Several recent incidents across Europe were conducted by Russia or are likely attributable to Russia, ISW assessed in its 24 September report, though authorities have not officially linked the Polish and German incidents to Moscow.

Russia's full-scale war against Ukraine has expanded into a parallel campaign of provocations against European defense and logistical infrastructure. The Kremlin is using drones, arson, and undersea cable sabotage to degrade Europe's will and ability to support Ukraine, while deliberately intensifying the frequency of airspace violations to erode the boundary between hybrid and kinetic war.

Drones over Moldova and Romania

Four Russian drones flew over Bukovyna and targeted an energy facility and border crossings with Moldova and Romania, Chernivtsi Oblast Military Administration head Ruslan Osypenko reported. Ukrainian forces shot down three. The fourth flew toward Suceava County in northeastern Romania.

A drone crashed in Cernița, Florești district, Moldova—preliminarily identified as a Russian Gerbera type, the first such device found in the country. It carried an onboard camera, hit a tree, and exploded, Moldovan police said. Romania's Defense Ministry reported a second aerial vehicle entered Romanian airspace for four minutes and crashed near Solca in the same border region; geolocated footage confirmed it was also a Gerbera, ISW noted. Poland evacuated the Hrubieszów and Dorohusk border crossings for 30 minutes, Prime Minister Donald Tusk said. Three countries were put on alert by a single night of Russian strikes.

"Intentional and accidental Russian drone incursions into NATO and Moldovan airspaces are likely part of the Kremlin's efforts to normalize airspace violations by intensifying their frequency," ISW assessed.

Sabotage in Poland and Germany

A fire engulfed the power system and backup generator at a Starlink ground station in Wola Krobowska, central Poland, on the evening of 23 September. Deputy Prime Minister Krzysztof Gawkowski confirmed it was sabotage aimed at cutting internet access, including for Ukraine's military. Authorities have not identified who was responsible, but the act aligns with Russia's "new" doctrine of attacks, Gawkowski said. The station is now operating normally.

German authorities suspended operations at Berlin-Brandenburg airport for 45 minutes the same evening after staff reported a drone sighting, Die Zeit reported. Federal police could not confirm it. ISW assessed both incidents fit Russia's wider pattern of sabotage against European defense assets, though neither has been officially attributed to Russia.

Explore further

Russian attack puts three countries on alert as drones enter Moldova and Romania

Western intelligence warnings

A Lithuanian Defense Ministry source reported on 23 September that Russia could launch Gerbera drones from a shipping container in the Mediterranean against Spain, France, and Italy. Danish Defense Intelligence assessed on 24 September that Russia will intensify its hybrid war in coming months, including destructive cyber attacks and sabotage carrying a high risk of casualties, and that there is a low but growing risk of a limited Russian military attack on a NATO border state. It sees no indications of an outright invasion. The CIA reportedly warned Poland that Russia may sabotage underwater cables to disrupt its banking system, according to Newsweek Polska journalists.

NATO tracked and confronted Russian submersibles rehearsing deployment of a new cable-disabling weapon near Svalbard in spring 2026—no cables were damaged, but the operation demonstrated Moscow's intent, Reuters reported. Shadow fleet vessels likely served as drone-launch platforms for incursions into NATO airspace, ISW noted.

"The increasing frequency of such warnings suggests that Western intelligence agencies are picking up indicators that the Kremlin is looking to diversify its platforms and means for conducting attacks against NATO and European states and is considering conducting such attacks," ISW assessed.

ISW said it has not yet seen evidence that Russia has conducted the attacks the warnings describe.

Denmark's assessment—that a limited Russian military strike on a NATO border state could come in the coming months—suggests the boundary between hybrid provocations and military action is narrower than European policy has assumed. ISW's synthesis reframes what governments have treated as separate incidents into one campaign.

"Intentional and accidental Russian drone incursions into NATO and Moldovan airspaces are likely part of the Kremlin's efforts to normalize airspace violations by intensifying their frequency," ISW assessed.

