Intelligence assessments indicate that Russian plans include drone and missile strikes against countries supporting Ukraine, including Poland, Polish Prime Minister Donald Tusk told parliament on 17 September. He said Russia could seek to make such attacks appear accidental in order to weaken NATO's resolve.

The warning comes after an escalating pattern of drone incidents and suspected sabotage in Poland, Lithuania and Germany, as European governments face growing security risks linked to Russia's war against Ukraine.

Tusk cites NATO, US and Ukrainian intelligence

Tusk said he was relying on intelligence from NATO, Ukraine, and the United States. He described late autumn and winter as the most critical phase of the war so far and warned of escalating attacks on Ukrainian infrastructure.

"There is a real risk that the territory of one or several NATO countries on the eastern flank may be entered by drones or other types of missiles," Tusk said.

He said the purpose could be to show that Article 5 "exists only in theory" and to weaken NATO's willingness to respond.

Jet-powered drones near the Polish border

The 17 September attack struck near Yahodyn, close to the Dorohusk border crossing. Tusk said Russia had used jet-powered drones that travel at higher speeds and altitudes, making them harder to intercept.

A pattern of incidents near NATO territory

The warning follows several incidents near NATO's eastern border. On 13 September, a drone struck a passenger train at Yahodyn, near the Ukraine-Poland border. Ukraine's state railway company said it was "highly probable" that the Russian drone's intended target was a diplomatic train that had carried former British Prime Minister Boris Johnson and former Swedish Prime Minister Carl Bildt. Former CIA Director David Petraeus was on a separate train that remained at the station. No one was injured.

On 15 September, Italian NATO jets shot down a drone in Lithuanian airspace after it apparently entered from Belarus. Lithuanian authorities said the wreckage indicated it had likely been carrying explosives. Poland also recovered a Gerbera-type drone carrying a live warhead from the Baltic coast near Rusinowo.

Germany on 1 September blamed Russia for an attempted drone attack involving explosives at Leipzig/Halle Airport on 4–5 August, adding another NATO country to the series of incidents.

From warning to coalition

Tusk visited Ukraine on 18 September for the inaugural Carpathian Eight summit. Zelenskyy said Ukraine and its European partners were building an anti-ballistic coalition, while Polish Deputy Prime Minister Radosław Sikorski said Warsaw was preparing its largest military aid package for Ukraine, potentially including Patriot missiles.

Russia's Foreign Ministry rejected Tusk's accusations as "contrived" and "far-fetched".

Latvia's State Security Service (VDD) opened a criminal case on 9 September over threats of terrorism against Latvian companies that supply weapons to Ukraine, after a pro-Kremlin group issued the same demand to Latvia, Poland, and Portugal.

The threat comes amid a series of fires and explosions at European sites connected to Ukraine's war effort, at least four at ammunition facilities alone since 10 August. No common cause has been established, and authorities have not publicly linked any of them to Global Citizens Against War 1984.

VDD detained one person in Riga on 10 September, searched their home and vehicle, and seized data storage devices and other items, the service said on 17 September. The suspect has been remanded in custody, and the case runs under part two of article 79.6 of Latvia's criminal law.

The ultimatum and the group behind it

The group, calling itself Global Citizens Against War 1984, published its ultimatum on 8 September, demanding that Latvia, Poland, and Portugal stop supplying weapons and ammunition to Ukraine.

The seven companies are Latvia's Eraser, a military drone maker, and Unitrack, which develops all-terrain vehicle prototypes; Poland's PGZ, WB Electronics, JFG Composites, and Nitro-Chem; and Portugal's Tekever, according to inbox.lv. VDD did not name the companies in its statement.

The group said the companies would face operational shutdown "by any means necessary" if the demands were not met by 7 October. It also circulated photographs of graffiti bearing its abbreviation, which it says was sprayed in Riga, Warsaw, and Lisbon.

The group previously claimed responsibility for planning an arson attack on the Slovak plant of Skyeton, a Ukrainian drone maker. Slovak police announced the detention of three foreign suspects on 25 August. Authorities have not said whether the suspects are connected to the group.

An investigation by The Insider found evidence suggesting Russian origins for the group: Russian-language folder labels on its English-language Instagram account, an Orwell quotation on its website back-translated from a common Russian rendering rather than taken from the original, and a proprietary Yandex font left in the page code. The outlet did not establish which Russian organization, if any, operates the group.

European security services have also reported suspected sabotage targeting defense companies and infrastructure, including a fire at an Estonian military robotics company, fires at a Bulgarian ammunition facility, and an explosion at an ammunition plant in Italy. Authorities have not publicly linked those incidents to Global Citizens Against War 1984.