Latvia's State Security Service (VDD) opened a criminal case on 9 September over threats of terrorism against Latvian companies that supply weapons to Ukraine, after a pro-Kremlin group issued the same demand to Latvia, Poland, and Portugal.

The threat comes amid a series of fires and explosions at European sites connected to Ukraine's war effort, at least four at ammunition facilities alone since 10 August. No common cause has been established, and authorities have not publicly linked any of them to Global Citizens Against War 1984.

VDD detained one person in Riga on 10 September, searched their home and vehicle, and seized data storage devices and other items, the service said on 17 September. The suspect has been remanded in custody, and the case runs under part two of article 79.6 of Latvia's criminal law.

The ultimatum and the group behind it

The group, calling itself Global Citizens Against War 1984, published its ultimatum on 8 September, demanding that Latvia, Poland, and Portugal stop supplying weapons and ammunition to Ukraine.

The seven companies are Latvia's Eraser, a military drone maker, and Unitrack, which develops all-terrain vehicle prototypes; Poland's PGZ, WB Electronics, JFG Composites, and Nitro-Chem; and Portugal's Tekever, according to inbox.lv. VDD did not name the companies in its statement.

The group said the companies would face operational shutdown "by any means necessary" if the demands were not met by 7 October. It also circulated photographs of graffiti bearing its abbreviation, which it says was sprayed in Riga, Warsaw, and Lisbon.

The group previously claimed responsibility for planning an arson attack on the Slovak plant of Skyeton, a Ukrainian drone maker. Slovak police announced the detention of three foreign suspects on 25 August. Authorities have not said whether the suspects are connected to the group.

An investigation by The Insider found evidence suggesting Russian origins for the group: Russian-language folder labels on its English-language Instagram account, an Orwell quotation on its website back-translated from a common Russian rendering rather than taken from the original, and a proprietary Yandex font left in the page code. The outlet did not establish which Russian organization, if any, operates the group.

European security services have also reported suspected sabotage targeting defense companies and infrastructure, including a fire at an Estonian military robotics company, fires at a Bulgarian ammunition facility, and an explosion at an ammunition plant in Italy. Authorities have not publicly linked those incidents to Global Citizens Against War 1984.

Lithuanian troops began military exercises across 12 municipalities in the southern half of the country on 14 September, training to respond to different types of military threats, LRT reported. The exercises will run through 18 September.

NATO's eastern flank has faced growing security pressure from Russia's war against Ukraine. Lithuania borders Russia's Kaliningrad Oblast to the southwest and Belarus to the east, while its territory forms part of the land route connecting the Baltic states with Poland and the rest of NATO.

The exercises involve multiple types of drones, boats, weapons, and wheeled military and civilian transport vehicles, with troops moving on foot and by vehicle during the day and at night. No imitation ammunition or pyrotechnics will be used, the army said.

Recent airspace incidents

Vilnius International Airport was closed on 13 September for 38 minutes after radar detected what was initially feared to be a drone. An Italian air force detachment based at Šiauliai as part of NATO's Baltic Air Defense mission scrambled a fighter jet, which identified the contact as a flock of birds.

Vilmantas Vitkauskas, head of Lithuania's National Crisis Management Center, told LRT radio that a large concentration of birds moving in one direction can register on radar as a drone-like object.

Separately, Poland said on 14 September that its military had found a suspected Russian military drone near its Baltic Sea coast. Polish Defense Minister Władysław Kosiniak-Kamysz said a preliminary inspection indicated it was a Russian military drone.

Operational Command spokesman Jacek Goryszewski told TVN24 it was most probably a Russian Gerbera, a cheap long-range drone built from plywood and foam that is often used as a decoy but can carry explosives, and said it had drifted to shore under military observation, with no violation of Polish airspace recorded since late July.

Multinational drills near Belarus

Another multinational exercise, Strong Griffin 2026, is also underway in Lithuania's Švenčionys district near the Belarusian border. Running from 2 to 20 September, it involves about 2,500 troops and 500 pieces of equipment from Lithuania, the United States, Poland, the Netherlands, France, and Portugal, plus partner countries Ukraine and Moldova, according to LRT. Drone work is integrated across it, from reconnaissance to long-range strikes and countering enemy drones.

European intelligence services expect the danger to grow rather than fade. Dutch military intelligence assesses that Russia could mount a regional conflict against NATO within a year of the fighting in Ukraine ending, and reports that preparations for sabotage across Europe have been rising again since mid-2025.