German industry expects Russian sabotage against the country’s companies to persist and take more forms, the deputy head of the Federation of German Industries (BDI) told Handelsblatt. His warning follows alarms from Germany’s intelligence services, which describe the country as a main target of Russia’s covert campaign in Europe.

Russia keeps striking Ukrainian cities and power plants every day while trying to weaken the European support that keeps Ukraine fighting. Germany is home to arms makers producing with and for Ukraine, so pressure on its companies targets the supply behind Ukraine’s defense.

Industry expects attacks to last and change form

The warning came from Holger Lösch, the BDI’s deputy managing director.

“German industry is preparing for the threat to persist and for attack methods to become more varied,” he told Handelsblatt. “Companies don’t end up in the crosshairs by chance,” he added.

Russian influence and sabotage operations are no longer an abstract scenario, and companies, critical infrastructure, and defense supply chains are already among their targets, Lösch said. Companies now receive more threat warnings, and their cooperation with the authorities has improved significantly, he noted. “What is still missing are joint procedures to quickly derive concrete measures from warnings,” Lösch said, calling the protection of the economy a cornerstone of national security.

German intelligence describes a Russian shadow war

The warning comes a week after a public hearing of the intelligence oversight panel of the Bundestag, Germany’s parliament, on 5 October. There, Martin Jäger, head of Germany’s Federal Intelligence Service (BND), said Russia was waging a shadow war against Germany. “Germany has become a main obstacle to Russian hegemonic power projection in Europe and thus a target of Russian action,” Jäger said. “The danger of attacks against targets in Germany remains real and present,” he warned.

Sinan Selen, head of the Federal Office for the Protection of the Constitution (BfV), Germany’s domestic intelligence agency, told the same hearing that Russia was showing a readiness for sabotage and killings.

German Chancellor Friedrich Merz said on 1 October that Germany was preparing for further hybrid attacks, “including serious ones,” and would respond “quickly and very clearly,” as it did after the drone attack at Leipzig airport.

Drone bombs, arson, and paid saboteurs on German soil

In August, a drone carrying Semtex explosives hit the wing of a Ukrainian An-124 cargo plane at Leipzig/Halle Airport but did not explode. Germany blamed Russia on 1 September, and German Foreign Minister Johann Wadephul said Germany was not at war with Russia but was a “target of war.”

German authorities suspect Russian intelligence of commissioning an arson attack near two Munich defense firms, and a confidential Federal Criminal Police Office (BKA) assessment counted more than 165 suspected sabotage cases in Germany between January and August. The same assessment recorded 747 suspicious drone incidents involving 1,068 drones over critical infrastructure, military sites, and defense companies.

Explore further

The throwaway agents Moscow sent after a Bavarian drone boss arming Ukraine—and how Germany stopped them

Germany’s Military Counterintelligence Service (MAD) warns that the threat from low-level agents, locals paid small sums for one-off jobs such as arson or photographing military sites, has increased significantly. European intelligence agencies also report that Russia is increasingly targeting defense company executives, including at smaller drone makers, and the BfV has advised some German firms to hire close protection.

As long as Germany keeps backing Ukraine, Russian pressure on its companies is unlikely to ease, and the gap between warnings and action that industry flagged leaves smaller firms, with fewer resources for security, the most exposed.

NATO's Military Committee, the Alliance's highest military body, visited Kyiv on 6 October to reaffirm support for Ukraine, its chair, Admiral Giuseppe Cavo Dragone, said. It was the committee's first official visit to Ukraine's capital in eight years. The officers came to hear how Ukraine is fighting Russia and to draw lessons for NATO's own defense, and Dragone used the visit to warn Moscow.

Russia's war no longer stays inside Ukraine: its drones, saboteurs, and pressure campaigns increasingly reach NATO members. That turns Ukraine, the only European army facing Russia in combat, from a country the Alliance helps into one it learns from.

All 32 allies at the table

Dragone brought the military representatives of all 32 member states to hear the latest battlefield assessment directly from Ukraine's commander-in-chief, Mykhailo Drapatyi, and his staff. They also came to learn what more NATO can do to support Ukraine, he said in an address recorded in Kyiv.

"After eight years, the NATO Military Committee comes back to Kyiv for an official visit. But while we were not physically present here, Ukraine is in our thoughts, in our discussions, in our decisions and following action every single day," Dragone said.

The visit fulfilled a promise he made to Drapatyi during their last conversation in August, the admiral said. It also follows a June visit to Kyiv by the North Atlantic Council, NATO's main political decision-making body. "We are here in full strength with a clear message. The bond between NATO and Ukraine is stronger and stronger," he said.

Lessons from Ukraine's commanders

The talks with Drapatyi focused on Ukraine's military priorities and lessons learned to strengthen Allied preparedness for current and future threats, Dragone wrote on X. The delegation also paid respects at the Wall of Remembrance of the Fallen for Ukraine in Kyiv.

Explore further

14 dead in Pryluky, two each in Kyiv, Kremenchuk, and Oleksandriia: Russia’s night of 70 missiles

In his address, Dragone said Ukraine's courageous and resilient spirit remains unbreakable and serves as an example to other nations.

"An example that combines with all the lessons we can learn from your commanders, from their experience, which will ultimately help our Alliance too to better face today's and tomorrow's threats," he said.

