A former Wagner fighter captured by Ukraine has described alleged training sessions in Mali where Russian mercenaries used African prisoners as live subjects, deliberately inflicting severe injuries so recruits could practice battlefield medicine and killing.

Training built around real victims

The fighter told Ukrainian journalist Dmytro Karpenko that Wagner instructors brought captured Africans to training sessions and turned them into human practice targets.

“We gathered for medical training, and they brought in a captured terrorist. They tied a block of TNT to his leg. They set it off, everyone moved away, and of course his leg was blown off,” he said.

The recruits then practiced stopping the resulting bleeding. According to the fighter, the prisoner was later shot in the artery near his armpit so they could practice the same procedure on his arm.

The prisoner died after the training.

In another session, he said, instructors had a prisoner's leg chopped off with an ax so recruits could practice applying a tourniquet under realistic conditions.

“They cut off his leg. Then they put on the tourniquet – everything as if it were an extreme situation, so everything would be realistic,” he said.

‘Here, strike the heart’

The alleged exercises also included training in how to kill.

The fighter said another prisoner was drugged before recruits were taught how to kill someone with a knife.

“They showed us how to kill with a knife to the heart. They chose two people who were willing and said: ‘Here, strike the heart,’” he said.

The fighter said all three prisoners died during the exercises.

From Mali to Ukraine

The testimony comes from a Russian mercenary who joined Wagner in 2023 and was sent to Mali that September via Syria. He said around 120–130 recruits traveled with him and that Wagner paid them $3,000 a month.

Wagner was a Russian paramilitary formation that operated as a deniable arm of the Kremlin in Ukraine, Syria, and Africa. After Wagner chief Yevgeny Prigozhin's death in 2023, the group's independent role was largely dismantled, with many of its fighters and operations brought under Russian state control. Its African operations were increasingly taken over by Russia's state-run Africa Corps.

The mercenary remained in Mali until April 2024. After returning to Russia, he signed a contract with the Russian Defense Ministry in August 2025 and was assigned to the 14th Separate Special Forces Brigade, which is subordinate to Russia's military intelligence agency, the GRU.

He was subsequently captured by Ukrainian forces.

A record of alleged abuses

The account has not been independently verified, but it adds to years of allegations of serious abuses by Wagner and other Russian personnel in Africa.

Wagner fighters have long faced allegations of abuses in Africa, including killings and violence against civilians. In Mali, the group became a key part of Russia’s military presence after the country’s military junta turned to Moscow for support, with Wagner fighters operating alongside Malian forces. Ukrainian intelligence has also documented and targeted Wagner’s activities in Africa.

The pattern of alleged abuses has continued under Russia’s Africa Corps, the Kremlin-controlled force that replaced Wagner in Mali. Human Rights Watch reported in August 2026 that Africa Corps fighters summarily killed nine civilians, including four children, beat dozens of others, and burned and looted homes in central Mali. In June, the group also carried out airstrikes that killed eight civilians, including three children.

Small groups of Russian infantry could slip into regional capital Zaporizhzhia this winter, a frontline commander warned in a mid-September interview with Dnipro TV, in a debate later compiled by Radio Svoboda. His forecast drew quick pushback from a military analyst, who called it far more categorical than the situation warrants. At the center of the dispute lies the drained Kakhovka Reservoir, whose dry bed Russia now uses for cover.

Dense drone surveillance has made large mechanized assaults costly, pushing Russian commanders toward small groups that probe for gaps. That shift turns unwatched terrain — here, the drained reservoir bed—into the seams they test.

Solitary groups, not massed forces

Dmytro Filatov, callsign Perun, commands the 1st Separate Assault Regiment named after Dmytro Kotsiubailo. The danger will come not as a massed assault but as infiltration, he said. He expects solitary infantry groups to reach and enter Zaporizhzhia over the winter. He pointed to the Stepnohirsk axis and the dense buildings along the Dnipro shore. Fog and rain raise pressure across the whole front, and Russian troops have long fought well in winter, he said.

A city on the front's edge

Zaporizhzhia is a regional capital and industrial center in southeastern Ukraine, with more than 700,000 residents before the full-scale invasion. The city sits about 25 km from the nearest active front, around Stepnohirsk to the south—unusually close for a regional capital of its size. Russian missiles, drones, and glide bombs hit the city daily. It has held since 2022, and Russia has not taken a Ukrainian regional capital since the war's first months.

The dead reservoir as cover

Russia blew up the Kakhovka dam in June 2023 and drained the reservoir behind it. Reeds now stand several meters high across the dry basin, giving foot soldiers cover to move unseen. Ukraine's Southern Defense Forces reported in November 2025 that Russian groups use it to press into the Ukrainian flank.

Russian troops increasingly use the bed to infiltrate and haul supplies, said Kostiantyn Mashovets of the Information Resistance group. One of their assault groups pushed as far as Malokaterynivka before Ukrainian forces blocked it, he wrote. Ukrainian troops hold northern Plavni, including the railway station and part of the E-105 highway, Mashovets added. The Institute for the Study of War pointed to the same route in its 26 September assessment, citing Ukrainian military observers.

Explore further

“The worst environmental catastrophe since Chornobyl disaster”: Three years after Russia destroyed Kakhovka Dam, real death toll is still unknown

An analyst is not convinced

Oleksandr Kovalenko, a military-political expert and Information Resistance coordinator, rates the threat far lower. He wrote that the warning "sounded far more categorical than it should have." Stepnohirsk, about 25 km south of Zaporizhzhia, is the closest active fighting to the city. Russia has tried for years to take the town but now controls only its 3rd microdistrict and southern Plavni.

Infiltration becomes possible only if Russia takes the whole foothold and reaches the north bank of the Konka river. That will not happen by the end of 2026, and no ground push on the city looks possible, he said. The main danger stays daily Russian strikes on the city, not a ground advance, he added.

Estonia says Russia ordered the August arson attack on Milrem Robotics’ Tallinn premises, an Estonian defense company supplying Ukraine with military ground robots.

Russian sabotage operations have been expanding across Europe in recent months, targeting companies, infrastructure and supply chains connected to Ukraine’s defense effort. European authorities have linked or investigated suspected Russian involvement in arson and other sabotage attempts in several countries, as Moscow seeks to disrupt support for Ukraine and intimidate its European backers.

Foreign Minister Margus Tsahkna said on 29 September that information gathered by Estonia’s Internal Security Service showed the fire at Milrem’s Tallinn premises on the night of 14–15 August was a Russian intelligence-directed sabotage operation. Estonia summoned Russia’s chargé d’affaires over the attack.

Three suspects detained

Estonian authorities had already detained three suspects in connection with the arson, with the suspects apprehended in Latvia. Tsahkna said the perpetrators had been taken into custody and no longer posed a threat to Estonia.

When the investigation was first announced in August, Estonian authorities had not publicly established a Russian connection or disclosed evidence linking Moscow to the fire.

Milrem supplies robots to Ukraine

Milrem Robotics makes THeMIS unmanned ground vehicles, which have been used by Ukrainian forces since 2022 for tasks including transporting ammunition, food and other supplies, evacuating wounded troops, and mine clearance.

The company said in August that the fire had not disrupted its production or deliveries to Ukraine. More than 200 of its robotic systems are expected to be operating in Ukraine by the end of 2026, including more than 150 vehicles funded by the Netherlands.

The attack is part of a growing series of suspected sabotage operations targeting companies and facilities connected to Ukraine’s defense effort. In August, Slovak authorities foiled an attempted arson attack on a Ukrainian drone factory, while European investigations have also examined suspected Russian involvement in attacks on defense-related facilities in Czechia, Lithuania and Bulgaria.

Estonia says sabotage will not weaken Ukraine support

Tsahkna said Russia’s campaign is intended to intimidate European countries, divide allies and weaken their support for Ukraine.

“Russia’s sabotage campaign will not achieve its objectives,” the Estonian Foreign Ministry said, adding that Estonia and its allies would continue increasing pressure on Russia and supporting Ukraine.

