Several recent incidents across Europe were conducted by Russia or are likely attributable to Russia, ISW assessed in its 24 September report, though authorities have not officially linked the Polish and German incidents to Moscow.

Russia's full-scale war against Ukraine has expanded into a parallel campaign of provocations against European defense and logistical infrastructure. The Kremlin is using drones, arson, and undersea cable sabotage to degrade Europe's will and ability to support Ukraine, while deliberately intensifying the frequency of airspace violations to erode the boundary between hybrid and kinetic war.

Drones over Moldova and Romania

Four Russian drones flew over Bukovyna and targeted an energy facility and border crossings with Moldova and Romania, Chernivtsi Oblast Military Administration head Ruslan Osypenko reported. Ukrainian forces shot down three. The fourth flew toward Suceava County in northeastern Romania.

A drone crashed in Cernița, Florești district, Moldova—preliminarily identified as a Russian Gerbera type, the first such device found in the country. It carried an onboard camera, hit a tree, and exploded, Moldovan police said. Romania's Defense Ministry reported a second aerial vehicle entered Romanian airspace for four minutes and crashed near Solca in the same border region; geolocated footage confirmed it was also a Gerbera, ISW noted. Poland evacuated the Hrubieszów and Dorohusk border crossings for 30 minutes, Prime Minister Donald Tusk said. Three countries were put on alert by a single night of Russian strikes.

"Intentional and accidental Russian drone incursions into NATO and Moldovan airspaces are likely part of the Kremlin's efforts to normalize airspace violations by intensifying their frequency," ISW assessed.

Sabotage in Poland and Germany

A fire engulfed the power system and backup generator at a Starlink ground station in Wola Krobowska, central Poland, on the evening of 23 September. Deputy Prime Minister Krzysztof Gawkowski confirmed it was sabotage aimed at cutting internet access, including for Ukraine's military. Authorities have not identified who was responsible, but the act aligns with Russia's "new" doctrine of attacks, Gawkowski said. The station is now operating normally.

German authorities suspended operations at Berlin-Brandenburg airport for 45 minutes the same evening after staff reported a drone sighting, Die Zeit reported. Federal police could not confirm it. ISW assessed both incidents fit Russia's wider pattern of sabotage against European defense assets, though neither has been officially attributed to Russia.

Explore further

Russian attack puts three countries on alert as drones enter Moldova and Romania

Western intelligence warnings

A Lithuanian Defense Ministry source reported on 23 September that Russia could launch Gerbera drones from a shipping container in the Mediterranean against Spain, France, and Italy. Danish Defense Intelligence assessed on 24 September that Russia will intensify its hybrid war in coming months, including destructive cyber attacks and sabotage carrying a high risk of casualties, and that there is a low but growing risk of a limited Russian military attack on a NATO border state. It sees no indications of an outright invasion. The CIA reportedly warned Poland that Russia may sabotage underwater cables to disrupt its banking system, according to Newsweek Polska journalists.

NATO tracked and confronted Russian submersibles rehearsing deployment of a new cable-disabling weapon near Svalbard in spring 2026—no cables were damaged, but the operation demonstrated Moscow's intent, Reuters reported. Shadow fleet vessels likely served as drone-launch platforms for incursions into NATO airspace, ISW noted.

"The increasing frequency of such warnings suggests that Western intelligence agencies are picking up indicators that the Kremlin is looking to diversify its platforms and means for conducting attacks against NATO and European states and is considering conducting such attacks," ISW assessed.

ISW said it has not yet seen evidence that Russia has conducted the attacks the warnings describe.

Denmark's assessment—that a limited Russian military strike on a NATO border state could come in the coming months—suggests the boundary between hybrid provocations and military action is narrower than European policy has assumed. ISW's synthesis reframes what governments have treated as separate incidents into one campaign.

"Intentional and accidental Russian drone incursions into NATO and Moldovan airspaces are likely part of the Kremlin's efforts to normalize airspace violations by intensifying their frequency," ISW assessed.