To Russia: "You are failing"

Dragone also addressed Russia directly. NATO stands unwavering with Ukraine in the face of Russia's continued aggression and its reckless hybrid activities in member countries, he said.

"To those who think that by perpetrating acts of sabotage, cyberattacks, and violation of the airspace in national NATO territory they will undermine this support and our resolve, I will respond: You are failing. NATO support for Ukraine continues to grow, and our unity is stronger than ever."

Russia bears full responsibility for such dangerous and unacceptable behavior, and allies will keep sharpening their tools and strengthening deterrence and defense, the admiral added.

Drapatyi became Ukraine's commander-in-chief in July, when President Volodymyr Zelenskyy replaced Oleksandr Syrskyi after a week of political turmoil.

Kyiv under fire, Russian troops pushed back near Lyman

The day after the visit, Russia struck Kyiv and 12 oblasts with about 70 missiles. In recent weeks, Russian attacks have cratered the capital's bridges and hit a school, a café, and warehouses, as well as a maternity hospital. Ukrainian troops also retook ground near Lyman in the Vivaldi counteroffensive.

Armed escorts in masks pushed a group of migrants from Belarus toward Latvia and threatened Latvian soldiers, and hours later masked people crossed into Latvia and stole border surveillance cameras, Latvian Interior Minister Jānis Dombrava said on 6 October. Latvia's military described the incident as part of a continuing hybrid campaign on the border, and Ukraine's foreign minister blamed Moscow.

Russia keeps probing the EU's eastern defenses with migrants pushed from its own soil and through its ally Belarus, alongside drone incursions and sabotage that ISW has linked into one Russian pattern across Europe.

Armed escorts threatened Latvian soldiers

Latvian soldiers stopped at least 20 migrants trying to cross the border illegally from Belarus, the Latvian National Armed Forces said. Masked escorts led the group, and this time they were armed, threatened the soldiers, and urged and drove the migrants toward Latvia, the military said.

"Unlike many previous incidents, this time the provocation was particularly demonstrative and aggressive," Dombrava said.

The incident confirms that deliberate provocations and hybrid threats on the border will continue, the armed forces said. Illegal migration is being used as a tool to pressure Latvia's border and, with it, the external border of the EU and NATO, they added.

Belarus began funneling migrants toward the EU in 2021, a campaign Poland's government called a hybrid attack in which the migrants end up as weapons. In 2023, Finland closed its border crossings with Russia, accusing Moscow of the same tactic, and by mid-July Latvia had logged 111 straight days of migrants pushed across from Belarus.

Masked people stole the cameras

Several hours after the standoff, people in masks entered Latvian territory, damaged a distribution cabinet, and stole surveillance cameras, Dombrava said. They returned to Belarus before the border guard patrol could arrive.

"Belarus should understand that such incidents could lead to more serious consequences for Belarus itself," he said.

Ukrainian Foreign Minister Andrii Sybiha said Ukraine stands in full solidarity with Latvia. "Make no mistake: Moscow is behind it," he wrote, adding that Russian President Vladimir Putin "deliberately weaponizes migration, with the help of Lukashenka, to destabilise Europe."

Tunnels, tear gas, and damaged cameras on the border

Latvia's border guards stopped 11,384 attempts to cross illegally from Belarus between the start of 2026 and 24 September. In January, Latvia's armed forces and border guard published evidence that Belarusian security agencies were organizing illegal migration across the border. Latvia has also recorded deliberate damage to cables, distribution cabinets, and camera poles on its eastern border, aimed at slowing the rollout of an automated border control system.

Explore further

Stop arming Ukraine or we shut down your defense firms, pro-Kremlin group tells Latvia, Poland, and Portugal

On 22 July, Latvian soldiers fired warning shots and used tear gas against migrants trying to cross. The next day, Prime Minister Andris Kulbergs said Russia and Belarus were stepping up their hybrid war against the Baltic States to distract from Russia's failures in Ukraine. Latvia temporarily halted crossings on the Belarus border on 31 July. In August, Latvian guards found the first tunnel dug from Belarus and turned back 15 migrants who used it.

Germany is expanding drone detection at its airports with a new system operated by German air traffic control provider Deutsche Flugsicherung (DFS), the German Federal Ministry for Transport (BMV) announced on 5 October.

Germany has accused Russia of attempting a hybrid attack at Germany’s Leipzig/Halle Airport near a Ukrainian An-124 aircraft using a drone carrying explosives. Earlier, Finnish President Alexander Stubb said Europe must be prepared for “continued hybrid and sabotage attacks” by Russia, adding that Russia seeks to sow panic through such actions.

On Monday, two more sites were added—Stuttgart and Hamburg. As of Monday, seven of Germany’s eight largest airports were equipped with the new drone detection system in their approach and departure areas.

Germany seeks responses to new hybrid threats

The Federal Ministry cited the reason for the new measure: drones near airports can affect air traffic very quickly.

Federal Transport Minister Steffen Bilger and Baden-Württemberg Transport Minister Nicole Razavi were briefed on the new system at Stuttgart Airport, where it is being put into operation, the ministry said. The system creates “an important technical basis for detecting potential threats at an early stage and quickly informing the competent authorities,” Bilger said.

“With today’s commissioning of the drone detection system at Stuttgart Airport, the federal government is fulfilling a key promise: it is not only talking about the dangers posed by unmanned aircraft, but is also following through with very concrete action. Protecting critical infrastructure and ensuring the safety of passengers at Stuttgart Airport require continuous adaptation to a changing security situation,” Razavi said, according to the ministry.

