Several recent incidents across Europe were conducted by Russia or are likely attributable to Russia, ISW assessed in its 24 September report, though authorities have not officially linked the Polish and German incidents to Moscow.

Russia's full-scale war against Ukraine has expanded into a parallel campaign of provocations against European defense and logistical infrastructure. The Kremlin is using drones, arson, and undersea cable sabotage to degrade Europe's will and ability to support Ukraine, while deliberately intensifying the frequency of airspace violations to erode the boundary between hybrid and kinetic war.

Drones over Moldova and Romania

Four Russian drones flew over Bukovyna and targeted an energy facility and border crossings with Moldova and Romania, Chernivtsi Oblast Military Administration head Ruslan Osypenko reported. Ukrainian forces shot down three. The fourth flew toward Suceava County in northeastern Romania.

A drone crashed in Cernița, Florești district, Moldova—preliminarily identified as a Russian Gerbera type, the first such device found in the country. It carried an onboard camera, hit a tree, and exploded, Moldovan police said. Romania's Defense Ministry reported a second aerial vehicle entered Romanian airspace for four minutes and crashed near Solca in the same border region; geolocated footage confirmed it was also a Gerbera, ISW noted. Poland evacuated the Hrubieszów and Dorohusk border crossings for 30 minutes, Prime Minister Donald Tusk said. Three countries were put on alert by a single night of Russian strikes.

"Intentional and accidental Russian drone incursions into NATO and Moldovan airspaces are likely part of the Kremlin's efforts to normalize airspace violations by intensifying their frequency," ISW assessed.

Sabotage in Poland and Germany

A fire engulfed the power system and backup generator at a Starlink ground station in Wola Krobowska, central Poland, on the evening of 23 September. Deputy Prime Minister Krzysztof Gawkowski confirmed it was sabotage aimed at cutting internet access, including for Ukraine's military. Authorities have not identified who was responsible, but the act aligns with Russia's "new" doctrine of attacks, Gawkowski said. The station is now operating normally.

German authorities suspended operations at Berlin-Brandenburg airport for 45 minutes the same evening after staff reported a drone sighting, Die Zeit reported. Federal police could not confirm it. ISW assessed both incidents fit Russia's wider pattern of sabotage against European defense assets, though neither has been officially attributed to Russia.

Explore further

Russian attack puts three countries on alert as drones enter Moldova and Romania

Western intelligence warnings

A Lithuanian Defense Ministry source reported on 23 September that Russia could launch Gerbera drones from a shipping container in the Mediterranean against Spain, France, and Italy. Danish Defense Intelligence assessed on 24 September that Russia will intensify its hybrid war in coming months, including destructive cyber attacks and sabotage carrying a high risk of casualties, and that there is a low but growing risk of a limited Russian military attack on a NATO border state. It sees no indications of an outright invasion. The CIA reportedly warned Poland that Russia may sabotage underwater cables to disrupt its banking system, according to Newsweek Polska journalists.

NATO tracked and confronted Russian submersibles rehearsing deployment of a new cable-disabling weapon near Svalbard in spring 2026—no cables were damaged, but the operation demonstrated Moscow's intent, Reuters reported. Shadow fleet vessels likely served as drone-launch platforms for incursions into NATO airspace, ISW noted.

"The increasing frequency of such warnings suggests that Western intelligence agencies are picking up indicators that the Kremlin is looking to diversify its platforms and means for conducting attacks against NATO and European states and is considering conducting such attacks," ISW assessed.

ISW said it has not yet seen evidence that Russia has conducted the attacks the warnings describe.

Denmark's assessment—that a limited Russian military strike on a NATO border state could come in the coming months—suggests the boundary between hybrid provocations and military action is narrower than European policy has assumed. ISW's synthesis reframes what governments have treated as separate incidents into one campaign.

"Intentional and accidental Russian drone incursions into NATO and Moldovan airspaces are likely part of the Kremlin's efforts to normalize airspace violations by intensifying their frequency," ISW assessed.

"The increasing frequency of such warnings suggests that Western intelligence agencies are picking up indicators that the Kremlin is looking to diversify its platforms and means for conducting attacks against NATO and European states and is considering conducting such attacks," ISW assessed.

Moldova’s Defense Ministry reported four drone incursions, Romania’s Defense Ministry confirmed a drone crash, and Poland’s Operational Command scrambled fighters twice during Russia’s 24 September attack on Ukraine.

The strike wave forced Moldova to close part of its airspace, Romania to warn residents and launch F-16 fighter jets, and Poland to activate aircraft, air defenses, and radar. No casualties were reported in the two confirmed crashes, and Poland detected no incursion during its first deployment. Moldova has recorded dozens of Russian drone incursions this year.

The drones approached from Ukraine’s Vinnytsia, Odesa, and Chernivtsi oblasts, according to Moldova’s Defense Ministry. Authorities temporarily closed part of the country’s northern airspace.

Near Cernița in northern Moldova, one drone struck a tree, fell into a field beside a farm, and exploded, police said. No casualties were reported.

Investigators preliminarily identified the camera-equipped wreckage as a Gerbera, a low-cost Russian drone often used during attacks on Ukraine. Police said it was the first device of that type found in Moldova.

Police also reported a resident’s account of another explosion near Vadul Rașcov, but said they were still investigating the location.

