noted that a US Defense Department official told CNN that Washington assessed the drone belonged to Russian intelligence.

On 25 August, EP reported, citing Tagesschau’s NDR/WDR/SZ investigation, that investigators had expanded the case to three drones and found the third with suspected military explosive nearby in Kabelsketal, 10 days after the original attempt.

Wolfgang Kubicki, chair of Germany’s pro-business liberal Free Democratic Party (FDP), proposed that Berlin summon Russia’s ambassador and use the prospect of Taurus missiles for Ukraine as leverage against further hybrid attacks during an appearance on German broadcaster ntv.

Kubicki’s proposal does not change German policy. The FDP has no seats in the Bundestag, Germany’s federal parliament, while Chancellor Friedrich Merz has ruled out supplying the missiles. However, it recasts military aid to Ukraine as a potential cost Moscow would face for hybrid attacks inside Germany. Berlin has since formally blamed Russia for the Leipzig/Halle operation that prompted his remarks.

Kubicki said “a reasonable person” would tell the ambassador that Germany had so far withheld Taurus missiles. If the hybrid threat continued, Berlin should do everything possible to ensure Ukraine received the weapons it needed to defend itself against Russia, he added.

Taurus, the weapon Kubicki spoke about, is a German-Swedish cruise missile launched from military aircraft, with a range exceeding 500 kilometers. Ukraine has sought it for years to strike military targets far behind Russian lines.

Germany refused to supply Taurus missiles in 2025 while funding hundreds of Ukrainian-made long-range systems. Merz again ruled out a transfer in March, arguing that Ukrainian weapons were more effective.

Leipzig sharpens Germany’s hybrid-war debate

Germany formally blamed Russia on 1 September for the attempted drone attack at Leipzig/Halle Airport and said it would close the Russian consulate in Bonn and terminate the agreement under which the Russian House cultural center operates in Berlin, DW reported. Interior Minister Alexander Dobrindt cited evidence from German and allied intelligence services, as well as investigations across Europe. Russia has denied involvement.

The operation that prompted Kubicki’s warning involved an explosives-laden drone that struck the wing of a Ukrainian Antonov An-124 heavy cargo aircraft on the evening of 4 August but failed to detonate, Die Zeit reported. The airport handles civilian freight and NATO logistics, while Ukraine’s Antonov Airlines uses it as a base.

Investigators later found evidence that three drones were involved and discovered about 50 grams of suspected military explosive near the runways.

Three men were found guilty on July 8 in connection with an arson attack on Ukraine-linked businesses in London, which British authorities say was orchestrated by Russia's Wagner mercenary group, Reuters reported.

The alleged ringleader, Dylan Earl, 21, had already pleaded guilty to aggravated arson over the 2024 blaze targeting companies that were supplying Elon Musk's Starlink satellite equipment to Ukraine, according to Reuters.

The systems are considered vital to Ukraine's communications and defense against Russia's ongoing invasion.

Earl also became the first person convicted under the U.K.'s National Security Act after admitting to a separate plot to attack a wine shop and restaurant in London’s upscale Mayfair district and to kidnap its owner, a prominent critic of Russian President Vladimir Putin.

Two others, Jake Reeves, 23, and Earl’s associate, also pleaded guilty to aggravated arson, with Reeves admitting to a charge under the National Security Act for receiving a material benefit from a foreign intelligence agency.

A jury at London's Old Bailey court convicted three additional men, Nii Kojo Mensah, 23, Jakeem Rose, 23, and Ugnius Asmena, 20, of aggravated arson. They had denied the charges. A fourth man, Paul English, 61, was acquitted.

Two other defendants, Ashton Evans, 20, and Dmitrijus Paulauskas, 23, were charged with failing to disclose knowledge of terrorist activity. Evans was convicted on one count and cleared of another. Paulauskas was acquitted of both charges and reportedly broke down in tears as the verdict was read.

Commander Dominic Murphy of the London Metropolitan Police reportedly said he was confident the Wagner Group and the Russian state were behind the attacks.

The U.K. has designated the Wagner Group as a terrorist organization.

Earl had exchanged hundreds of encrypted messages with a supposed Wagner handler using the alias "Privet Bot" on Telegram. According to reporting by the Organized Crime and Corruption Reporting Project (OCCRP), the account was previously advertised by Grey Zone, a Wagner-affiliated channel.