The new DFS system allows drones near airports to be detected at an early stage and information about possible threats to air traffic to be passed more quickly to the relevant authorities. This helps them assess risks and respond to them more quickly, the statement said.

DFS is responsible for detecting drones in approach and departure areas, while the Federal Police and other security services are responsible for preventing threats and defending against drones. The BMV, Federal Ministry of the Interior, DFS, Federal Police and airports coordinate their work to exchange information quickly and maintain a shared picture of the situation.

No further details about how the system operates have been disclosed.

The first stage of the expansion at Germany’s eight major commercial airports will be fully implemented this week, with the systems in Stuttgart and Hamburg being put into operation, the statement said.

Explore further

A drone came down beside a Bundeswehr air base, weeks after Berlin blamed Moscow for the Leipzig airport attack

The system will also be installed at the airport where a bomb-laden drone was found

The system will also be put into operation at Leipzig/Halle Airport this week, meaning that the first stage will be fully implemented at all eight of Germany’s largest commercial airports, according to the press release.

A quadcopter drone carrying a Semtex explosive flew directly toward a parked Ukrainian An-124 Ruslan cargo aircraft and struck its wing at Leipzig/Halle Airport in Germany on the evening of 4 August, Die Zeit reported on 10 August. The drone hit the aircraft at around 19:30 local time, bounced off the wing, and fell to the ground without detonating, according to the media outlet.

Germany has accused Russia of attempting the drone attack and announced further sanctions against Russian citizens and institutions, Tagesschau reported on 1 September.

At the crime scene, investigators found the drone configuration, explosives and detonation technology that had already appeared in other Russian hybrid operations and in Russia’s war against Ukraine, Federal Interior Minister Alexander Dobrindt said during a joint press conference with Federal Foreign Minister Johann Wadephul, the media outlet reported.

The German government assumes that Germany has been and will be a target of further such Russian attacks. Germany is not at war with Russia but is a “target of war,” Foreign Minister Wadephul said, according to the outlet.

Russia is preparing to make daily life in Kyiv harder before winter, aiming at the ordinary places civilians use rather than at military sites, The Economist reported. Ukrainian officials say the push blends bombing, sabotage, and disinformation, and expect it to peak in November.

Every winter of its full-scale invasion, Russia has tried to freeze Ukrainians into surrender, and each year the strikes reach deeper into ordinary life. The civilian casualties recorded in 2026 have already passed the whole of last year, the UN says.

From the power grid to the grocery store

Russia has already turned its drones on Kyiv's supermarkets, food warehouses, and data centers this year. On 28 September, a Russian jet drone struck the National Academy of Sciences in central Kyiv. The strike killed two people, the Academy said. Survivors climbed from the windows of the burning building. A senior Ukrainian official told The Economist the Kremlin now wants shoppers too afraid to enter a store. Russia is also keeping its winter routine, hitting electricity, water, and sewage systems.

Cheaper jet drones that stream live to their pilots

Most of the damage now comes from Russia's cheap jet drones, The Economist said. Pilots guide them onto targets and watch a live video feed. They are hard to stop, and Russia's ballistic missiles are deadlier still as Ukraine's supply of Patriot interceptors dwindles. Ukrainian President Volodymyr Zelenskyy said Kyiv had agreed a new Patriot interceptor package, but it remains short of interceptors of its own. A security official told The Economist that Russia has thousands of drones stockpiled and plans to use its entire ballistic missile stock within two months.

Explore further

War is costing Ukraine $155 billion per year. With Western aid running late, Kyiv is freezing everything but army, pensions, and public wages

Sabotage, chaos, and a city that won't switch off

Ukraine's counter-intelligence services say they foil seven or eight Russian plots a week, and officials believe some sleeper cells remain. The campaign's third element, disinformation, targets war fatigue and corruption scandals. Russia runs the same plan every year, hoping its bot farms will push Ukrainians onto the streets to demand surrender, said Andrii Kovalenko, who heads the Center for Countering Disinformation at the National Security and Defense Council.

"It's nonsense," he told The Economist, adding that someone is feeding the idea to Putin so they can steal more money.

Kyiv is also far harder to shut down than Moscow assumes, Kovalenko said. The city's internet is too decentralized for a handful of strikes to knock out, The Economist noted. Energy expert Olha Babii said the test is how fast crews restore power, not whether it can be destroyed. The capital is emptying, its population down from about 3.7 million to 3.3 million by The Economist's count.

Estonia says Russia ordered the August arson attack on Milrem Robotics’ Tallinn premises, an Estonian defense company supplying Ukraine with military ground robots.

Russian sabotage operations have been expanding across Europe in recent months, targeting companies, infrastructure and supply chains connected to Ukraine’s defense effort. European authorities have linked or investigated suspected Russian involvement in arson and other sabotage attempts in several countries, as Moscow seeks to disrupt support for Ukraine and intimidate its European backers.

Foreign Minister Margus Tsahkna said on 29 September that information gathered by Estonia’s Internal Security Service showed the fire at Milrem’s Tallinn premises on the night of 14–15 August was a Russian intelligence-directed sabotage operation. Estonia summoned Russia’s chargé d’affaires over the attack.