"The increasing frequency of such warnings suggests that Western intelligence agencies are picking up indicators that the Kremlin is looking to diversify its platforms and means for conducting attacks against NATO and European states and is considering conducting such attacks," ISW assessed.

Russia has made Germany a priority espionage target, and the threat from cheap, deniable sabotage carried out by civilians paid for one-off jobs is rising, Germany's Military Counterintelligence Service (MAD) said in its 2025 annual report—the first published under a new law obliging annual disclosure. MAD blamed Germany's geostrategic position in Europe and NATO, the expansion of the Bundeswehr, and the introduction of new weapons systems. Repeated sabotage cases on German soil last year were "with high probability" Russian-run, MAD said.

For two years Berlin has publicly warned about a Kremlin campaign of arson, surveillance, and drone incursions run through cheap local proxies—mostly at press briefings and closed sessions. A January 2026 transparency law now forces that warning onto the statutory public record, sharpening the burden of an operational answer. Germany hosts NATO's logistics spine for arming Ukraine—the very hub Moscow's proxies keep aiming at.

Sabotage on the cheap

"Hybrid attacks have increased in Germany," MAD said.

The threat from "low-level agents"—residents paid small sums to plant fires or photograph military sites—has significantly increased. Recent incidents match the model: a bomb-laden drone found in August beside a Ukrainian cargo aircraft at Leipzig/Halle airport was traced this month to a Russian intelligence operative and a Belarusian petty criminal, and two Bulgarian nationals were arrested over a September suspected arson near defense-electronics firm Rohde & Schwarz in Munich. Russia's Legalresidenturen — intelligence outposts inside embassies, semi-state bodies, and press agencies—remain a central instrument of Moscow's information-gathering.

Explore further

A masked figure got into a Polish drone-parts plant—Poland now suspects a foreign spy service set the fire

Chinese drones over bases, blackmail risk for soldiers

Some drone overflights and unauthorized entries at Bundeswehr sites are attributable to Chinese intelligence, MAD said, which is also drawing on parts of the Chinese diaspora in Germany.

The service flagged travel by German soldiers to Russia and Belarus: personnel with family ties there kept visiting despite the security climate, drawing the attention of Russian and Belarusian intelligence services and creating particular exposure to blackmail and threats.

NATO fighter jets shot down a drone over Lithuania shortly after midnight on 15 September, the first time alliance aircraft have destroyed one over that country, LRT reported. The aircraft crossed in from Belarus and came down near a village in the center of the country, where military police sealed the site. Its type and operator have not been established.

What happened over Lithuania

Lithuania's National Crisis Management Center issued a yellow air alert after midnight, first for the capital and the districts around it, then for the Kaunas region further west. Italian Air Force Eurofighter Typhoons flying NATO's Baltic air policing mission from Šiauliai Air Base destroyed the drone with missile armament, Lithuania's Defense Ministry confirmed, and the army published the first images from the crash site.

The drone was over Lithuanian territory for about half an hour, crisis center head Vilmantas Vitkauskas told LRT radio. He said there is a high probability it carried an explosive charge, though the wreckage does not yet show whether it was a combat drone. Lithuania chose a yellow alert rather than red because red is used when a strike or a fall is unavoidable, he explained, and the drone was destroyed within seconds of the air defense crews reacting, over farmland with no homes nearby.

Military and civilian police are working at the site under the Shield security plan, and the area has been fenced off and guarded. President Gitanas Nausėda thanked the allied personnel for their swift response, saying that with Russia intensifying its aggression against Ukraine such readiness is vital for the region.

Whose drone it was

Nothing has been established beyond the direction it came from. The army has not commented on the drone's possible origin while the wreckage is still being collected, and the launch point also remains unreleased. Vilnius airport suspended operations during the alert, and flights from Türkiye and Iceland were delayed.

The same night as this incursion, Poland scrambled fighter jets and raised air defense readiness over Russian drone strikes on western Ukraine, and Romania did the same, with neither country recording a violation of its airspace. The day before, the Polish military recovered a drone from the Baltic Sea that its defense minister said preliminary inspection indicated was Russian and military.