French President Emmanuel Macron said French services received no CIA warning about a possible Russian drone attack from Mediterranean merchant ships, pushing back on an El Mundo report that US intelligence had alerted France, Italy, and Spain, RTL reported.

Macron’s denial comes amid drone attacks and sabotage cases that European governments have linked to Russia. France is preparing stronger defenses against that wider threat, even as Macron says its services received no specific CIA warning. Italy’s defense minister has also cautioned against fueling alarm over an unconfirmed report.

Asked about the report during a televised interview on 24 September, Macron said: “The CIA did not inform French services of such an attack.” He said Russia was multiplying hostile and sometimes criminal acts against European countries. Covert acts such as sabotage and cyberattacks are often described as hybrid warfare. Asked whether France itself could be attacked, Macron answered yes.

Italian Defense Minister Guido Crosetto separately wrote on X that El Mundo’s alert “finds no confirmation.” He said it served no one to add “more fuel to the fire” at an already tense time.

The Spanish newspaper reported that the possible operation would use Gerbera drones, small Russian aircraft capable of carrying several kilograms of explosives. The drones would be hidden in shipping containers aboard merchant ships and launched toward targets along Europe’s southern coast. El Mundo cited a source close to Lithuania’s Defense Ministry, and analysts familiar with a CIA report said to have circulated among European foreign ministries. Euromaidan Press covered the account on 24 September. Bythe time of publication, neither Spain’s government nor the CIA had publicly addressed it.

Macron pointed to the failed attack at Leipzig/Halle Airport in eastern Germany in August. A drone carrying explosives was found near a Ukrainian cargo aircraft. German officials attributed the attempt to Russia. Macron said France had not experienced a comparable incident.

The wider hybrid warfare threat

Beyond the disputed Mediterranean alert, authorities have investigated other incidents throughout Europe as possible Russian sabotage.

Germany followed its accusation over Leipzig with diplomatic measures against Moscow. Berlin ordered Russia’s last consulate in Germany closed and ended an agreement permitting a Russian cultural center. German investigators also identified two suspects, including a Russian man they linked to military intelligence. Moscow denied involvement.

Poland’s justice and interior ministers said Russian intelligence ordered the May 2024 arson of Warsaw’s Marywilska 44 shopping center.

Finnish President Alexander Stubb said Russia would continue such attacks to frighten Ukraine’s allies into reducing support. He urged vigilance without overreacting, saying Finnish intelligence saw no imminent military threat.

Ukrainian drone makers are getting another shot at a Pentagon contract, this time for bomber drones. Seventeen companies, including Ukrainian firms and Western partners fielding Ukrainian designs, will test bomber drones at Camp Grayling in Michigan in October, the next stage of the Pentagon's Drone Dominance program, Defender Media reported.

The Phase 2.5 Bomber Qualifier is the latest round of the Pentagon's drive to buy combat-tested drones at scale, and Ukrainian makers are again in the field, some through US-registered partners, because Pentagon rules bar direct sales from foreign firms.

This time, the target is bombers, the drones that drop munitions on what is below them.

Seventeen makers head to Michigan

The contest runs at Camp Grayling, a Michigan training range, and organizers call it the hardest and fastest-paced stage of the program yet. Each company must bring at least six fully built systems.

The testing splits into two parts: a Bomber Qualifier, which the makers conduct themselves, and a Bomber Gauntlet run by US soldiers. Organizers have not published details of a third mission. Winners of the wider program earn Pentagon supply contracts.

Ukrainian bombers make the list

The invited firms include UFORCE USA Services, Grim Tech, Gurzuf Defence, UA Defense Tech, Skycutter, and UDD Tech Corp. Which models they will bring is not yet clear.

UFORCE is known for its Nemesis bombers. Grim Tech showed a light bomber, the Grim-18, at the MSPO defense expo in Poland this month, and Gurzuf builds heavy bombers, including the Ayudag-6, which recently set a Ukrainian payload record for multirotor drones at 130 kilograms.

A second try after a US sweep

In the program's last phase, the Pentagon picked five winners in each of two categories, and all were American, though a Ukrainian firm had reached the second round and, by industry accounts, Ukrainian designs were incorporated into some Western entries. For Ukraine's makers, the bomber round is another chance to turn battlefield-proven hardware into a US contract.

France delivered additional MICA air-to-air missiles and 30mm cannon ammunition for Ukraine's Mirage 2000 fighter jets, Militarnyi reported, citing France's Armed Forces Ministry.

Delivering an aircraft is one step, keeping it armed is another. France's weapons resupply reflects a shift from one-off hardware transfers to sustained combat support as Russia's aerial campaign against Ukrainian cities grinds on.

What MICA does

The MICA, developed by MBDA, comes in two versions: radar-guided (MICA RF) and infrared (MICA IR). It weighs about 112 kg, flies at Mach 4.9—nearly five times the speed of sound—and can engage targets 60 to 80 km away.

Ukraine's Mirages have also carried older Magic 2 missiles limited to roughly 20 km. MICAs were reportedly included with the original donation, but the supply may have been limited, which would explain why the Magic 2s stayed in use. MICA triples to quadruples that engagement window, letting pilots intercept cruise missiles far earlier in their flight path. The fresh delivery keeps Ukraine's small fleet supplied with the missiles that make these longer-range interceptions possible.