Tsahkna said Estonia would respond to the attack by increasing both its support for Ukraine and pressure on Russia.

A Russian drone struck near the Yahodyn border crossing on the Ukrainian-Polish border, the Ukrainian Border Service and the Polish Armed Forces Operational Command reported on 28 September. Geolocated footage of the attack shows the jet-powered Geran-5 striking near the facility. Following the incident, Poland is reviewing its air security measures.

Russia systematically strikes Ukraine’s border crossings to complicate logistics. Russian strikes near the Ukrainian-Polish border have increased over the past month. Yahodyn is one of the largest border crossings with Poland, on a route leading, among other destinations, to Warsaw, and has repeatedly been used by senior foreign officials visiting Ukraine.

The blast wave damaged the checkpoint building at the terminal entrance, Ivan Romaniuk, head of the Volyn Regional Military Administration, reported on 28 September. It was a jet-powered drone, but there was “preliminarily no direct hit” on the border crossing, BBC Ukraine reported, citing its own sources in the State Border Guard Service of Ukraine.

Russian drone strikes near Yahodyn

On the afternoon of 28 September, Poland reported the involvement of Polish military aviation because of Russian drone attacks against Ukraine. That day, it was also reported that the airports in Rzeszów and Lublin suspended operations.

Jacek Horyszewski, a spokesperson for the Polish Armed Forces Operational Command, said on TVN24 that a Russian drone had struck near the Yahodyn border crossing in Volyn Oblast on the border with Poland.

Romaniuk confirmed the attack in the village of Starovoitove, Kovel district, Volyn Oblast, where the Yahodyn international border crossing is located.

“There have been no reports of injuries or fatalities,” he said.

Videos that appeared online show the drone falling in a forest near people and border infrastructure.

The Russians carry out such attacks on Ukraine’s western regions using repeaters on Belarusian territory that amplify signals for Shahed- and Gerbera-type drones, BBC Ukraine reported, citing State Border Guard Service data.

Poland is already considering changes to its air security rules after the incident

The same day, Polish Deputy Defense Minister Cezary Tomczyk said Poland will change its engagement rules "in the coming days." Currently, helicopter and fighter jet pilots can use weapons only after visually identifying a target: the aircraft must approach the object and determine what it is. After the rules are changed, however, a pilot or operational commander will be able to make a decision to engage based solely on radar data.

“It is notable that Polish authorities have taken this step as NATO states attempt to find an adequate response to Russian drones nearing or entering their airspace from Ukraine, often leaving NATO air defense insufficient time to identify and target such threats before they have entered allied airspace,” the Institute for the Study of War noted in its 28 September report.

Recent strikes near the Polish border

On 10 September, Polish Prime Minister Donald Tusk said that Poland had prevented a threat to one of its border crossings with Ukraine overnight and expected its border crossings to be attacked as Moscow targets trade routes in an attempt to economically weaken Kyiv. He made the statement after drones struck a border crossing between Ukraine and Moldova on the previous day, killing two people.

On 13 September, Russian forces struck the locomotive of a passenger train two kilometers from the Polish border and hit a gas station near the Yahodyn international border crossing on the Ukrainian-Polish border.

The drone attack forced passengers on a train from Ukraine to leave the carriages for safety. Those evacuated included Boris Johnson, security advisers to European governments, German Bundestag lawmakers, diplomats, and academics.

After the Russian attacks, Poland deployed military units on the border with Ukraine and strengthened infrastructure near the border crossings, Polish Defense Minister Władysław Kosiniak-Kamysz said on 15 September.

On 17 September, Russian forces struck near the Yahodyn border crossing with a jet-powered drone.

Russia plans to sharply increase military spending in 2027 while expanding the authorized size of its armed forces, according to budget documents seen by Reuters and a report by Novaya Gazeta Europe.

The developments point to Moscow preparing to expand its war effort into next year, even as its battlefield gains remain limited and its campaign increasingly relies on missile and drone attacks against Ukrainian cities and civilian infrastructure. It is also doing so as the Russian government faces a widening budget deficit and falling projected oil and gas revenues.

Russia plans 27% increase in 2027 defense spending despite widening budget deficit

Russia plans to spend 17.1 trillion rubles ($202.6 billion) on defense in 2027, according to government documents reviewed by Reuters. That is about 27% more than the 13.5 trillion rubles originally budgeted for defense in 2027 and would be the highest level of military spending since Russia launched its full-scale invasion of Ukraine in February 2022.

The documents project total defense spending of 50 trillion rubles over the next three years. The actual amount Russia will spend on defense in 2026 is classified, Reuters reported, while some military-related spending can be recorded under other parts of the state budget.

The planned increase comes alongside worsening fiscal pressures. Russia has raised its forecast for the 2026 budget deficit to 3.2% of GDP, from an earlier estimate of 1.6%, according to Reuters. Overall government spending is expected to rise 13.2% this year to 48.6 trillion rubles, or 20.9% of GDP.

The government also expects to increase net borrowing by 26% in 2026 to 5 trillion rubles and withdraw 459 billion rubles from its National Wealth Fund, Reuters reported. Its forecast for 2026 oil and gas revenues has been cut to 7.6 trillion rubles from 8.9 trillion.

Russia is reportedly planning new tax increases for 2027 to help cover the growing deficit. A new windfall tax on metals and mining companies is expected to bring in about 200 billion rubles a year, according to the documents. State debt is projected to rise to 21.7% of GDP in 2027, above the 20% level Russian authorities have previously considered safe.

The draft budget is expected to be submitted to Russia's parliament by October 1.

Army staffing also reaches new high

At the same time, Russian President Vladimir Putin has again increased the authorized size of the country's armed forces.

Putin signed a decree raising the official staffing level of the Russian Armed Forces to 2.44 million people, including 1.55 million military personnel, Novaya Gazeta Europe reported on September 28. The increase is 15,500 personnel compared with the previous decree issued in August.

It is the fourth increase in the authorized size of the Russian military in 2026 and the seventh since the beginning of the full-scale invasion of Ukraine, according to Novaya Gazeta Europe. Before the invasion, the authorized force stood at 1.90 million people, including 1.01 million military personnel.

Russia shifts more of the war into the air

The increases in military staffing and spending come as Russia continues to pursue its maximalist war aims despite limited battlefield progress. The Institute for the Study of War assessed on September 27 that Russia's frontline has remained largely static in recent months and that the Kremlin is increasingly relying on long-range missile and drone strikes as part of its effort to force Ukraine to capitulate during the winter of 2026–27.

ISW assessed that Putin may be trying to make Ukraine's infrastructure and air defense capacity buckle under sustained Russian strikes rather than relying solely on further territorial gains. The institute also said the Kremlin may delay a large-scale mobilization while it assesses whether its expanded long-range strike campaign can achieve its objectives.

The planned increase in military spending and the repeated expansion of the armed forces show that Moscow is preparing to sustain and expand its war effort into 2027, even as its forces make limited territorial gains in Ukraine.

Lithuania is getting its US troops back although the overall American presence in Europe will shrink, Lithuanian President Gitanas Nausėda said. He tied the wider drawdown to Washington's demand that Europe take more responsibility for its own defense. Lithuania's case, he suggested, is the exception.

While waging all-out war on Ukraine, Russia keeps probing Europe with drones and sabotage that stop just short of open attack. Its small Baltic neighbors are already preparing their people for a possible invasion, and American soldiers on their soil have long been the clearest sign that attacking them means fighting the US. With Washington weighing a pullback and telling Europe to fend for itself, each US unit that stays on Russia's doorstep carries more weight than its size.

"There will be fewer US troops in Europe"

Nausėda spoke in an interview with LNK television on 28 September.

"There will be fewer US troops in Europe. This is partly related to what US President Donald Trump says, to the signals the US administration is sending us that Europe must take on more responsibility itself," he said.