Prosecutors said Earl expressed interest in fighting for Wagner and was encouraged to recruit contacts from British soccer hooligan networks, Irish republican groups, and organized crime circles, Reuters reported. He and Evans also admitted to unrelated charges of dealing cocaine.

The Russian Embassy in London has denied any involvement in the warehouse attack and accused the British government of blaming Russia for domestic issues.

The Kremlin has consistently rejected accusations of sabotage and espionage, despite growing evidence and convictions tied to Russian-linked operations across Europe.

‘Neither side wasted time’ — Ukraine’s economy minister on minerals deal negotiations with Trump’s ‘business-oriented’ administration

Ukraine’s Economy Minister Yuliia Svyrydenko says her task is simple — to get the investment fund behind the closely watched minerals deal with the U.S. off the ground, and prove its detractors wrong. “There are so many criticisms from different parties that this fund is just a piece of paper we can put on the shelves — that it won’t be operational,” Svyrydenko, who is also Ukraine’s first deputy prime minister, tells the Kyiv Independent at Ukraine’s Cabinet of Ministers on July 4, the morning

The Kyiv IndependentLiliane Bivings

BRICS summit participants condemned recent attacks on Russia’s railway infrastructure, according to a joint declaration on July 6 from Rio de Janeiro.

"We condemn in the strongest possible terms the attacks on bridges and railway infrastructure deliberately targeting civilians in the Bryansk, Kursk and Voronezh regions of the Russian Federation on May 31, and June 1 and 5 2025, which resulted in the deaths of several civilians, including children," the document says.

Bryansk, Kursk, and Voronezh oblasts are all located near Ukraine’s northeastern border and have played a central role in Russia’s war effort, serving as key logistical hubs and launch sites for missile and drone attacks on Ukrainian cities–often targeting civilian infrastructure and causing casualties.

In their declaration, BRICS leaders also called for a negotiated peace agreement between Russia and Ukraine.

“We recall our national positions concerning the conflict in Ukraine as expressed in the appropriate forum, including the UN Security Council and the UN General Assembly,” the document said. “We expect that current efforts will lead to a sustainable peace settlement.”

The statement comes a few days after a phone call between U.S. President Donald Trump and Russian President Vladimir Putin on July 3, in which Putin said "Russia will continue to pursue its goals" in the war against Ukraine, Kremlin aide Yury Ushakov said.

Russian Foreign Minister Sergey Lavrov attended the summit in person, while Russian President Vladimir Putin participated via video link.

Brazil is a member of the ICC and a signatory to the Rome Statute, meaning it is obliged to arrest Putin if he enters the country.

The ICC issued a warrant for the Russian leader's arrest in March 2023 over the illegal deportation of Ukrainian children during Russia's full-scale invasion of Ukraine.

The BRICS declaration also condemned recent U.S. and Israeli airstrikes on Iranian nuclear facilities as violations of international law and criticized the presence of foreign forces in Syria and Gaza, calling for Israeli withdrawal from Syrian territory.

BRICS, originally composed of Brazil, Russia, India, China, and South Africa, has expanded in recent years to include Iran, Egypt, the UAE, Ethiopia, and Indonesia.

Lavrov meets Iranian counterpart Abbas Araqchi at BRICS summit, reiterates Russia’s offer to mediate disputes over nuclear program

Russia reiterated its offer to mediate the conflict over Iran’s nuclear program during a meeting between Foreign Minister Sergey Lavrov and his Iranian counterpart at the BRICS summit in Rio de Janeiro, Reuters reported on July 6.

The Kyiv IndependentSonya Bandouil

The Atesh partisan group set fire to a signal cabinet that helps control traffic on a railway line near the Russian-occupied city of Yasynuvata in Donetsk Oblast, a route used for Russia's military logistics, the group claimed on Telegram on June 28.

Yasynuvata lies some 22 kilometers (12.5 miles) from the occupied city of Donetsk and is considered to be a major railway junction in the region.

According to the group, the sabotaged section is located near Russian military units, warehouses, and industrial facilities.

Atesh said the attack disrupted the delivery of a train carrying fuel for Russian forces.

"On Ukraine's Constitution Day, we remind the occupiers that this is an independent and free country. And Donetsk will always be Ukrainian," the statement read.

The Kyiv Independent could not verify these claims.

The Atesh partisan group regularly conducts sabotage attacks in Russia and Ukraine's Russian-occupied territories.

In early June, Atesh claimed to have destroyed a signal cabinet on the new Volnovakha-Mariupol railway, which had been recently built by occupying Russian forces.