"The increasing frequency of such warnings suggests that Western intelligence agencies are picking up indicators that the Kremlin is looking to diversify its platforms and means for conducting attacks against NATO and European states and is considering conducting such attacks," ISW assessed.

Moldova’s Defense Ministry reported four drone incursions, Romania’s Defense Ministry confirmed a drone crash, and Poland’s Operational Command scrambled fighters twice during Russia’s 24 September attack on Ukraine.

The strike wave forced Moldova to close part of its airspace, Romania to warn residents and launch F-16 fighter jets, and Poland to activate aircraft, air defenses, and radar. No casualties were reported in the two confirmed crashes, and Poland detected no incursion during its first deployment. Moldova has recorded dozens of Russian drone incursions this year.

The drones approached from Ukraine’s Vinnytsia, Odesa, and Chernivtsi oblasts, according to Moldova’s Defense Ministry. Authorities temporarily closed part of the country’s northern airspace.

Near Cernița in northern Moldova, one drone struck a tree, fell into a field beside a farm, and exploded, police said. No casualties were reported.

Investigators preliminarily identified the camera-equipped wreckage as a Gerbera, a low-cost Russian drone often used during attacks on Ukraine. Police said it was the first device of that type found in Moldova.

Police also reported a resident’s account of another explosion near Vadul Rașcov, but said they were still investigating the location.

Romanian radar first tracked an aerial target over Ukraine near the border before it entered northern Romania, the Defense Ministry said. Romania launched two F-16s and sent emergency alerts to residents’ phones in the area. The drone remained in Romanian airspace for about four minutes before crashing near Solca, the ministry said. Officials reported no casualties or damage and had not identified the drone’s origin.

Poland’s Operational Command launched fighters twice in response to Russian strikes on western Ukraine. The first Polish deployment ended around 08:00 with no airspace violation detected; the command announced a second at 09:07. It also activated ground-based air defenses and radar.

The incursions came amid a wider assault. Ukraine’s Air Force said Russia launched 282 drones of various types, along with ballistic and other missiles, overnight into 24 September. Ukrainian officials reported detecting four drones over Chernivtsi Oblast, the Ukrainian region bordering Moldova and Romania, and shooting down three.

Moldova’s repeated airspace breaches

The latest incident followed several breaches in August. An unidentified drone exploded near Crocmaz on 9 August. Another object exploded near Talmaza on 17 August after Moldova briefly closed part of its airspace.

President Maia Sandu said Russian drones had entered Moldovan airspace 39 times in 2026, compared with 17 times throughout 2025. Moldova has portable air-defense weapons and electronic warfare equipment, but Sandu said these chiefly protect individual sites. Her government is working with partners to expand air-defense coverage and speed up threat warnings.

Russian drones have entered Moldovan airspace 39 times since the start of 2026, against 17 in all of last year, President Maia Sandu said after a meeting of the country's National Security Council, Liga reported. Moldova's military can defend individual sites and little more, and Sandu said the country has to speed up building air defenses it spent three decades without. The council also ordered better protection for the energy facilities the country runs on, drones included.

What Moldova has to shoot with

Moldovan forces hold portable anti-aircraft missiles, anti-aircraft machine guns, and electronic warfare equipment, Sandu said. Their capabilities are mostly limited to protecting individual pieces of critical infrastructure. Three decades of ignoring air defense will not be paid off in five, she said, and Moldova is working with partners to speed the process up.

The military is now working to extend the range its air defenses cover. Moldova received €120 million from the EU to buy a medium-range system, and it is looking with international partners for more modern and cheaper ways to bring drones down.

Chișinău is also deepening cooperation with countries in the region to receive and pass on threat data faster. Interception is the part Moldova cannot yet do: Romania has shot down drones that reached it after crossing Moldovan territory, while Moldova mostly records them.

Explore further

Moldova is investing in air defense against the Russian drones crossing from Ukraine—Romania shoots down the ones that reach it

A month of incidents

The pace has picked up this month. A drone tracked over Moldova on 8 September held up seven flights, among them Volodymyr Zelenskyy's plane as it took off for King Harald V's funeral in Norway.