Three suspects detained

Estonian authorities had already detained three suspects in connection with the arson, with the suspects apprehended in Latvia. Tsahkna said the perpetrators had been taken into custody and no longer posed a threat to Estonia.

When the investigation was first announced in August, Estonian authorities had not publicly established a Russian connection or disclosed evidence linking Moscow to the fire.

Milrem supplies robots to Ukraine

Milrem Robotics makes THeMIS unmanned ground vehicles, which have been used by Ukrainian forces since 2022 for tasks including transporting ammunition, food and other supplies, evacuating wounded troops, and mine clearance.

The company said in August that the fire had not disrupted its production or deliveries to Ukraine. More than 200 of its robotic systems are expected to be operating in Ukraine by the end of 2026, including more than 150 vehicles funded by the Netherlands.

The attack is part of a growing series of suspected sabotage operations targeting companies and facilities connected to Ukraine’s defense effort. In August, Slovak authorities foiled an attempted arson attack on a Ukrainian drone factory, while European investigations have also examined suspected Russian involvement in attacks on defense-related facilities in Czechia, Lithuania and Bulgaria.

Estonia says sabotage will not weaken Ukraine support

Tsahkna said Russia’s campaign is intended to intimidate European countries, divide allies and weaken their support for Ukraine.

“Russia’s sabotage campaign will not achieve its objectives,” the Estonian Foreign Ministry said, adding that Estonia and its allies would continue increasing pressure on Russia and supporting Ukraine.

Tsahkna said Estonia would respond to the attack by increasing both its support for Ukraine and pressure on Russia.

Several recent incidents across Europe were conducted by Russia or are likely attributable to Russia, ISW assessed in its 24 September report, though authorities have not officially linked the Polish and German incidents to Moscow.

Russia's full-scale war against Ukraine has expanded into a parallel campaign of provocations against European defense and logistical infrastructure. The Kremlin is using drones, arson, and undersea cable sabotage to degrade Europe's will and ability to support Ukraine, while deliberately intensifying the frequency of airspace violations to erode the boundary between hybrid and kinetic war.

Drones over Moldova and Romania

Four Russian drones flew over Bukovyna and targeted an energy facility and border crossings with Moldova and Romania, Chernivtsi Oblast Military Administration head Ruslan Osypenko reported. Ukrainian forces shot down three. The fourth flew toward Suceava County in northeastern Romania.

A drone crashed in Cernița, Florești district, Moldova—preliminarily identified as a Russian Gerbera type, the first such device found in the country. It carried an onboard camera, hit a tree, and exploded, Moldovan police said. Romania's Defense Ministry reported a second aerial vehicle entered Romanian airspace for four minutes and crashed near Solca in the same border region; geolocated footage confirmed it was also a Gerbera, ISW noted. Poland evacuated the Hrubieszów and Dorohusk border crossings for 30 minutes, Prime Minister Donald Tusk said. Three countries were put on alert by a single night of Russian strikes.

"Intentional and accidental Russian drone incursions into NATO and Moldovan airspaces are likely part of the Kremlin's efforts to normalize airspace violations by intensifying their frequency," ISW assessed.

Sabotage in Poland and Germany

A fire engulfed the power system and backup generator at a Starlink ground station in Wola Krobowska, central Poland, on the evening of 23 September. Deputy Prime Minister Krzysztof Gawkowski confirmed it was sabotage aimed at cutting internet access, including for Ukraine's military. Authorities have not identified who was responsible, but the act aligns with Russia's "new" doctrine of attacks, Gawkowski said. The station is now operating normally.

German authorities suspended operations at Berlin-Brandenburg airport for 45 minutes the same evening after staff reported a drone sighting, Die Zeit reported. Federal police could not confirm it. ISW assessed both incidents fit Russia's wider pattern of sabotage against European defense assets, though neither has been officially attributed to Russia.

Explore further

Russian attack puts three countries on alert as drones enter Moldova and Romania

Western intelligence warnings

A Lithuanian Defense Ministry source reported on 23 September that Russia could launch Gerbera drones from a shipping container in the Mediterranean against Spain, France, and Italy. Danish Defense Intelligence assessed on 24 September that Russia will intensify its hybrid war in coming months, including destructive cyber attacks and sabotage carrying a high risk of casualties, and that there is a low but growing risk of a limited Russian military attack on a NATO border state. It sees no indications of an outright invasion. The CIA reportedly warned Poland that Russia may sabotage underwater cables to disrupt its banking system, according to Newsweek Polska journalists.

NATO tracked and confronted Russian submersibles rehearsing deployment of a new cable-disabling weapon near Svalbard in spring 2026—no cables were damaged, but the operation demonstrated Moscow's intent, Reuters reported. Shadow fleet vessels likely served as drone-launch platforms for incursions into NATO airspace, ISW noted.

"The increasing frequency of such warnings suggests that Western intelligence agencies are picking up indicators that the Kremlin is looking to diversify its platforms and means for conducting attacks against NATO and European states and is considering conducting such attacks," ISW assessed.

ISW said it has not yet seen evidence that Russia has conducted the attacks the warnings describe.

Denmark's assessment—that a limited Russian military strike on a NATO border state could come in the coming months—suggests the boundary between hybrid provocations and military action is narrower than European policy has assumed. ISW's synthesis reframes what governments have treated as separate incidents into one campaign.