Europe must do more for itself, and it is already doing so, Nausėda added. The US presence in Lithuania matters not only for its military power but also for deterrence, he argued.

"The presence of these troops is precisely what reduces the likelihood of military conflict or military aggression," he told LNK, ELTA reported.

"The heavy battalion will be here"

Nausėda called the decision a kind of encouragement for Lithuania. "As the overall number of US troops in Europe decreases, in Lithuania that number will at least remain, will not decrease, and perhaps will even be slightly larger," he said. "In any case, the heavy battalion will be here."

The battalion will keep its Abrams tanks, but an engineer battalion will replace the artillery battalion, Nausėda said on LRT's Savaitė program. The rotation will again last nine months. The Americans will number roughly as before, over 1,000, Defense Minister Robertas Kaunas said.

Estonia has also secured the return of US troops, at least temporarily, LRT noted.

Explore further

Trump announces 5,000 US troops to Poland — one week after US froze scheduled combat-team rotation and amid Russia’s threat

More than 1,000 US troops began leaving Lithuania when their rotation ended in early June, and no replacement arrived, LRT said. It was the country's first gap in the US presence since 2020. American heavy battalions have rotated through Lithuania since 2019.

The Pentagon is weighing a withdrawal of about 25,000 US troops from Europe, and possibly as many as 40,000, NBC News reported, adding that no final decision had been made. About 80,000 US troops are now stationed on the continent. Germany, Italy, and Spain would likely be among the countries most affected.

For decades, Europe operated on a series of assumptions: that borders were essentially settled; that economic interdependence would constrain major-power conflict; that international law would increasingly regulate state behavior; that military force was becoming less relevant; and that, ultimately, the United States would guarantee European security.

Russia's invasion of Ukraine has shattered those norms, as Moscow attempts to change borders by force and reshape the European security order. NATO now describes Russia as the most significant and direct threat to Allied security, while also identifying sabotage, cyberattacks, disinformation, economic coercion, and other hybrid actions as part of the threat.

The foreign policy of the Trump administration is further undermining past postulations. It threatens to annex Canada, speaks of occupying Greenland by force, and ignores Spain's sovereignty. It disrespects European military contributions, then demands European support for operations of its own choosing, legal justification optional. It negotiates European security over Europe's head while resetting relations with the power that threatens the continent, calls European countries "decaying" and their leaders "weak," and has launched a trade war against its former allies while pursuing business with its former strategic opponent.

Discussing solutions without first agreeing on the problem is meaningless. Yet that is what Europe has done since the war started in 2014.

Eight realities

Analyzing the security environment, before recommending solutions, I have identified eight fixed points that I regard as constants.

1. It was never a Russia/Ukraine war

Russia has offered the West four tales, all unpleasant, one designed to look like an "easy way out." The first calls on Ukraine to give up Crimea, Luhansk, Donetsk, Zaporizhzhia and Kherson, the lie Trump's plan is built on. But Putin's demands transcend Donbas, as his 2024 speech and Russia's operations show. The second, "Novorossiya," adds Kharkiv, Dnipropetrovsk, Mykolaiv and Odesa to the first lie.

The third, "one people, one nation," claims all of Ukraine. In the words of former US National Security Advisor Zbigniew Brzezinski: "Without Ukraine, Russia ceases to be an empire, but with Ukraine suborned and then subordinated, Russia automatically becomes an empire." The fourth, "the Russian World," is the only one formalized in Russian strategic documents, encompassing the "former territories of Kyivan Rus, the Kingdom of Muscovy, the Russian Empire, the Soviet Union, and the contemporary Russian Federation."

Ukraine's defeat is crucial to Russia's broader strategy. Integrated with Belarus, a subjugated Ukraine would give Russia the population, economy and technology to be seen as a near peer to the US and China, project power across the post-Soviet space, and ease its own demographic decline, while handing Moscow the country's defense industry, farmland and mineral, gas and oil deposits, and moving Russian military power nearly 900 km closer to London, Berlin and Paris.

It would create an aggressive, imperialist power on Europe's border, emboldened to force NATO's withdrawal to its 1997 borders and to deny the US the ability to deploy forces and nuclear weapons to Europe. The West, not Ukraine, has been defined as Russia's enemy.

2. A war is ongoing in Europe

Russia has been conducting an ever-escalating hybrid war against NATO's European member states since 2014. The EU Parliament acknowledged as much in September 2021. Its aggressions include sabotage against critical infrastructure, cyberattacks, disinformation, GPS jamming affecting civilian aviation, repeated airspace violations by strike drones, and attacks on Europe's defense-industrial base.

Russia's acts of violence against Western targets are becoming increasingly brazen. In August, Western intelligence sources reported a new wave of attacks on weapons factories in Europe under cover of "plausible deniability," The Telegraph reported. A CIA report shared with European governments warns Russia may attack Spain, France or Italy with Gerbera drones launched from ships, El Mundo reported, citing Lithuanian sources.

It is the same hybrid war Ukraine faced until 24 February 2022, one expected to turn open by 2029. Article 5 could, and probably should, have been triggered years ago. Having failed to respond, NATO has lost credibility, raising the risk of war.

3. The tsunami of ripple effects is changing the political landscape in the West

In May 2022, I began using the term tsunami of ripple effects to describe the cost of not intervening in a war that threatens the security of the Alliance. It is the reverberations that raise the cost of living, undermine food and energy security, and spread famine, recession and inflation, raising the risk of unrest, extremism, and, ultimately, the fall of governments. Europe is living through the biggest refugee crisis since the Second World War.

The international security architecture is being dismantled, our institutions discredited, and NATO no longer deters Russia. Building on public frustration, the tsunami of ripple effects gave us Trump and the rise of right-wing parties across Europe.

4. NATO no longer deters Russia

If Russia were deterred, it would not have launched a full-scale invasion of Ukraine. NATO's strategic concept commits it to ending, by political and military means, conflicts that threaten Alliance security, including in Ukraine. Nor would Russia be conducting an ever-escalating hybrid war against NATO's European states, or preparing for a military conflict with the Alliance, as US and European intelligence services warn. Lack of deterrence raises the risk of Russian strategic miscalculation and war, especially since NATO was the only military power able to deny Russia its Great Power aspiration and its demand for a sphere of influence over the post-Soviet space.

NATO used to display readiness and capabilities. Today it has become a religion. Europe begs it is still almighty while Russia is a disbeliever.

Explore further

NATO no longer deters Russia. A new coalition could

5. The transatlantic rupture undermines NATO and European security

Canadian Prime Minister Mark Carney put it plainly at Davos on 20 January 2026: "We are in the midst of a rupture, not a transition." We "cannot live within the lie of mutual benefit through integration when integration becomes the source of your subordination," he said, calling for countries to organize in the face of great-power rivalry through different coalitions for different issues, based on common values and interests. As he told the World Economic Forum: "We actively take on the world as it is, not wait around for a world we wish to be."

6. The war is existential to both Ukraine and Russia

Ukraine is fighting for its right to exist. Russia is fighting for its Great Power status, strategic parity with the USA and China. If it is defeated in Ukraine, it will forever remain a pariah state, potentially imploding. For a negotiation to succeed, it must solve the cause of the war: Russia's Great Power ambitions, which cannot be negotiated away, only denied through military power.

7. Russia will never accept being defeated by Ukraine

Even with the tools to evict the Russian Armed Forces, Ukraine cannot expect Russia to accept defeat by a nation that, in its distorted narrative, "does not exist." Russia would only accept withdrawal from Ukraine if the alternative were to fight a far superior military power and thereby risk losing the means that secure the survival of the regime and the state.

8. Europe has very limited time to stop the war from escalating

Several European intelligence services warn of war by 2029;

• French intelligence is preparing for large-scale Russian attacks by 2030, and autumn 2027 is now being discussed, France Télévisions reported;
• US intelligence expects Russia may test NATO's resolve with a limited strike against a member state between this autumn and 2029, the Wall Street Journal reported in August;
• Baltic intelligence chiefs told The Guardian on 20 September that an attack could come within "months, not years."
• Worse still, Europe won't be ready until 2035, six to nine years too late, SACEUR warns.