Three days later, Moldova temporarily withdrew its staff from three border crossings on Ukrainian territory because of the threat of Russian strikes, after Russia hit at least five of Ukraine's western crossings since late August.

On the morning of 18 September, a loud explosion went off near Chișinău and police found drone wreckage at the site. In August, a blast near the village of Talmaza marked the country's third airspace breach in nine days.

Warning the public is the other gap

Moldova is still building the system that would tell people a drone is overhead. MD-Alert needs more time to implement and is costed at €5 million, Sandu said, and until it works the government will use whatever notification mechanisms it already has.

The council that produced the drone count was convened on energy, and its decisions ran from gas reserves and fuel stocks to cyber vulnerabilities. Among them, Sandu wrote, were measures to better protect the facilities the country's energy supply depends on from hostile action, including the danger of drones.

Beyond the ceremonies, 127 children enrolled in two military schools for 2026–2027, Promo-LEX, a Moldovan rights group, said.

Promo-LEX says Transnistria’s military schools prepare children for service in the separatist administration’s security forces and paramilitary units. At the same time, Russian “patriotic education” programs expose them to indoctrination and security risks. Those programs connect Transnistria’s school system to Russia’s wider militarization and re-education of children in occupied Ukraine.

Beyond the classroom, dozens of Transnistrian children attended “patriotic education” programs in Russia and occupied Crimea this summer, the Association for the Reintegration of Crimea (ARC) said, citing Promo-LEX.

ARC said one group attended events at Artek, a Russian-run children’s camp, in June 2026. From 23 June to 13 July, another group participated in the “Circle of Friends” program at Russia’s Orlyonok children’s center.

The Artek camp is under EU, UK, and US sanctions over its role in deporting and re-educating Ukrainian children. Promo-LEX has documented Transnistrian children attending Artek-run camps for nearly a decade.

Transnistria is internationally recognized as part of Moldova but has remained under Russia-backed separatist control since a war in 1992, with Russian troops still stationed there.

A Radio Free Europe/Radio Liberty (RFE/RL) video showed students raising Transnistria’s flag and singing its anthem at the start of the school week. Tiraspol authorities described the ceremonies as promoting patriotism and discipline.

Of the 127 children who enrolled in the two military schools (up from 120 the previous year), 65 entered the Tiraspol Suvorov Military School, and 62 entered a cadet school in Bender, according to Promo-LEX. About half of this year’s new students in Bender are girls.

Students from the age of 11 wear camouflage, live under a barracks regime, and receive training in handling weapons and drones, Promo-LEX says. The intake includes children from vulnerable families and boarding schools. The group has also warned that graduates may face pressure to sign contracts with Tiraspol’s paramilitary structures.

How Russia militarizes children in occupied Ukraine

Russia uses the same education-to-service pipeline across occupied Ukraine. More than 582,000 children at nearly 2,000 occupation schools study under an imposed Russian curriculum, while schools are adding military-training tracks and ideology classes, according to the Almenda Center.

In December 2025, UN monitors documented Russia imposing weekly “patriotic” lessons in occupied Ukraine on children as young as three and putting older children through combat training—including instructions on how to handle drones.

At “Zarnitsa 2.0,” a Russian military-training competition for children held in May 2026, a Kremlin-backed youth movement taught children to handle weapons and explosives and operate drones, Ukraine's military intelligence said.

Earlier, 24 teenagers from occupied Kherson Oblast received drone, combat, and cyber training at Russia's Avangard camp, according to Ukraine's Center for National Resistance.

A Russian state-linked espionage group ran much of its campaign against Ukraine on Claude, the AI assistant sold by US company Anthropic, which set out the case in a threat report published on 10 September, covering activity it disrupted between December 2025 and August 2026. Ukrainian government, military, and diplomatic staff recurred most often among the targets, with the drone supply chain second. Other Russian users of the same chatbot produced on-air tickers and voiceover scripts for state broadcasters, while Russian-speaking criminals went after the AI industry itself.