Explore further

Ukraine is running short of its best missiles for hunting Russia’s jet drones. Now MiG-29s are firing 1970s weapons

Cheap shells for cheap drones

The 30mm ammunition feeds the Mirage's two built-in DEFA 554 cannons, which fire at a selectable rate of 1,200 or 1,800 rounds per minute. A pilot who uses the gun on a Shahed drone saves a MICA for a target that actually needs one.

Ukraine's F-16 operations follow a similar logic: pilots use their 20mm Vulcan cannons alongside AIM-9 and AIM-120 missiles, though Zelenskyy called the missile option expensive—used when nothing else can reach a jet drone, because "a human life is more important."

A Ukrainian Mirage 2000 shot down a Russian Kh-101 cruise missile during its very first combat mission, on 7 March 2025. France has delivered about a dozen modified Mirage 2000-5F jets since February 2025, and the fleet is still growing.

Several recent incidents across Europe were conducted by Russia or are likely attributable to Russia, ISW assessed in its 24 September report, though authorities have not officially linked the Polish and German incidents to Moscow.

Russia's full-scale war against Ukraine has expanded into a parallel campaign of provocations against European defense and logistical infrastructure. The Kremlin is using drones, arson, and undersea cable sabotage to degrade Europe's will and ability to support Ukraine, while deliberately intensifying the frequency of airspace violations to erode the boundary between hybrid and kinetic war.

Drones over Moldova and Romania

Four Russian drones flew over Bukovyna and targeted an energy facility and border crossings with Moldova and Romania, Chernivtsi Oblast Military Administration head Ruslan Osypenko reported. Ukrainian forces shot down three. The fourth flew toward Suceava County in northeastern Romania.

A drone crashed in Cernița, Florești district, Moldova—preliminarily identified as a Russian Gerbera type, the first such device found in the country. It carried an onboard camera, hit a tree, and exploded, Moldovan police said. Romania's Defense Ministry reported a second aerial vehicle entered Romanian airspace for four minutes and crashed near Solca in the same border region; geolocated footage confirmed it was also a Gerbera, ISW noted. Poland evacuated the Hrubieszów and Dorohusk border crossings for 30 minutes, Prime Minister Donald Tusk said. Three countries were put on alert by a single night of Russian strikes.

"Intentional and accidental Russian drone incursions into NATO and Moldovan airspaces are likely part of the Kremlin's efforts to normalize airspace violations by intensifying their frequency," ISW assessed.

Sabotage in Poland and Germany

A fire engulfed the power system and backup generator at a Starlink ground station in Wola Krobowska, central Poland, on the evening of 23 September. Deputy Prime Minister Krzysztof Gawkowski confirmed it was sabotage aimed at cutting internet access, including for Ukraine's military. Authorities have not identified who was responsible, but the act aligns with Russia's "new" doctrine of attacks, Gawkowski said. The station is now operating normally.

German authorities suspended operations at Berlin-Brandenburg airport for 45 minutes the same evening after staff reported a drone sighting, Die Zeit reported. Federal police could not confirm it. ISW assessed both incidents fit Russia's wider pattern of sabotage against European defense assets, though neither has been officially attributed to Russia.

Explore further

Russian attack puts three countries on alert as drones enter Moldova and Romania

Western intelligence warnings

A Lithuanian Defense Ministry source reported on 23 September that Russia could launch Gerbera drones from a shipping container in the Mediterranean against Spain, France, and Italy. Danish Defense Intelligence assessed on 24 September that Russia will intensify its hybrid war in coming months, including destructive cyber attacks and sabotage carrying a high risk of casualties, and that there is a low but growing risk of a limited Russian military attack on a NATO border state. It sees no indications of an outright invasion. The CIA reportedly warned Poland that Russia may sabotage underwater cables to disrupt its banking system, according to Newsweek Polska journalists.

NATO tracked and confronted Russian submersibles rehearsing deployment of a new cable-disabling weapon near Svalbard in spring 2026—no cables were damaged, but the operation demonstrated Moscow's intent, Reuters reported. Shadow fleet vessels likely served as drone-launch platforms for incursions into NATO airspace, ISW noted.

"The increasing frequency of such warnings suggests that Western intelligence agencies are picking up indicators that the Kremlin is looking to diversify its platforms and means for conducting attacks against NATO and European states and is considering conducting such attacks," ISW assessed.

ISW said it has not yet seen evidence that Russia has conducted the attacks the warnings describe.

Denmark's assessment—that a limited Russian military strike on a NATO border state could come in the coming months—suggests the boundary between hybrid provocations and military action is narrower than European policy has assumed. ISW's synthesis reframes what governments have treated as separate incidents into one campaign.

"Intentional and accidental Russian drone incursions into NATO and Moldovan airspaces are likely part of the Kremlin's efforts to normalize airspace violations by intensifying their frequency," ISW assessed.

"The increasing frequency of such warnings suggests that Western intelligence agencies are picking up indicators that the Kremlin is looking to diversify its platforms and means for conducting attacks against NATO and European states and is considering conducting such attacks," ISW assessed.