Explore further

NATO’s generals warn of war by 2029. Europe won’t be ready until 2035.

Rules do not enforce themselves

International law, sovereignty, and territorial integrity remain fundamental principles. But without the capability and political will to defend them, principles become aspirations, not constraints on states prepared to use force. Acknowledging the world as it is means acknowledging that power still matters. It means accepting that deterrence requires more than statements of concern: ammunition, air and missile defense, long-range strike and counter-drone systems, secure communications, logistics, cyber resilience, and the industrial capacity to sustain a prolonged conflict.

This is where Carney's second formulation matters: countries must rely not only on "the strength of our values, but also the value of our strength." Values mean nothing unless one is prepared to defend them, as Canada is doing, raising defense spending and strengthening domestic industry. Europe needs to draw the same conclusion: strategic autonomy, not abandoning NATO, but ensuring Europe can defend itself and its interests even when an ally's priorities change.

The European Council already calls Russia's war an existential challenge and demands defense readiness be strengthened by 2030. But acknowledging reality means going further than setting targets.

It means recognizing that Ukraine is not merely the recipient of European security assistance. Ukraine is an integral part of Europe's security architecture. Its battlefield experience, defense industry, intelligence, and ability to absorb and defeat Russian attacks are crucial to European security.

Because individual member states refuse Ukraine as a member, NATO has made itself a liability, and some of the same countries are erecting hindrances to its EU membership too, letting national interest block common security.

The solution

The choice is not between idealism and realism. It is between pretending that the old assumptions still hold and building the capabilities required by the reality that has replaced them.

Acknowledging the world as it is means seeing the threats clearly; defending the world as it should be means acting on that knowledge, and the bridge between the two is strength.

Accept those eight fixed points, and Europe's room for maneuver is gone, along with its present strategy. Europe cannot afford another 12 years of futile diplomacy while Russia exploits our naivety to prepare for war in the next two to three years, diplomacy that has undermined Europe's need to rearm and establish credible deterrence.

European governments have long acknowledged that their armed forces no longer provide credible defense, yet their security policy still assumes NATO guarantees collective security.

Acknowledge reality, and the illusion shatters.

Europe urgently needs a new strategy, one that looks beyond NATO and the EU's inherent weaknesses toward a military alliance credible enough to reshape the strategic environment. This is why I have long argued for a Coalition of Like-Minded European countries (CALM). It offers a path from recognition to action, from acknowledging NATO's failure to building something that works.

Strength is not found in numbers, but in unity: agreeing on the enemy, his aims and strategy, and committing to countermeasures that demonstrate real will and capability to fight.

Explore further

The alternative to NATO: A Coalition of Like-Minded European Countries

Unlike NATO or the EU, CALM does not have to wait for Europe's rearmament to reach 2035. It builds on existing NATO interoperability.

The force already exists: Ukraine's battle-hardened army, National Guard, Special Operations Forces, air defense, and Unmanned System Forces, combined with European fifth-generation aircraft and state-of-the-art navies, are credible, combat-proven, and in place.

Russia already struggles to fight Ukraine alone; it would face a different reality entirely if Ukraine formally joined a coalition of European military powers. That is why the declaration matters now, not after the capability is fully built: with the interoperability already proven, it changes Russia's strategic assessment immediately, not in 2035.

This is not only about physical capabilities. It is about changing Russia's perception of its strategic environment. It starts with a declaration; preparing for military intervention comes next. But it begins with the declaration.

Hans Petter Midttun

Hans Petter Midttun, independent analyst on hybrid warfare, Non-Resident Fellow at the Centre for Defense Strategies, board member of the Ukrainian Institute for Security and Law of the Sea, former Defense Attaché of Norway to Ukraine, and officer (R) of the Norwegian Armed Forces. 

Editor's note. The opinions expressed in our Opinion section belong to their authors. Euromaidan Press' editorial team may or may not share them.

Submit an opinion to Euromaidan Press

The vehicles carried out autonomous underwater formation navigation with no human intervention for 34 minutes over 500m

Russia is likely attempting to force Ukraine to capitulate by spring 2027 through a large-scale campaign of long-range strikes, the Institute for the Study of War (ISW) said in its 27 September report. Russian President Vladimir Putin's new theory of victory relies heavily on the mass use of jet-powered drones and ballistic missiles against Ukraine, the institute assesses.

Russia keeps shifting to faster jet-powered drones that Ukraine's defenses struggle to stop, forcing it to spend scarce missiles on them. Russia's use of jet-powered drones rose eightfold from June to August, with Moscow launching around 7,700 such drones since their initial deployment, Ukrainian Air Force spokesperson Yurii Ihnat said on 23 September. But Putin likely does not expect the campaign to last indefinitely, and he may hold off on a new mobilization until he sees whether the strikes work, ISW assesses.

Putin's modified theory of victory

Putin's modified theory of victory largely depends on Russia's ability to mass-launch cheap jet-powered Gerans that get through Ukrainian defenses often enough, the institute notes.

Even a Kremlin-linked Russian milblogger claimed on 27 September that the Russian strategy, which relies heavily on long-range strikes, is costly and cannot continue indefinitely, not least because Ukraine is hitting Russia harder too, according to the analysis.

At the same time, Putin stated on 25 September that Ukraine "must feel" Russia's "retaliatory" strikes. ISW assesses that this suggests he intends to intensify Russia's strike campaign in winter, as he has in previous winters.

If Putin is counting on Ukraine to break and capitulate this winter, he may be ignoring what the campaign will cost Russia over time, the institute notes. This strategy also counts on Ukraine's shortage of Patriot interceptors against ballistic missiles, and on the country's power grid and other vital systems giving way under months of strikes.

Until that approach runs out, Putin is unlikely to back down on his demands or agree to real ceasefire talks, ISW assesses.

Ukrainian interceptors could disrupt Russia's plan

A Kremlin-linked Russian milblogger claimed on 27 September that Russian forces launched predominantly jet-powered Geran-5 drones at Odesa, Mykolaiv, and Kyiv during the night of 26–27 September. According to the blogger, Russia's diverse arsenal of strike weapons and Ukraine's shortage of air defense assets allow Russian forces to maintain the current pace of strikes and expand the range of targets, ISW writes in its analysis.

At the same time, Ukrainian President Volodymyr Zelenskyy said on 26 September that Ukraine's interception rate for jet-powered Shahed drones currently stands at 55%. Of more than 2,730 such drones Russia had launched in September by then, Ukrainian forces had downed or suppressed more than 1,500, he added.

Ukraine is testing interceptor drone prototypes in combat conditions, Ukrainian Presidential Office head Kyrylo Budanov told Novyny.LIVE on 27 September. The mass deployment of interceptors capable of shooting down jet-powered Gerans could begin within several months, he added. Ukrainian companies have already successfully tested several interceptor drones capable of intercepting Russian jet-powered drones in field conditions, the institute notes.

At the same time, it remains unclear whether Ukraine will be able to scale up its interceptor program quickly enough and achieve sufficient success to disrupt the intensification of Russia's campaign during the winter, ISW notes.

Why Putin may hold off on a new mobilization

Expanding Russia's arsenal of strike weapons is cheaper than carrying out a second mobilization economically, militarily, and socially, a Kremlin-linked Russian milblogger cited by the institute claimed.

Putin may put off large-scale forced mobilization until he sees whether the strikes deliver, ISW assesses, though his officials have been laying the groundwork for it despite Kremlin denials. Still, the need to replace Russia's enormous battlefield losses could push him to order such a mobilization as early as this fall, ISW notes, as Ukrainian and other sources have repeatedly reported he is preparing to do.