"Intentional and accidental Russian drone incursions into NATO and Moldovan airspaces are likely part of the Kremlin's efforts to normalize airspace violations by intensifying their frequency," ISW assessed.

"The increasing frequency of such warnings suggests that Western intelligence agencies are picking up indicators that the Kremlin is looking to diversify its platforms and means for conducting attacks against NATO and European states and is considering conducting such attacks," ISW assessed.

Ukrainian partisans say they have sabotaged the railway signaling that keeps Russian troops supplied on the Lyman front. The ATESH movement reports that its agents disabled four relay cabinets on a line through Voronezh Oblast that carries military cargo to Russian forces there, delaying ammunition to three regiments.

The strike was timed to help Ukraine's Operation Vivaldi, the counteroffensive the Third Army Corps is running near Lyman in northern Donetsk. In its first phase, the operation cleared 75 square kilometers of Russian infiltrators and de-occupied another 10.

Cutting the rail line that feeds the Russian units facing that offensive is, by ATESH's account, part of the same fight, targeting the supply line rather than the front.

Four cabinets go dark

The sabotage hit a rail corridor running through the Voronezh, Novovoronezh, Liski, and Ostrogozhsk areas of Voronezh Oblast, a route ATESH says Russia uses to move military cargo toward the Lyman axis.

Relay cabinets house the switching gear that runs a line's automatic signals. Knocking them out can freeze traffic on a stretch of track without a single explosion, and ATESH says its agents disabled four of them. As with the movement's other claims, the account could not be independently verified.

Ammunition backs up

By ATESH's telling, the signaling failure delayed shipments of ammunition and engineering materiel to the 1st and 15th Guards regiments and the 254th Motor Rifle Regiment. Russian commanders, it said, had to rush in repair crews and divert resources to guard the infrastructure. A delayed shipment, far behind the front, can be felt at it, where an assaulted position waits for the ammunition that does not arrive.

ATESH hunts the supply lines

ATESH is a network of pro-Ukrainian agents operating inside Russia and Russian-occupied territory, and it has increasingly gone after the rail and power infrastructure that sustains Moscow's war. This month, the group also said it knocked out the power supply of a plant in Voronezh that makes components for Russian missiles.

Investigators found what they believe is explosives meters from a crashed drone near the Bundeswehr's Wunstorf air base in Lower Saxony, Germany, and the device matches the construction of drones used in the GRU-attributed Leipzig airport attack, Süddeutsche Zeitung, NDR, and WDR reported on 22 September. Germany's federal prosecutor and the Federal Criminal Police Office (BKA) have taken over the investigation, and the same reporting traced one of the Leipzig suspects to a sanctioned GRU colonel who directs sabotage against countries arming Ukraine.

Russia's sabotage campaign against countries supporting Ukraine has escalated from arson packages and recruited proxies to explosives-laden drones targeting military infrastructure inside NATO. Germany's military counterintelligence has attributed repeated sabotage on German soil to Russia, while Finnish President Stubb called the broader alarm about Russian threats an "overreaction"—a position the accumulating evidence from Germany and Poland does not support.

Explosives found days after the drone crash

A farmer discovered the drone, broken into several pieces, on the evening of 14 September, about one kilometer from the Wunstorf air base, Militarnyi reported. Days later, police found a suspicious substance just meters from the crash site. Security sources told SZ, NDR, and WDR they believe it is an explosive, though forensic analysis has not yet been completed.

The drone's design is similar to the devices used in the Leipzig airport attack on 4 August, when attackers tried to destroy Ukrainian cargo planes with explosives-laden drones. At least one component was manufactured using a 3D printer, the reporting found. Investigators believe the drone may have been near the military airfield for a long time—possibly up to two years.

Wunstorf air base houses the Bundeswehr's entire A400M transport fleet. The facility is Germany's central hub for moving troops and materiel worldwide. An explosives-laden drone near this base would represent a direct threat to the Bundeswehr's central global logistics hub.

The Wunstorf find was discussed at the weekly intelligence briefing in the Chancellery on 22 September, the outlets reported.

Leipzig suspect linked to sanctioned GRU colonel

The federal prosecutor's investigation connects the Wunstorf case to the Leipzig attack. In that case, Germany's government has officially blamed Russia. Two suspects were identified: Oleg L., a Latvian with a Russian passport, and Andrei K., a dual Belarusian-Russian citizen whose DNA was found at the Leipzig scene.

SZ, NDR, and WDR reported that Oleg L. maintained years-long contacts with GRU Colonel Denis Smolyaninov. The EU sanctioned Smolyaninov for directing sabotage operations against countries supporting Ukraine. Andrei K. had previously been noticed for minor offenses in the Baltic states and Finland and entered Germany on an Italian tourist visa. Moscow denied involvement in the Leipzig attack.

A drone violated the no-fly zone around NATO's missile shield base in Poland

The Wunstorf case came to light in the same week that a drone violated the no-fly zone around the US-operated Aegis Ashore missile defense base in Redzikowo, northern Poland, on 15 September.

Polish troops guarding the facility called civilian emergency services instead of neutralizing the drone, TVP World reported. Poland's defense ministry said the drone was a civilian device that "posed no threat" and remained under military surveillance, but Defense Minister Władysław Kosiniak-Kamysz ordered a full report into the incident.