Ukraine war latest: Ukrainian drones reportedly strike 4 fighter jets in Russia

Key developments on June 27: * Ukraine war latest: Ukrainian drones reportedly strike 4 fighter jets in Russia * North Korea deployed 20% of Kim’s elite ‘personal reserve’ to fight against Ukraine in Russia, Umerov says * Pro-Palestinian activists reportedly destroy military equipment intended for Ukraine * Zelensky signs decree to synchronize Russia sanctions

The Kyiv IndependentThe Kyiv Independent news desk

Ukraine's security service (SBU) is teaching teenagers how to avoid recruitment by Russian intelligence online, the New York Times (NYT) reported on June 21.

"Maybe not all of these special operations are reported in the media — but believe me, the enemy is not sleeping... They are working actively and carrying out illegal activities, as strange as it may sound, directly inside your phones," SBU spokesperson Roksolana Yavorska-Isaienko told students.

Approximately 22% of Ukrainians recruited by Russian intelligence to conduct sabotage or terrorist attacks are minors, Artem Dekhtiarenko, SBU spokesperson, said on April 2.

Russian intelligence attempts to recruit Ukrainian civilians online, offering easy money in return for sharing sensitive data or preparing sabotage or terrorist acts.

Russian intelligence finds its recruits using social platforms, including Telegram, Discord, and TikTok.

Unsuspecting teenagers are often offered hundreds or even thousands of dollars to conduct simpler tasks such as delivering packages or taking photos of energy sites, the NYT reports.

More serious tasks are commonly assigned to teenagers once they have been blackmailed for conducting less serious operations beforehand or when their phones are hacked to reveal compromising photos.

Russian intelligence is actively attempting to recruit Ukrainian nationals for illegal operations across the EU, Ukraine's military intelligence agency (HUR) said on June 2.

"The recruitment of Ukrainians for hostile operations in Europe is yet another tool of hybrid aggression that the Russian Federation is waging against Ukraine and the entire European community," HUR said.

The SBU caught a Russian agent as he was filming a military airfield in preparation for a Russian strike, the agency reported on June 15.

The Russian Federal Security Service (FSB) recruited the unemployed 24-year-old via the Telegram messaging app to collect coordinates for air attacks on airfields and logistic depots, the SBU said.

The Russian FSB allegedly offered "easy money" and instructed the recruit to find military facilities and carry out reconnaissance on the ground.

Love, sex, survival — Ukrainian author on how war shapes intimacy in Ukraine

In Ukraine, Russia’s war of aggression has upended not just borders but the country’s cultural landscape. Conversations about identity, gender, and sexuality have gained new urgency. Women are increasingly stepping into combat roles once dominated by men, while relationships can dissolve as quickly as they form. Many people

The Kyiv IndependentKate Tsurkan

Ukraine’s military intelligence (HUR) ignited an electrical substation during a sabotage operation in the Russian city of Kaliningrad, causing $5 million in damage and cutting electricity to a military production site, a source in HUR told the Kyiv Independent.

In the early hours of June 14, Ukrainian agents drained the coolant from the substation’s power transformer before setting the facility on fire. The inferno inflicted major damage on the facility and caused a power cut, impacting nearby Russian military sites.

"We once again remind you that Russia no longer has a rear either in the east, in the west, or anywhere else on the planet. Everything Russian involved in the war against Ukraine will burn, sink, and be destroyed regardless of its level of protection or location," the source said.

Ukraine continues to carry out numerous secretive attacks within Russia and occupied Ukrainian territories, targeting military sites, like airfields, as well as key infrastructure like railways and oil refineries.

The attacks involve HUR, Ukraine’s Security Service (SBU) as well as partisan and sabotage groups.

HUR was behind explosions near Desantnaya Bay in Russia's far eastern Vladivostok on May 30, which reportedly damaged military personnel and equipment. The operations took place approximately 6,800 kilometres from the Ukrainian border, making it Ukraine's furthest incursion into Russian territory, if confirmed.

On June 1, the SBU launched Operation Spiderweb, a game-changing drone attack on four key Russian military airfields, damaging 41 planes, including heavy bombers and rare A-50 spy planes.

Ukrainian drones destroy Russian air defense systems in occupied Zaporizhzhia Oblast, military intelligence says

Ukraine’s military intelligence (HUR) destroyed three Russian air defense systems using drones in the occupied Zaporizhzhia Oblast on June 14, HUR says.

The Kyiv IndependentVolodymyr Ivanyshyn