Ukrainian ministries and diplomats led the target list

Anthropic tracks the group as GTG-20006 and says its attribution matches public reporting that links it to Midnight Blizzard, a hacking group the US and UK governments attribute to Russia's SVR foreign intelligence service. A Russian-speaking operator using the handle JackPoterz ran campaigns against military intelligence targets in Ukrainian and European governments, plus diplomatic and defense bodies and individuals connected to US foreign policy.

More than 20 organizations appeared in the actor's planning and live operations, from ministries and embassies to think tanks and defense companies. Ukrainian government, military, and diplomatic staff came up most often, and the operators scanned email and remote-access systems across more than two dozen Ukrainian state organizations. Russia has worked these networks all war, treating Ukrainian media as a priority cyber target.

Explore further

Ukraine’s media are top Russian cyber target: Hackers hit Ukrainian TV site with 200,000 requests in minute

Drone technology was the other target

The operators bulk-exported the mailboxes of at least two drone component manufacturers and went after a military drone maker. They also stole a complete proprietary software development kit for a drone vision system, the code and documentation engineers need to build on that hardware, then spent days pulling it apart. They recovered the product architecture, the parts list, the supplier dependencies, and details of a product the company had not announced. Military drone control and AI vision firmware drew their particular interest.

Explore further

AI against AI over Ukraine: Russia’s Shahed now sees its target, and Ukraine’s interceptor sees Shahed

To reach people indirectly, the group also compromised at least three vendors running hotel guest WiFi and redirected guests to its own servers, pushing malware at their devices and hunting for Ukrainian officials and drone manufacturers. To reach people indirectly, the group also compromised at least three vendors running hotel guest WiFi and redirected guests to its own servers, pushing malware at their devices and hunting for Ukrainian officials and drone manufacturers. Microsoft documented the same method on 31 July, calling it CaptiveCrunch and tracing it to a Midnight Blizzard sub-cluster. Russian services have tracked the weapons pipeline before, tapping private cameras in Europe to watch arms shipments bound for Ukraine.

What the chatbot did for the operation

Claude fingerprinted mail systems, built the phishing infrastructure, ran commands inside victim networks, harvested credentials, and organized hundreds of gigabytes of stolen data, Anthropic found. Automated agents also checked whether the group's implants were being detected, rewrote flagged malware until it passed, and staged it for the next intrusion. The operators also seized WhatsApp accounts and targeted at least two former high-level Ukrainian officials that way, and stole cloud email from at least eight bodies, including a national prosecutor office and a military education institute.

Russian state media used the same chatbot

Four individual operators fed state outlets, among them a former Sputnik Moldova editor-in-chief. Anthropic says content generated with Claude reached Sputnik Moldova, RIA Novosti, Sputnik en Español, Sputnik Africa, and RT's English newsroom, including fabricated claims about Moldova's President Maia Sandu before the parliamentary election of 28 September 2025. 

A Russian-speaking operator in Bangui also supplied daily material to Radio Lengo Songo, a station investigators say the Wagner Group founded and funded in 2017, coordinating with RT, Sputnik Afrique, and TASS.

Explore further

Estonia quarantines emails from Russian domains over cyberattack risk

Two crews went after the AI company itself

A Russian-speaking actor moved from hotel-booking and fintech intrusions to attacking AI firms, planting instructions in one vendor's testing system and hitting roughly 30 companies in four days while chasing an unreleased Claude model. The hunt for the model failed, though the actor did take production API keys from that testing system, and Anthropic says its own systems were never breached. A Russian- and Ukrainian-speaking group meanwhile sold fake discounted access to the assistant, routing customers to a different model and stealing their logins.

Moldova's Victory bloc, a pro-Russian political alliance, plans to participating in the country's September parliamentary elections, the bloc's founder Ilan Shor announced on July 6.

Shor, an exiled pro-Kremlin oligarch, established the Victory bloc in August 2024. The bloc includes his own Shor party, which is banned in Moldova.

Victory will submit documents in the coming days registering the bloc for participation in the September vote, Shor said.