Russia is trying to "scare Europe" through hybrid attacks so that it provides less support to Ukraine, but Moscow has neither an interest in nor the capability to escalate to a full-scale military confrontation with NATO, Finnish President Alexander Stubb told Politico on 21 September during an interview on the sidelines of the UN General Assembly—even as other European leaders warn that Russian strikes on NATO territory could come within months.

Ukraine critically needs Western support as Russia's full-scale invasion continues. NATO's PURL program has provided about 75% of all Patriot battery missiles and 90% of the missiles used in other air defense systems since its launch last summer, according to NATO Secretary General Mark Rutte on 3 February. Some countries are also hubs for defense companies that produce weapons for Ukraine. Russia is trying to pressure such countries, including through hybrid attacks. Polish Prime Minister Donald Tusk and the head of the Czech security service have warned that Russia could strike NATO territory within months. The Finnish president says his own intelligence sees activity but no imminent military threat, and calls it an "overreaction" when intelligence services tell their neighbors they are next for a Russian invasion.

Finnish intelligence sees Russian activity but no imminent military threat, Stubb says

Stubb calls claims by some intelligence services that Europe is next for a Russian invasion an "overreaction" and says he sees no evidence of this.

"We think we have to be vigilant and awake. But, you know, we have the longest border in NATO with Russia, it's half the border. In our intelligence we see that there is activity but no imminent military threat right now," Stubb added.

He says Russia will continue hybrid attacks, so Europe must be prepared and support Ukraine

Europe should prepare for Russia's "continued hybrid and sabotage attacks," but should not "overreact" to them, as Russia wants to scare its allies so that they slow down their support for Ukraine, the Finnish president said.

"And any time we overreact to a hybrid attack, they have actually won the battle in that particular way," Stubb told Politico.

Europe should remain "cool, calm and collected" during such Russian intimidation, the Finnish president said.

Germany's recent decision to officially hold Russia responsible for an attempted drone attack in Leipzig is "exactly what you need to do," Stubb said.

"You need to point the finger and say, we know what you're doing, and these are the consequences," he added.

A pro-Kremlin group, Global Citizens Against War 1984, issued an ultimatum to Latvia, Poland, and Portugal to stop supplying weapons to Ukraine by 7 October, threatening to disrupt defense companies in those countries.

Warnings from Warsaw and Prague paint a different picture

Russia could carry out "accidental" drone or missile strikes against NATO countries supporting Ukraine in an attempt to weaken the Alliance's integrity and persuade members that Article 5 is more theoretical than practical, Polish Prime Minister Donald Tusk said in parliament on 17 September, citing NATO, Ukrainian, and Polish intelligence assessments.

"There is a real risk that drones or other types of missiles could enter the territory of one or several NATO countries on the eastern flank," Tusk said.

The head of the Czech security service warned separately that Russia could undertake a limited incursion, false-flag provocations, and a massive influence campaign in a matter of months rather than years.

Illia Bilyk, a 21-year-old Ukrainian national, admitted five counts of racially and religiously aggravated criminal damage on 17 September over graffiti at five Muslim institutions in east London, the BBC reported.

The BBC and Hope Not Hate linked Bilyk’s attacks to the same Russian network behind arsons targeting properties connected to former UK Prime Minister Keir Starmer. The network operated Direct Action UK, a fake British far-right group that recruited people through Telegram and shared images of the resulting vandalism. Investigations have documented the same recruitment model across Europe for surveillance, sabotage, and other criminal assignments.

The Metropolitan Police said Bilyk sprayed offensive graffiti at three mosques, Noor Ul Islam Primary School, and the Islamic Shariah Council on 23 and 25 January 2025. Images then appeared in a Direct Action UK Telegram group. Russian operators created the group to pose as a British far-right movement, the BBC reported. Bilyk will be sentenced on 19 October.

The handler, known as EL or “El Money,” also recruited through Telegram groups used by Ukrainians seeking work, the BBC found. Ukrainian builder Roman Lavrynovych was paid in cryptocurrency and steered from posters and graffiti to arson.

In May 2025, Lavrynovych set fire to a car and properties connected to Starmer. Nobody was injured. Lavrynovych was jailed for seven years, while Ukrainian-born Romanian national Stanislav Carpiuc was also convicted.

The BBC identified EL as Yevgeny Lyukshin, a 23-year-old Russian diplomat and son of a senior Foreign Ministry official. It cited matching personal details, his presence in the Direct Action UK chat, family connections, and information-warfare training from Rybar, a sanctioned pro-Kremlin Telegram outlet.

However, the BBC could not conclusively establish that Lyukshin was EL, while British police said they had no evidence the attacks were state-sponsored. Lyukshin did not respond. The Russian Embassy denied any connection between Russia or its Foreign Ministry and unlawful activity.

Paid local recruits make Russia-linked attacks look homegrown

The London operation is one of several cases across Europe and other continents.

UK intelligence warned that Moscow increasingly relies on non-state actors, meaning hired civilians and criminals outside its formal services, for espionage, sabotage, assassination, and information operations.

This month, US prosecutors alleged that another Russian network recruited local residents for surveillance, sabotage, and murder-for-hire.

Three men were found guilty on July 8 in connection with an arson attack on Ukraine-linked businesses in London, which British authorities say was orchestrated by Russia's Wagner mercenary group, Reuters reported.

