Russia's propaganda center Rybar ran a covert filming operation across multiple European countries, Ukraine's Center for Countering Disinformation (CCD) reported, citing a Czech investigation by Seznam Zprávy. The founder of the project, Mykhailo Zvinchuk, has been under sanctions by the European Union and the UK.

The EU's sanctions justification states that Rybar is a member of a working group established by Vladimir Putin in December 2022 to coordinate Russia's mobilization efforts in connection with the war against Ukraine.

Moscow has recently escalated covert influence operations and disinformation across Europe, yet years of sanctions have not stopped its operatives from working inside the EU. The Rybar case shows how thin the enforcement of those measures remains.

Rybar crew posed as documentarians in Prague

Russians moved freely within the Schengen Area, holding residence permits for EU countries, particularly Germany. They traveled to Prague posing as documentary filmmakers and attempted to record interviews with local experts and politicians. The stated pretext was a documentary series on Europe's sociopolitical situation.

When Seznam Zprávy journalists confronted the film crew at the meeting location, the propagandists fled. The investigation identified Boris Dvorkin as the Moscow-based producer of the operation. One of his projects received funding from the History of the Fatherland Foundation, established by Putin's decree and headed by Sergei Naryshkin, chief of Russia's Foreign Intelligence Service (SVR).

Operations planned across multiple countries

Similar filming operations were allegedly planned or already carried out in Czechia, Slovakia, Austria, Hungary, Serbia, France, and other countries, the CCD said.

The UK sanctioned Rybar and Zvinchuk in December 2025, citing the network's interference in elections in Moldova and Armenia. It added ten more Rybar staff members in July 2026 for their role in destabilizing Ukraine. In 2024, the US State Department offered a $10 million reward for information on Zvinchuk and eight others tied to the project.

Investigators found what they believe is explosives meters from a crashed drone near the Bundeswehr's Wunstorf air base in Lower Saxony, Germany, and the device matches the construction of drones used in the GRU-attributed Leipzig airport attack, Süddeutsche Zeitung, NDR, and WDR reported on 22 September. Germany's federal prosecutor and the Federal Criminal Police Office (BKA) have taken over the investigation, and the same reporting traced one of the Leipzig suspects to a sanctioned GRU colonel who directs sabotage against countries arming Ukraine.

Russia's sabotage campaign against countries supporting Ukraine has escalated from arson packages and recruited proxies to explosives-laden drones targeting military infrastructure inside NATO. Germany's military counterintelligence has attributed repeated sabotage on German soil to Russia, while Finnish President Stubb called the broader alarm about Russian threats an "overreaction"—a position the accumulating evidence from Germany and Poland does not support.

Explosives found days after the drone crash

A farmer discovered the drone, broken into several pieces, on the evening of 14 September, about one kilometer from the Wunstorf air base, Militarnyi reported. Days later, police found a suspicious substance just meters from the crash site. Security sources told SZ, NDR, and WDR they believe it is an explosive, though forensic analysis has not yet been completed.

The drone's design is similar to the devices used in the Leipzig airport attack on 4 August, when attackers tried to destroy Ukrainian cargo planes with explosives-laden drones. At least one component was manufactured using a 3D printer, the reporting found. Investigators believe the drone may have been near the military airfield for a long time—possibly up to two years.

Wunstorf air base houses the Bundeswehr's entire A400M transport fleet. The facility is Germany's central hub for moving troops and materiel worldwide. An explosives-laden drone near this base would represent a direct threat to the Bundeswehr's central global logistics hub.

The Wunstorf find was discussed at the weekly intelligence briefing in the Chancellery on 22 September, the outlets reported.

Leipzig suspect linked to sanctioned GRU colonel

The federal prosecutor's investigation connects the Wunstorf case to the Leipzig attack. In that case, Germany's government has officially blamed Russia. Two suspects were identified: Oleg L., a Latvian with a Russian passport, and Andrei K., a dual Belarusian-Russian citizen whose DNA was found at the Leipzig scene.

SZ, NDR, and WDR reported that Oleg L. maintained years-long contacts with GRU Colonel Denis Smolyaninov. The EU sanctioned Smolyaninov for directing sabotage operations against countries supporting Ukraine. Andrei K. had previously been noticed for minor offenses in the Baltic states and Finland and entered Germany on an Italian tourist visa. Moscow denied involvement in the Leipzig attack.

A drone violated the no-fly zone around NATO's missile shield base in Poland

The Wunstorf case came to light in the same week that a drone violated the no-fly zone around the US-operated Aegis Ashore missile defense base in Redzikowo, northern Poland, on 15 September.

Polish troops guarding the facility called civilian emergency services instead of neutralizing the drone, TVP World reported. Poland's defense ministry said the drone was a civilian device that "posed no threat" and remained under military surveillance, but Defense Minister Władysław Kosiniak-Kamysz ordered a full report into the incident.