"Our main goal in these elections is to overthrow the fascist regime and hold early democratic elections within the next six months," Shor said.

The candidate list will be headed by Evghenia Gutul, the head of Moldova's Gagauzia region, who is currently on trial for illegally funding the banned Shor party. Gutul maintains ties to Moscow and is currently under U.S. sanctions.

The upcoming September elections carry high stakes for Moldova, one of the pooerest countries in Europe. Moldovan President Maia Sandu said on July 4 that Chisinau's European path rests on the outcome of the vote.

European Commission President Ursula von der Leyen pledged on July 4 that the European Union will help Moldova defend itself against hybrid threats by "agents of autocracy" as elections approach.

Moldova was granted EU candidate status in 2022. Sandu's ruling Party of Action and Solidarity aims to maintain its parliamentary majority and move the country closer to full membership by 2030.

Ukraine war latest: Drones attack Russia’s Black Sea Fleet; Russian pipelines explode in country’s Far East, HUR says

Key developments on July 5-6: * Drones reportedly attack Russia’s Black Sea fleet * Pipelines supplying Russian military explode in Russia’s Far East, HUR source says * Ukrainian drone strike on Russian airfield hits bomb depot, aircraft * Ukraine hits Russian electronic warfare facility making Shahed, Iskander components, General Staff says * Ukraine’s army chief warns of new Russian offensives in northeast as he visits Kharkiv Oblast front Drones attacked Russia’s Black Sea Fleet at the

The Kyiv IndependentThe Kyiv Independent news desk

European Commission President Ursula von der Leyen pledged on July 4 that the European Union will help Moldova defend itself against hybrid threats by "agents of autocracy."

"We are committed to protecting you against the hybrid attacks and the energy shocks that your country has been a victim of," von der Leyen said following the EU-Moldova summit in Chisinau.

"Who is behind those attacks is clear to all of us here. These are the same agents of autocracy trying to undermine our democracies everywhere in Europe."

Von der Leyen praised Moldova's support for Ukraine and the EU, noting its acceptance of hundreds of thousands of Ukrainian refugees and its assistance with European wildfire response efforts.

The visit was made in show of solidarity with Moldova, one of Europe's poorest countries, as it prepares for high-stakes parliamentary elections on Sept. 28.

The pro-European government of President Maia Sandu faces a challenge from the pro-Russian Socialist Party, amid growing fears of destabilization ahead of the vote.

Sandu has accused Russia of using its military presence in Moldova's Russian-occupied Transnistria region to stir unrest and derail the country's EU aspirations. On June 12, she warned that Moscow could provoke a crisis in Transnistria to influence the election outcome.

Transnistria has been under Russian-backed separatist control since the early 1990s, with approximately 1,000 to 1,500 Russian troops still stationed in the region.

On June 11, Transnistrian authorities declared a 30-day state of emergency after a sharp drop in natural gas supplies. The unrecognized region has faced mounting energy shortages since January, when Russian energy giant Gazprom halted deliveries in what many see as an attempt to destabilize the situation in Moldova.

Moldova was granted EU candidate status in 2022. Sandu's ruling Party of Action and Solidarity aims to maintain its parliamentary majority and move the country closer to full membership by 2030.

Moldovan Prime Minister Dorin Recean earlier told the Financial Times that Russia plans to send 10,000 troops to Transnistria and establish a pro-Kremlin government in Moldova.

Death of top Russian oil executive fuels fresh scrutiny of elite’s ‘window falls’

The unexplained death of a top Russian oil executive on July 4 is fueling renewed scrutiny over the rising number of high-profile Russian officials and businessmen who have died under mysterious circumstances, specifically, have fallen out of windows. Andrei Badalov, vice president of Transneft, Russia’s largest state-controlled pipeline transport company,

The Kyiv IndependentTim Zadorozhnyy

Moldovan President Maia Sandu said on July 4 that her country's European Union aspirations depend on Moldovan citizens as a crucial September 28 election approaches.

Sandu hopes her pro-European Party of Action and Solidarity (PAS) will retain its parliamentary majority, paving the way for Moldova, one of Europe's poorest nations, to join the EU by 2030.