A Ukrainian Hornet drone struck a Russian radar system about 120 kilometers behind the front, Taras Myshak, senior communications officer of the 59th Separate Assault Brigade of Unmanned Systems, said on Suspilne on 28 September, ArmyInform reported. The brigade's Signum unmanned systems battalion carried out the strike about a week earlier, he added.

Russia's air defenses depend on radars to see Ukrainian drones and missiles coming. Every radar it loses weakens that watch and gives the next Ukrainian strike a better chance of getting through.

According to Myshak, the target was a "quite expensive" Russian radar system.

A radar system is effectively the "eyes" of the Russian air defense system: it detects aerial targets, determines their coordinates, and transmits information to other elements of the system.

Russians continue probing Ukrainian defenses

Russian forces in the brigade's zone, roughly along the Donetsk Oblast border, continue to operate in small infantry groups and use infiltration tactics, Myshak says. At the same time, the Russians are trying to cut Ukrainian logistics, he adds, saying that the brigade is effectively holding the Russian army back from infiltrating into Dnipropetrovsk Oblast.

The Russians' main means in this sector remain drones and infantry, the serviceman says. The number of infantry has decreased somewhat compared with previous periods, but the pressure from the enemy has not stopped, he adds.

"Of course, they will try, they will constantly probe, so to speak, our defense with their infiltrations. And likewise with drones, of various ranges, working on logistics, making it impossible for us to enter positions, to deliver everything necessary to the positions, in order to make our defense impossible," Myshak emphasized.

At the same time, Ukrainian troops are trying not only to defend against these actions but also to deprive the Russians of radars, electronic warfare systems, and other equipment, the serviceman says. "We likewise don't let them relax," he said.

Ukraine systematically knocks out the "eyes" of Russian air defense

In October 2024, Ukraine's military said it had hit a Russian Nebo-M radar station with ATACMS ballistic missiles to blunt Moscow's ability to spot and shoot down aircraft and missiles, Reuters reported. The military estimated each such system at more than $100 million.

Ukraine is systematically increasing its use of medium-range strike drones, which can hit targets up to 200 kilometers deep inside enemy territory, the Ukrainian Defense Ministry reported in May this year. Russian air defenses and radars are among the main priorities of such operations, as their destruction weakens the system for detecting and intercepting aerial targets, the ministry said. Medium-class drones, including the FP-2, Hornet, and Bulava, play a critical role in such strikes, the ministry noted.

According to the General Staff of the Armed Forces of Ukraine, Ukrainian forces struck at least 25 major Russian air defense and radar systems during April, about 12 of which were radar systems, the Ukrainian Defense Ministry also wrote in May this year.

Ukrainian drones struck two fuel depots in Krasnodar Krai overnight on 28 September, setting both on fire, Militarnyi reported. The targets were the NFB-Pavlovskaya depot in Pavlovskaya and the Edelveys-95 depot near Novotitarovskaya, about 25 km from Krasnodar.

Residents heard six explosions near the railway

A drone alert was declared in the region at 23:43. Residents of Novotitarovskaya then reported drones overhead and at least six explosions near the railway, Russian news Telegram channel Astra reported. Fires broke out at both depots. NASA FIRMS satellite data confirmed both blazes by 04:24, Militarnyi reported, citing imagery published by Ukrainian Telegram channel Exilenova+.

What the depots store

NFB-Pavlovskaya handles cargo operations with petroleum products, including wholesale trade in motor fuel and petroleum storage, Militarnyi reported.

Edelveys-95 is a similar facility. It specializes in wholesale distribution of diesel fuel (Euro-5 standard) and gasoline (AI-92, AI-95, and AI-100), Astra reported. Its capacity is 4,500 cubic meters, and it has its own rail siding for receiving and shipping fuel. The company has been selling petroleum products for 30 years, buying directly from Russia's largest refineries, according to its website.

Ilsky refinery struck days earlier in the same region

The overnight strikes came two days after SBU drones struck the Ilsky oil refinery in the same region on 26 September, triggering fires near the ELOU-AVT unit and the tank farm. Ilsky is one of the largest refineries in Russia's Southern Federal District, with a design capacity of roughly 6.6 million tonnes of crude per year, and has been struck more than 18 times since the start of Russia's full-scale invasion.

Ukraine's sustained campaign against Russian fuel infrastructure has earlier pushed Russia's fuel shortages into Central Asia and forced Moscow to seek emergency refining deals abroad.

The soldiers’ military backgrounds and firsthand knowledge of North Korea’s deployment to Russia could result in more extensive debriefing

French President Emmanuel Macron said French services received no CIA warning about a possible Russian drone attack from Mediterranean merchant ships, pushing back on an El Mundo report that US intelligence had alerted France, Italy, and Spain, RTL reported.

Macron’s denial comes amid drone attacks and sabotage cases that European governments have linked to Russia. France is preparing stronger defenses against that wider threat, even as Macron says its services received no specific CIA warning. Italy’s defense minister has also cautioned against fueling alarm over an unconfirmed report.

Asked about the report during a televised interview on 24 September, Macron said: “The CIA did not inform French services of such an attack.” He said Russia was multiplying hostile and sometimes criminal acts against European countries. Covert acts such as sabotage and cyberattacks are often described as hybrid warfare. Asked whether France itself could be attacked, Macron answered yes.

Italian Defense Minister Guido Crosetto separately wrote on X that El Mundo’s alert “finds no confirmation.” He said it served no one to add “more fuel to the fire” at an already tense time.

The Spanish newspaper reported that the possible operation would use Gerbera drones, small Russian aircraft capable of carrying several kilograms of explosives. The drones would be hidden in shipping containers aboard merchant ships and launched toward targets along Europe’s southern coast. El Mundo cited a source close to Lithuania’s Defense Ministry, and analysts familiar with a CIA report said to have circulated among European foreign ministries. Euromaidan Press covered the account on 24 September. Bythe time of publication, neither Spain’s government nor the CIA had publicly addressed it.

Macron pointed to the failed attack at Leipzig/Halle Airport in eastern Germany in August. A drone carrying explosives was found near a Ukrainian cargo aircraft. German officials attributed the attempt to Russia. Macron said France had not experienced a comparable incident.

The wider hybrid warfare threat

Beyond the disputed Mediterranean alert, authorities have investigated other incidents throughout Europe as possible Russian sabotage.

Germany followed its accusation over Leipzig with diplomatic measures against Moscow. Berlin ordered Russia’s last consulate in Germany closed and ended an agreement permitting a Russian cultural center. German investigators also identified two suspects, including a Russian man they linked to military intelligence. Moscow denied involvement.

Poland’s justice and interior ministers said Russian intelligence ordered the May 2024 arson of Warsaw’s Marywilska 44 shopping center.

Finnish President Alexander Stubb said Russia would continue such attacks to frighten Ukraine’s allies into reducing support. He urged vigilance without overreacting, saying Finnish intelligence saw no imminent military threat.

The Institute for the Study of War (ISW) published a map in its analytical report on 24 September that contrasts the claimed Russian encirclement with the location of Russian forces as assessed by the experts. Based on the evidence observed by ISW, the nearest area where Russian forces are present is 10.2 kilometers from the southeastern outskirts of Dobropillia.

Russia has been spreading disinformation about its successes around Dobropillia as part of what ISW calls a cognitive warfare effort to portray Ukrainian defenses as on the verge of collapse. Russia's Defense Ministry published a map claiming the city was surrounded. ISW's own map challenges it. The Ukrainian military says the city remains under its control.

Russian Defense Ministry claims it is already destroying encircled Ukrainian troops in Dobropillia and moving further

Units of Russia's Center Grouping of Forces continue combat operations against encircled Ukrainian forces in the Dobropillia area of Donetsk Oblast while simultaneously advancing toward Oleksandrivka, the Russian Defense Ministry claimed. ISW analysts, meanwhile, said they have not observed evidence supporting Russia's claim that the city is encircled. They also noted that Ukrainian officials "directly refute" the claim.