The alleged ringleader, Dylan Earl, 21, had already pleaded guilty to aggravated arson over the 2024 blaze targeting companies that were supplying Elon Musk's Starlink satellite equipment to Ukraine, according to Reuters.

The systems are considered vital to Ukraine's communications and defense against Russia's ongoing invasion.

Earl also became the first person convicted under the U.K.'s National Security Act after admitting to a separate plot to attack a wine shop and restaurant in London’s upscale Mayfair district and to kidnap its owner, a prominent critic of Russian President Vladimir Putin.

Two others, Jake Reeves, 23, and Earl’s associate, also pleaded guilty to aggravated arson, with Reeves admitting to a charge under the National Security Act for receiving a material benefit from a foreign intelligence agency.

A jury at London's Old Bailey court convicted three additional men, Nii Kojo Mensah, 23, Jakeem Rose, 23, and Ugnius Asmena, 20, of aggravated arson. They had denied the charges. A fourth man, Paul English, 61, was acquitted.

Two other defendants, Ashton Evans, 20, and Dmitrijus Paulauskas, 23, were charged with failing to disclose knowledge of terrorist activity. Evans was convicted on one count and cleared of another. Paulauskas was acquitted of both charges and reportedly broke down in tears as the verdict was read.

Commander Dominic Murphy of the London Metropolitan Police reportedly said he was confident the Wagner Group and the Russian state were behind the attacks.

The U.K. has designated the Wagner Group as a terrorist organization.

Earl had exchanged hundreds of encrypted messages with a supposed Wagner handler using the alias "Privet Bot" on Telegram. According to reporting by the Organized Crime and Corruption Reporting Project (OCCRP), the account was previously advertised by Grey Zone, a Wagner-affiliated channel.

Prosecutors said Earl expressed interest in fighting for Wagner and was encouraged to recruit contacts from British soccer hooligan networks, Irish republican groups, and organized crime circles, Reuters reported. He and Evans also admitted to unrelated charges of dealing cocaine.

The Russian Embassy in London has denied any involvement in the warehouse attack and accused the British government of blaming Russia for domestic issues.

The Kremlin has consistently rejected accusations of sabotage and espionage, despite growing evidence and convictions tied to Russian-linked operations across Europe.

‘Neither side wasted time’ — Ukraine’s economy minister on minerals deal negotiations with Trump’s ‘business-oriented’ administration

Ukraine’s Economy Minister Yuliia Svyrydenko says her task is simple — to get the investment fund behind the closely watched minerals deal with the U.S. off the ground, and prove its detractors wrong. “There are so many criticisms from different parties that this fund is just a piece of paper we can put on the shelves — that it won’t be operational,” Svyrydenko, who is also Ukraine’s first deputy prime minister, tells the Kyiv Independent at Ukraine’s Cabinet of Ministers on July 4, the morning

The Kyiv IndependentLiliane Bivings

BRICS summit participants condemned recent attacks on Russia’s railway infrastructure, according to a joint declaration on July 6 from Rio de Janeiro.

"We condemn in the strongest possible terms the attacks on bridges and railway infrastructure deliberately targeting civilians in the Bryansk, Kursk and Voronezh regions of the Russian Federation on May 31, and June 1 and 5 2025, which resulted in the deaths of several civilians, including children," the document says.

Bryansk, Kursk, and Voronezh oblasts are all located near Ukraine’s northeastern border and have played a central role in Russia’s war effort, serving as key logistical hubs and launch sites for missile and drone attacks on Ukrainian cities–often targeting civilian infrastructure and causing casualties.

In their declaration, BRICS leaders also called for a negotiated peace agreement between Russia and Ukraine.

“We recall our national positions concerning the conflict in Ukraine as expressed in the appropriate forum, including the UN Security Council and the UN General Assembly,” the document said. “We expect that current efforts will lead to a sustainable peace settlement.”

The statement comes a few days after a phone call between U.S. President Donald Trump and Russian President Vladimir Putin on July 3, in which Putin said "Russia will continue to pursue its goals" in the war against Ukraine, Kremlin aide Yury Ushakov said.

Russian Foreign Minister Sergey Lavrov attended the summit in person, while Russian President Vladimir Putin participated via video link.

Brazil is a member of the ICC and a signatory to the Rome Statute, meaning it is obliged to arrest Putin if he enters the country.

The ICC issued a warrant for the Russian leader's arrest in March 2023 over the illegal deportation of Ukrainian children during Russia's full-scale invasion of Ukraine.

The BRICS declaration also condemned recent U.S. and Israeli airstrikes on Iranian nuclear facilities as violations of international law and criticized the presence of foreign forces in Syria and Gaza, calling for Israeli withdrawal from Syrian territory.

BRICS, originally composed of Brazil, Russia, India, China, and South Africa, has expanded in recent years to include Iran, Egypt, the UAE, Ethiopia, and Indonesia.

Lavrov meets Iranian counterpart Abbas Araqchi at BRICS summit, reiterates Russia’s offer to mediate disputes over nuclear program

Russia reiterated its offer to mediate the conflict over Iran’s nuclear program during a meeting between Foreign Minister Sergey Lavrov and his Iranian counterpart at the BRICS summit in Rio de Janeiro, Reuters reported on July 6.

The Kyiv IndependentSonya Bandouil

The Atesh partisan group set fire to a signal cabinet that helps control traffic on a railway line near the Russian-occupied city of Yasynuvata in Donetsk Oblast, a route used for Russia's military logistics, the group claimed on Telegram on June 28.