Sandu made her remarks at the conclusion of the 27-nation bloc's inaugural summit with Moldova. Her PAS party faces a challenge from the pro-Russian Socialist Party and its allies in the upcoming election. Sandu secured re-election last year by a narrow margin against a Socialist challenger in the ex-Soviet state, located between Ukraine and Romania. A referendum seeking public backing for EU membership also just barely surpassed a 50% majority.

"Prosperity and peace do not occur for nothing, you have to build them. With collective effort and unity. When citizens are united and choose the correct path and proceed along it," Sandu told a news conference after the summit. "The European Union is already happening here. The only risk is if we stop. If we decide this autumn that nothing will stop us, then everything is possible."

Sandu and her party have condemned Russia's invasion of Ukraine and accuse Moscow of destabilizing Moldova. Russia, in turn, claims many Moldovans desire to maintain ties with Moscow and accuses Sandu of fostering Russophobia.

Opinion polls suggest that no single party will likely secure a parliamentary majority. If no majority emerges, pro-European parties would need to engage in coalition talks.

At the summit, which included European Commission President Ursula von der Leyen and European Council head Antonio Costa, the EU announced the disbursement of the first €270 million ($318 million) tranche of an Economic Growth Plan for Moldova.

‘Disingenuous’ Hegseth paused Ukraine weapons despite Pentagon finding aid wouldn’t hurt US readiness, NBC reports

A senior military review had concluded that while some munitions stockpiles, including precision weapons, were low, they had not fallen below critical thresholds, according to NBC. Still, U.S. Defense Secretary Pete Hegseth opted to stop the shipment. This is reportedly his third such move since February.

The Kyiv IndependentAnna Fratsyvir

Moscow may instigate a crisis in Moldova's Russian-occupied Transnistria region to destabilize the country ahead of parliamentary elections scheduled for September, Moldovan President Maia Sandu said on June 12, according to Moldovan outlet Newsmaker.

"All these years, Russia has been using the residents of Transnistria and can provoke an even greater crisis at any moment if it suits its plans in Moldova," Sandu said.

"We can expect this crisis to deepen in the coming months, before the elections."

The president's comments come after Transnistria declared a 30-day state of emergency on June 11, due to a sharp reduction in natural gas supplies.

The unrecognized region, located along Moldova's eastern border with Ukraine, has faced mounting energy shortages since January, when Russian gas giant Gazprom halted deliveries.

Sandu, a pro-European leader of the country, warned that Moscow could combine voter bribery and political manipulation with "blackmail" in Transnistria.

"Russia may promise assistance in exchange for votes on the Right Bank. We can expect all sorts of games," the president said.

In February, Moldova's government revealed that Transnistria rejected a 60 million euros ($62 million) EU energy aid package under pressure from Moscow.

The Moldovan president assured that the country's institutions are monitoring the risks and pledged that the elections would be "free and fair," despite growing instability.

Sandu emphasized that Chisinau is prepared to support the population in Transnistria but must first address "the main problem — the withdrawal of Russian troops."

"This is a key issue that we must resolve peacefully, because otherwise we will not be able to justify our financial support," she said.

Moscow continues to maintain a military presence in Transnistria, which has been under the control of pro-Russian separatists since the early 1990s. President Volodymyr Zelensky said in February that around 1,000 to 1,500 Russian troops are currently stationed in the region.  

Chisinau has repeatedly called for the peaceful reintegration of Transnistria and the withdrawal of Russian forces, citing it as essential to Moldova's security and development.

Moldovan Prime Minister Dorin Recean earlier told the Financial Times that Russia plans to send 10,000 troops to Transnistria and establish a pro-Kremlin government in Moldova.

Russia preparing strategic reserves for conflicts beyond Ukraine, Ukraine warns

“According to our intelligence, Russia has started to prepare strategic reserves, which indicates plans for combat operations not only in Ukraine,” Ukraine’s Foreign Minister Andrii Sybiha said

The Kyiv IndependentAnna Fratsyvir