ISW observed evidence that Russian infiltrators, small groups, were operating east and northeast of Dobropillia on 19 and 20 September. The institute did not assess that these infiltrators had consolidated their positions.

Ukrainian forces maintain positions south and northeast of Dobropillia, military observer Kostiantyn Mashovets said on 20 September, according to ISW.

Russian forces have not made major gains in the Dobropillia direction, the chief of staff of an artillery reconnaissance battalion said on 22 September, according to the institute. On the same day, a Russian milblogger described the "alleged Russian encirclement of Dobropillia" as potentially meaning not the direct presence of infantry, but only the establishment of fire control over Ukrainian logistics, including roads west of Dobropillia and toward Sviatohorivka, according to ISW.

ISW noted that Russia's pervasive military culture of lying—what Russian milbloggers themselves call "beautiful reports"—has degraded the Defense Ministry's own ability to understand the battlefield and enabled inflated claims like the Dobropillia encirclement.

Russia uses this disinformation as a "diversion"

In its statement, the Russian Defense Ministry itself described Dobropillia as a "strongly fortified settlement" whose seizure would threaten key Ukrainian supply lines running from Dnipropetrovsk Oblast toward the Fortress Belt—the Sloviansk-Kramatorsk-Druzhkivka urban agglomeration.

Russia has recently renewed its attempts to break through toward Dobropillia.

Third Army Corps Commander Andrii Biletskyi said that Russian forces sought to bypass the fortified cities through Dobropillia and link up with troops advancing from north of Lyman, rather than launch a direct assault. ISW noted on 16 September that the Vivaldi operation disrupted Russia's two-pronged plan. In its 24 September report, ISW said Russia's claims about Dobropillia were partly intended to divert attention from Ukraine's elimination of the Russian salient north of Lyman, which has likely forced Russia's command to rethink its wider encirclement plans.

Several recent incidents across Europe were conducted by Russia or are likely attributable to Russia, ISW assessed in its 24 September report, though authorities have not officially linked the Polish and German incidents to Moscow.

Russia's full-scale war against Ukraine has expanded into a parallel campaign of provocations against European defense and logistical infrastructure. The Kremlin is using drones, arson, and undersea cable sabotage to degrade Europe's will and ability to support Ukraine, while deliberately intensifying the frequency of airspace violations to erode the boundary between hybrid and kinetic war.

Drones over Moldova and Romania

Four Russian drones flew over Bukovyna and targeted an energy facility and border crossings with Moldova and Romania, Chernivtsi Oblast Military Administration head Ruslan Osypenko reported. Ukrainian forces shot down three. The fourth flew toward Suceava County in northeastern Romania.

A drone crashed in Cernița, Florești district, Moldova—preliminarily identified as a Russian Gerbera type, the first such device found in the country. It carried an onboard camera, hit a tree, and exploded, Moldovan police said. Romania's Defense Ministry reported a second aerial vehicle entered Romanian airspace for four minutes and crashed near Solca in the same border region; geolocated footage confirmed it was also a Gerbera, ISW noted. Poland evacuated the Hrubieszów and Dorohusk border crossings for 30 minutes, Prime Minister Donald Tusk said. Three countries were put on alert by a single night of Russian strikes.

"Intentional and accidental Russian drone incursions into NATO and Moldovan airspaces are likely part of the Kremlin's efforts to normalize airspace violations by intensifying their frequency," ISW assessed.

Sabotage in Poland and Germany

A fire engulfed the power system and backup generator at a Starlink ground station in Wola Krobowska, central Poland, on the evening of 23 September. Deputy Prime Minister Krzysztof Gawkowski confirmed it was sabotage aimed at cutting internet access, including for Ukraine's military. Authorities have not identified who was responsible, but the act aligns with Russia's "new" doctrine of attacks, Gawkowski said. The station is now operating normally.

German authorities suspended operations at Berlin-Brandenburg airport for 45 minutes the same evening after staff reported a drone sighting, Die Zeit reported. Federal police could not confirm it. ISW assessed both incidents fit Russia's wider pattern of sabotage against European defense assets, though neither has been officially attributed to Russia.

Explore further

Russian attack puts three countries on alert as drones enter Moldova and Romania

Western intelligence warnings

A Lithuanian Defense Ministry source reported on 23 September that Russia could launch Gerbera drones from a shipping container in the Mediterranean against Spain, France, and Italy. Danish Defense Intelligence assessed on 24 September that Russia will intensify its hybrid war in coming months, including destructive cyber attacks and sabotage carrying a high risk of casualties, and that there is a low but growing risk of a limited Russian military attack on a NATO border state. It sees no indications of an outright invasion. The CIA reportedly warned Poland that Russia may sabotage underwater cables to disrupt its banking system, according to Newsweek Polska journalists.

NATO tracked and confronted Russian submersibles rehearsing deployment of a new cable-disabling weapon near Svalbard in spring 2026—no cables were damaged, but the operation demonstrated Moscow's intent, Reuters reported. Shadow fleet vessels likely served as drone-launch platforms for incursions into NATO airspace, ISW noted.

"The increasing frequency of such warnings suggests that Western intelligence agencies are picking up indicators that the Kremlin is looking to diversify its platforms and means for conducting attacks against NATO and European states and is considering conducting such attacks," ISW assessed.

ISW said it has not yet seen evidence that Russia has conducted the attacks the warnings describe.

Denmark's assessment—that a limited Russian military strike on a NATO border state could come in the coming months—suggests the boundary between hybrid provocations and military action is narrower than European policy has assumed. ISW's synthesis reframes what governments have treated as separate incidents into one campaign.

"Intentional and accidental Russian drone incursions into NATO and Moldovan airspaces are likely part of the Kremlin's efforts to normalize airspace violations by intensifying their frequency," ISW assessed.

"The increasing frequency of such warnings suggests that Western intelligence agencies are picking up indicators that the Kremlin is looking to diversify its platforms and means for conducting attacks against NATO and European states and is considering conducting such attacks," ISW assessed.

Indian police arrested the foreigners on terrorism allegations in March but later downgraded the charges

Russian President Vladimir Putin has again told US officials that Russia can capture Ukraine’s Donetsk Oblast within several months, according to Ukrainian President Volodymyr Zelenskyy.

Speaking to the UN General Assembly on 24 September, Zelenskyy said this was the latest in a long series of similar promises as Russia has spent nearly five years trying to seize the region. He said Putin has made such promises 17 or 18 times, repeatedly pushing the deadline further back.

He contrasted those promises with Russia’s heavy battlefield losses and relatively limited territorial gains.

Russia has paid a huge price for its Donetsk offensive

Zelenskyy said Russian forces suffered 248,964 troops killed or severely wounded between January and August 2026.

He said Russia had captured only slightly more than 1,000 square kilometers of Ukrainian territory this year, while Ukraine had already liberated a significant portion of those gains.

Zelenskyy presented the figures as the human cost of Putin’s continued attempt to seize Donetsk, arguing that Russia is paying an enormous price for relatively limited territorial gains.

“Always the same: ‘Just a few more months,’” Zelenskyy said, adding that Putin would again fail to meet his latest deadline.

The Russian offensive is also facing a recent setback in northern Donetsk. Ukraine launched Operation Vivaldi in September to clear Russian infiltrators and retake ground near Lyman, disrupting Russia’s plan to encircle the fortified cities of the Donetsk “Fortress Belt.”

Ukrainian forces have reported retaking several settlements and clearing up to 125 square kilometers in the operation, although the full scope of the offensive remains undisclosed.

Explore further

Ukraine retakes ground in a region Russia has fought for years to capture. “Vivaldi” is only getting started but is already “one of the most important victories for Ukraine in 2026”

Zelenskyy also warned that Russia’s ambitions extend beyond Donetsk. After saying Putin would again fail to capture the region, he said Russia would continue seeking other Ukrainian cities, naming Odesa, Kharkiv and Dnipro, while also pointing to Russian pressure on Moldova and threats toward Poland and the Baltic states.