Yasynuvata lies some 22 kilometers (12.5 miles) from the occupied city of Donetsk and is considered to be a major railway junction in the region.

According to the group, the sabotaged section is located near Russian military units, warehouses, and industrial facilities.

Atesh said the attack disrupted the delivery of a train carrying fuel for Russian forces.

"On Ukraine's Constitution Day, we remind the occupiers that this is an independent and free country. And Donetsk will always be Ukrainian," the statement read.

The Kyiv Independent could not verify these claims.

The Atesh partisan group regularly conducts sabotage attacks in Russia and Ukraine's Russian-occupied territories.

In early June, Atesh claimed to have destroyed a signal cabinet on the new Volnovakha-Mariupol railway, which had been recently built by occupying Russian forces.

Ukraine war latest: Ukrainian drones reportedly strike 4 fighter jets in Russia

Key developments on June 27: * Ukraine war latest: Ukrainian drones reportedly strike 4 fighter jets in Russia * North Korea deployed 20% of Kim’s elite ‘personal reserve’ to fight against Ukraine in Russia, Umerov says * Pro-Palestinian activists reportedly destroy military equipment intended for Ukraine * Zelensky signs decree to synchronize Russia sanctions

The Kyiv IndependentThe Kyiv Independent news desk

Ukraine's security service (SBU) is teaching teenagers how to avoid recruitment by Russian intelligence online, the New York Times (NYT) reported on June 21.

"Maybe not all of these special operations are reported in the media — but believe me, the enemy is not sleeping... They are working actively and carrying out illegal activities, as strange as it may sound, directly inside your phones," SBU spokesperson Roksolana Yavorska-Isaienko told students.

Approximately 22% of Ukrainians recruited by Russian intelligence to conduct sabotage or terrorist attacks are minors, Artem Dekhtiarenko, SBU spokesperson, said on April 2.

Russian intelligence attempts to recruit Ukrainian civilians online, offering easy money in return for sharing sensitive data or preparing sabotage or terrorist acts.

Russian intelligence finds its recruits using social platforms, including Telegram, Discord, and TikTok.

Unsuspecting teenagers are often offered hundreds or even thousands of dollars to conduct simpler tasks such as delivering packages or taking photos of energy sites, the NYT reports.

More serious tasks are commonly assigned to teenagers once they have been blackmailed for conducting less serious operations beforehand or when their phones are hacked to reveal compromising photos.

Russian intelligence is actively attempting to recruit Ukrainian nationals for illegal operations across the EU, Ukraine's military intelligence agency (HUR) said on June 2.

"The recruitment of Ukrainians for hostile operations in Europe is yet another tool of hybrid aggression that the Russian Federation is waging against Ukraine and the entire European community," HUR said.

The SBU caught a Russian agent as he was filming a military airfield in preparation for a Russian strike, the agency reported on June 15.

The Russian Federal Security Service (FSB) recruited the unemployed 24-year-old via the Telegram messaging app to collect coordinates for air attacks on airfields and logistic depots, the SBU said.

The Russian FSB allegedly offered "easy money" and instructed the recruit to find military facilities and carry out reconnaissance on the ground.

Love, sex, survival — Ukrainian author on how war shapes intimacy in Ukraine

In Ukraine, Russia’s war of aggression has upended not just borders but the country’s cultural landscape. Conversations about identity, gender, and sexuality have gained new urgency. Women are increasingly stepping into combat roles once dominated by men, while relationships can dissolve as quickly as they form. Many people

The Kyiv IndependentKate Tsurkan

Ukraine’s military intelligence (HUR) ignited an electrical substation during a sabotage operation in the Russian city of Kaliningrad, causing $5 million in damage and cutting electricity to a military production site, a source in HUR told the Kyiv Independent.

In the early hours of June 14, Ukrainian agents drained the coolant from the substation’s power transformer before setting the facility on fire. The inferno inflicted major damage on the facility and caused a power cut, impacting nearby Russian military sites.

"We once again remind you that Russia no longer has a rear either in the east, in the west, or anywhere else on the planet. Everything Russian involved in the war against Ukraine will burn, sink, and be destroyed regardless of its level of protection or location," the source said.

Ukraine continues to carry out numerous secretive attacks within Russia and occupied Ukrainian territories, targeting military sites, like airfields, as well as key infrastructure like railways and oil refineries.

The attacks involve HUR, Ukraine’s Security Service (SBU) as well as partisan and sabotage groups.

HUR was behind explosions near Desantnaya Bay in Russia's far eastern Vladivostok on May 30, which reportedly damaged military personnel and equipment. The operations took place approximately 6,800 kilometres from the Ukrainian border, making it Ukraine's furthest incursion into Russian territory, if confirmed.

On June 1, the SBU launched Operation Spiderweb, a game-changing drone attack on four key Russian military airfields, damaging 41 planes, including heavy bombers and rare A-50 spy planes.

Ukrainian drones destroy Russian air defense systems in occupied Zaporizhzhia Oblast, military intelligence says

Ukraine’s military intelligence (HUR) destroyed three Russian air defense systems using drones in the occupied Zaporizhzhia Oblast on June 14, HUR says.

The Kyiv IndependentVolodymyr Ivanyshyn