Russia continues to pour missiles and drones into Ukraine

The battlefield campaign has been accompanied by a sustained Russian long-range attack campaign against Ukrainian cities and infrastructure.

Since the beginning of 2026, Russia has launched more than 2,100 missiles against Ukraine, including more than 950 ballistic missiles, according to Zelenskyy.

Ballistic missiles are particularly difficult for Ukraine to counter because it has a limited supply of interceptors capable of engaging them. Russia’s heavy use of ballistic weapons is therefore contributing directly to civilian deaths and infrastructure destruction.

Over the first eight months of the year, Russia also used 63,000 attack drones of various types, Zelenskyy said. More than 7,700 were jet-powered Geran drones, which he described as particularly destructive and dangerous.

The newer jet-powered drones are faster and more advanced than earlier Shahed-type models, making them harder to intercept and adding to the pressure on Ukraine’s air defenses as Russia attacks cities and infrastructure.

Zelenskyy said Russia was using the drones continuously to disrupt economic activity and normal life in Ukrainian cities, including by making it harder for children to attend school.

The figures show the scale of the Russian campaign beyond the front line. Alongside its ground offensive, Russia is using sustained missile and drone strikes to kill civilians, destroy infrastructure, and exhaust Ukraine’s air-defense resources.

North Korean troops add to Russia’s war effort

Zelenskyy also highlighted North Korea’s direct involvement in Russia’s war, saying its troops have suffered heavy losses while gaining battlefield experience alongside Russian forces.

He said North Korea’s military capabilities were also benefiting from its cooperation with Russia, pointing to improvements in its ballistic missiles and drone capabilities.

Ukraine recently transferred two North Korean prisoners of war to South Korea. Zelenskyy said capturing the soldiers alive had been difficult and described one prisoner’s attempt to take his own life after realizing he was about to be captured.

He said the soldiers had been conditioned to believe they had to die rather than surrender.

“Do you really want to give such a force more time to learn how to fight?” Zelenskyy asked.

Zelenskyy calls for de-escalation before winter

Zelenskyy separately warned that Russia could again target Ukraine’s energy and heating infrastructure this winter.

Russia has already intensified attacks on Ukraine’s energy system ahead of the cold season.

Russia has also explicitly threatened to “freeze” Ukraine this winter, with its Defense Ministry linking the threat to attacks on Ukrainian infrastructure. The country spent much of the previous winter dealing with the consequences of Russian strikes on power and heating infrastructure, including blackouts and disruptions to heat supplies.

Zelenskyy said Ukraine expects the coming winter to be difficult but warned that if Russia continues attacking Ukraine’s energy and heating systems, Ukraine will make the winter painful for Russia as well.

He called for steps toward de-escalation before winter, saying that diplomacy and military strength were both needed to end the war.

Within 24 hours of claiming Ukrainian troops were surrounded near Dobropillia, Russia’s Defense Ministry and pro-war channels expanded the narrative to several supposed encirclements in northern Kharkiv Oblast. Evidence supports none of that, the Institute for the Study of War (ISW) has said.

The claims come as Ukrainian forces make gains in several frontline sectors, according to ISW. Near Dobropillia, Russian bloggers described the ability to fire on supply roads rather than troops surrounding the town. At the same time, Ukrainian forces said they had prevented Russia from physically cutting the routes.

Russia’s Defense Ministry claimed its forces had captured Krasnyi Yar and Potykhonove northeast of Kharkiv. Pro-war bloggers then claimed Russian troops threatened to trap Ukrainian units near Riznykove and had already surrounded others near Rublene. One asserted that roughly 1,500 Ukrainian soldiers were encircled across 460 square kilometers.

ISW found no evidence for those claims. A Ukrainian brigade spokesperson said Russian forces were still shelling settlements they claimed to hold and described positions in the area as heavily intermingled, with no clear front line.

Around Dobropillia, the Kremlin-linked Rybar channel claimed Russian troops were infiltrating toward nearby settlements and making tactical gains south of the town. It did not claim Russian forces had secured those settlements or show an encirclement on its map, ISW noted.

Another Russian blogger said neither side currently had the forces needed to establish and sustain a genuine encirclement.

Russia’s push toward Dobropillia continues

Russia’s Defense Ministry had claimed on 22 September that its troops surrounded Dobropillia, a transport hub on the approach to Ukraine’s fortified cities in Donetsk Oblast.

ISW found no evidence for that claim and linked its timing to the UN General Assembly and Ukraine’s recent battlefield gains. A Ukrainian officer said Russian troops had made no major advances near the town.

Russian assaults continue despite that setback. A Ukrainian staff sergeant reported a sharp increase in the number of small groups trying to reach Dobropillia. On 23 September, Ukraine’s 1st Azov Corps said its forces had prevented Russian troops from physically cutting supply routes toward Dobropillia and Druzhkivka.

The US has arrested the CEO of Virginia-based digital forensics company Oxygen Forensics and a Russian national over allegations that they concealed the company’s Russian ownership and the fact that its software was developed in Russia while selling it to US government agencies, according to the US Justice Department.

The case highlights a potential route through which Russian-linked networks could seek access to sensitive US institutions: concealing Russian ownership and influence behind seemingly legitimate American companies.

Lee Reiber, 55, and Oleg Sergeyevich Davydov, 52, are charged with conspiracy to commit wire fraud. The US Justice Department alleges that five Russian nationals, including Davydov, owned and controlled Oxygen Forensics through a Cyprus-based holding company, while its software was developed by a team in Russia.

Software sold to US government agencies

According to the criminal complaint, Oxygen Forensics presented itself to US agencies as an independent American company with no foreign ownership or control.

The company sold digital forensic software used to recover and analyze data from electronic devices to the US Department of War and three Department of Homeland Security components: the Secret Service’s National Computer Forensics Institute, Homeland Security Investigations, and the DHS Office of Inspector General.

The National Computer Forensics Institute awarded Oxygen Forensics a five-year contract in September 2024. The award file included a certification from Reiber stating that the company had no immediate or highest-level owner, according to the affidavit.

The Justice Department alleges that this was false. The Russian owners allegedly continued to make significant company decisions, set Reiber’s compensation, control payments and retain signatory authority over bank accounts after their names were removed from public corporate filings.

Russian software development allegedly concealed

The complaint says the same five Russian nationals also owned a Russian company founded by Davydov in 2000, previously known as Oxygen Software and now called MKO Systems.

According to the affidavit, the Russian company developed the software used by Oxygen Forensics, with developers working in Russia under Davydov’s direction. MKO Systems also sold its software in Russia under different product names to customers that reportedly included the Federal Security Service (FSB), the Russian Investigative Committee and the Russian Ministry of Internal Affairs.

After the US expanded sanctions against Russia in 2022 following Russia’s full-scale invasion of Ukraine, the Russian owners allegedly agreed with Reiber to conceal both the company’s ownership and its Russian development operations.

Reiber was installed as CEO, president and chairman in March 2022, while the Russian owners were removed from the company’s public filings, according to the Justice Department.

The complaint alleges that the arrangement did not end the Russian owners’ control. One of them was later appointed to the company’s board using a Turkish identity, according to the affidavit.

OSINT investigators had traced Russian software links

Militarnyi separately reported that OSINT investigators from InformNapalm had previously traced corporate and technological links between Oxygen Forensics and Russia’s Oxygen Software, now known as MKO Systems.

According to Militarnyi, the Russian company’s products were supplied to Russian security and law-enforcement agencies, including the FSB and Ministry of Internal Affairs. The investigation traced a common corporate and technological origin between the Russian and US software ecosystems.

CEO allegedly denied Russian involvement

The Justice Department says Reiber repeatedly certified to US authorities that the company had no foreign ownership or control.

In March 2026, he allegedly told DHS personnel that no Russian was involved in developing Oxygen Forensics’ software and that no one in Russia had access to its development environment. Days later, he published a statement saying the company had no development presence in any restricted jurisdiction.

The complaint alleges that the software was in fact written and managed by a team in Russia, using a cloud environment administered by one of the Russian owners.

The affidavit also describes a November 2023 exchange in which Reiber allegedly told the Russian owners that public reporting about the company’s Russian connections could jeopardize a pending US government contract.

Arrests and seizures

Reiber was arrested in Idaho on 20 September and released on bond after appearing in federal court. Davydov was arrested the same day at London Heathrow Airport before boarding a flight to Istanbul. The US says it will seek his extradition.

Separately, a federal judge authorized the seizure of Oxygen Forensics’ corporate bank accounts, around 57 domains and other cyber infrastructure allegedly used in the scheme. The domains and related infrastructure were seized on 20 September.

The case is being investigated by the US Department of Commerce’s Bureau of Industry and Security, with assistance from the Department of War Office of Inspector General’s Defense Criminal Investigative Service.

Each could face up to 20 years in federal prison if convicted.

Moldova’s Defense Ministry reported four drone incursions, Romania’s Defense Ministry confirmed a drone crash, and Poland’s Operational Command scrambled fighters twice during Russia’s 24 September attack on Ukraine.

The strike wave forced Moldova to close part of its airspace, Romania to warn residents and launch F-16 fighter jets, and Poland to activate aircraft, air defenses, and radar. No casualties were reported in the two confirmed crashes, and Poland detected no incursion during its first deployment. Moldova has recorded dozens of Russian drone incursions this year.

The drones approached from Ukraine’s Vinnytsia, Odesa, and Chernivtsi oblasts, according to Moldova’s Defense Ministry. Authorities temporarily closed part of the country’s northern airspace.

Near Cernița in northern Moldova, one drone struck a tree, fell into a field beside a farm, and exploded, police said. No casualties were reported.

Investigators preliminarily identified the camera-equipped wreckage as a Gerbera, a low-cost Russian drone often used during attacks on Ukraine. Police said it was the first device of that type found in Moldova.

Police also reported a resident’s account of another explosion near Vadul Rașcov, but said they were still investigating the location.

Romanian radar first tracked an aerial target over Ukraine near the border before it entered northern Romania, the Defense Ministry said. Romania launched two F-16s and sent emergency alerts to residents’ phones in the area. The drone remained in Romanian airspace for about four minutes before crashing near Solca, the ministry said. Officials reported no casualties or damage and had not identified the drone’s origin.

Poland’s Operational Command launched fighters twice in response to Russian strikes on western Ukraine. The first Polish deployment ended around 08:00 with no airspace violation detected; the command announced a second at 09:07. It also activated ground-based air defenses and radar.

The incursions came amid a wider assault. Ukraine’s Air Force said Russia launched 282 drones of various types, along with ballistic and other missiles, overnight into 24 September. Ukrainian officials reported detecting four drones over Chernivtsi Oblast, the Ukrainian region bordering Moldova and Romania, and shooting down three.

Moldova’s repeated airspace breaches

The latest incident followed several breaches in August. An unidentified drone exploded near Crocmaz on 9 August. Another object exploded near Talmaza on 17 August after Moldova briefly closed part of its airspace.

President Maia Sandu said Russian drones had entered Moldovan airspace 39 times in 2026, compared with 17 times throughout 2025. Moldova has portable air-defense weapons and electronic warfare equipment, but Sandu said these chiefly protect individual sites. Her government is working with partners to expand air-defense coverage and speed up threat warnings.

A court in Pula ruled that Ukrainian diving instructor Volodymyr Zhuravliov may be extradited to Germany over the September 2022 blasts that damaged the Nord Stream gas pipelines between Russia and Germany and caused major leaks in the Baltic Sea, RBC-Ukraine reported, citing his lawyers.

A Polish court refused to extradite Zhuravliov last year, but its ruling did not cancel Germany’s EU-wide arrest warrant. Croatia could therefore arrest him and decide Germany’s request for itself. The pipelines at the center of the case were built to carry Russian gas to Germany while bypassing Ukraine.

The firm Katerynchuk, Moor & Partners said it expected to receive the written ruling shortly and was preparing to challenge it in Croatia’s appellate court and before international judicial bodies. Zhuravliov also plans to announce an indefinite hunger strike. His lawyers said the Croatian court had disregarded the earlier Polish decision.

The Warsaw court refused to surrender Zhuravliov in October 2025, finding that the pipelines could be treated as a legitimate military target during an armed conflict. It released him from custody.

His Polish lawyer, Tymoteusz Paprocki, said Zhuravliov understood that the ruling applied only within Poland: under a European arrest warrant, the country where a suspect is arrested decides whether to send them to the country seeking them.

Germany amended the warrant in early September to add a war-crime classification, according to Zhuravliov’s lawyers. The change prompted the Croatian court to postpone an earlier hearing. The lawyers’ account of the amendment has not been independently confirmed.

How the Nord Stream case reached Croatia

Nord Stream 1 and 2 were built to carry Russian gas directly to Germany while bypassing Ukraine. Explosions on 26 September 2022 damaged three of their four lines; Nord Stream 2 had never entered service.

Germany issued a warrant for Zhuravliov in 2024. German prosecutors say he helped place explosives on the pipelines near Denmark’s Bornholm island. He denies involvement. Croatian police arrested him in Pula on 19 August 2026 under the European warrant.

Another Ukrainian suspect, Serhii Kuznietsov, was arrested in Italy in 2025 and later sent to Germany, where prosecutors have charged him over the explosions. He denies involvement. No court has established who ordered the attack.

US intelligence has warned Spain, France, and Italy that Russia may be preparing to launch drones at one of them from merchant ships in the Mediterranean, El Mundo reported on 23 September, citing sources familiar with the alert. Neither the CIA nor the three governments have confirmed it.

Russia has intensified a campaign of sabotage, airspace incursions, and other provocations against European states supporting Ukraine while keeping its actions below the threshold of open conflict with NATO. A maritime drone attack would extend that campaign into southern Europe, turning the Mediterranean into a launch zone for deniable strikes on civilian or military infrastructure.

El Mundo based its account on a source close to Lithuania's Defense Ministry and analysts familiar with a CIA report circulated among European foreign ministries. The reported plan would hide small Russian Gerbera drones inside shipping containers aboard merchant ships and launch them from the Mediterranean.

According to El Mundo, a Gerbera drone can travel up to 600 kilometers depending on payload and wind, potentially putting targets along NATO's southern coast within reach of a ship offshore.

The Gerbera drone's reported 4–5 kilogram explosive payload would be unlikely to destroy a large facility, the newspaper said, but could start a fire, damage exposed equipment, or temporarily close an airport or port.

All three countries hold elections in 2027 and have political forces capable of exploiting fear and fatigue with Ukraine, with connections to Kremlin interests especially visible in France and Italy, El Mundo reported. Keir Giles, a British defense analyst, said frontline states are not necessarily the targets—the target will be wherever Europe's weakest point is, naming the UK and Spain as countries that have not invested in air and missile defense adequate to the Russian threat.

El Mundo placed the warning alongside earlier Russian drone incidents on NATO territory. In September 2025, 19 unarmed drones strayed into Polish airspace. German authorities later attributed an explosive-carrying drone incident at Leipzig airport to Russia.

The war has reached Mediterranean shipping

Russia's oil shipments and naval presence, alongside reported Ukrainian operations, have brought the conflict into the region in several ways.

A source cited by Ukrainian media said Ukraine's Security Service struck a Russian shadow-fleet tanker there in December 2025. Such vessels carry Russian oil outside Western sanctions, making the sea a route for Moscow's war revenue and a target for Kyiv.

The French outlet RFI later reported that Ukraine may have established a drone launch site in Libya for strikes on Russian shipping. Kyiv has not confirmed the reported site.

Russia's military position in the region has also shifted. British intelligence assessed in January 2025 that its Mediterranean naval force lacked access to its Syrian base at Tartus after Bashar al-Assad's fall.