Romanian radar first tracked an aerial target over Ukraine near the border before it entered northern Romania, the Defense Ministry said. Romania launched two F-16s and sent emergency alerts to residents’ phones in the area. The drone remained in Romanian airspace for about four minutes before crashing near Solca, the ministry said. Officials reported no casualties or damage and had not identified the drone’s origin.

Poland’s Operational Command launched fighters twice in response to Russian strikes on western Ukraine. The first Polish deployment ended around 08:00 with no airspace violation detected; the command announced a second at 09:07. It also activated ground-based air defenses and radar.

The incursions came amid a wider assault. Ukraine’s Air Force said Russia launched 282 drones of various types, along with ballistic and other missiles, overnight into 24 September. Ukrainian officials reported detecting four drones over Chernivtsi Oblast, the Ukrainian region bordering Moldova and Romania, and shooting down three.

Moldova’s repeated airspace breaches

The latest incident followed several breaches in August. An unidentified drone exploded near Crocmaz on 9 August. Another object exploded near Talmaza on 17 August after Moldova briefly closed part of its airspace.

President Maia Sandu said Russian drones had entered Moldovan airspace 39 times in 2026, compared with 17 times throughout 2025. Moldova has portable air-defense weapons and electronic warfare equipment, but Sandu said these chiefly protect individual sites. Her government is working with partners to expand air-defense coverage and speed up threat warnings.

Russian drones have entered Moldovan airspace 39 times since the start of 2026, against 17 in all of last year, President Maia Sandu said after a meeting of the country's National Security Council, Liga reported. Moldova's military can defend individual sites and little more, and Sandu said the country has to speed up building air defenses it spent three decades without. The council also ordered better protection for the energy facilities the country runs on, drones included.

What Moldova has to shoot with

Moldovan forces hold portable anti-aircraft missiles, anti-aircraft machine guns, and electronic warfare equipment, Sandu said. Their capabilities are mostly limited to protecting individual pieces of critical infrastructure. Three decades of ignoring air defense will not be paid off in five, she said, and Moldova is working with partners to speed the process up.

The military is now working to extend the range its air defenses cover. Moldova received €120 million from the EU to buy a medium-range system, and it is looking with international partners for more modern and cheaper ways to bring drones down.

Chișinău is also deepening cooperation with countries in the region to receive and pass on threat data faster. Interception is the part Moldova cannot yet do: Romania has shot down drones that reached it after crossing Moldovan territory, while Moldova mostly records them.

Explore further

Moldova is investing in air defense against the Russian drones crossing from Ukraine—Romania shoots down the ones that reach it

A month of incidents

The pace has picked up this month. A drone tracked over Moldova on 8 September held up seven flights, among them Volodymyr Zelenskyy's plane as it took off for King Harald V's funeral in Norway.

Three days later, Moldova temporarily withdrew its staff from three border crossings on Ukrainian territory because of the threat of Russian strikes, after Russia hit at least five of Ukraine's western crossings since late August.

On the morning of 18 September, a loud explosion went off near Chișinău and police found drone wreckage at the site. In August, a blast near the village of Talmaza marked the country's third airspace breach in nine days.

Warning the public is the other gap

Moldova is still building the system that would tell people a drone is overhead. MD-Alert needs more time to implement and is costed at €5 million, Sandu said, and until it works the government will use whatever notification mechanisms it already has.

The council that produced the drone count was convened on energy, and its decisions ran from gas reserves and fuel stocks to cyber vulnerabilities. Among them, Sandu wrote, were measures to better protect the facilities the country's energy supply depends on from hostile action, including the danger of drones.

Moldova closed its airspace on the afternoon of 8 September and delayed the plane carrying Ukraine's President Volodymyr Zelenskyy to Norway after a Russian drone crossed into the country, its government said in a statement to Reuters. The aircraft was cleared for takeoff once officials established that it had come down on Moldovan territory. Norway's prime minister described the episode as a near-miss, and neither government has said how close the drone came.

Russia runs three things at once along the EU's eastern frontier—mass drone attacks on Ukraine, drones crossing into Moldovan and Romanian airspace almost weekly, and strikes on the border checkpoints tying the three countries together—and states without interceptors can answer only by closing their skies.

What happened, and when

Moldova's National Army detected a Shahed-type drone entering from Ukraine at 16:20, the country's Defense Ministry reported. It flew toward Bender, a city in the Russian-backed breakaway region of Transnistria, then turned toward the capital, Chișinău, by 16:32. At 16:37, it left the country over western Moldova and headed into eastern Romania, across the Prut river border.

Controllers restricted the airspace over central Moldova at 16:30. The same drone came back from the Romanian side, crossed the north of the country, and came down outside a village in the northwest, near the Romanian border, setting dry vegetation alight, according to the log. Nobody was hurt, and the airspace reopened at 17:39, more than an hour after it closed. The BBC's Ukrainian service placed the crash near a different northern village, without naming a source, so the exact spot is unsettled.

The violation fell in the window when Zelenskyy's aircraft was preparing to take off, Militarnyi reported, citing the ministry. The civilian airport he was leaving from suspended operations and the border service closed the nearby crossings, the outlet added. Three departures and four arrivals were delayed in all, Reuters said.

Explore further

A drone nearly hit Zelenskyy’s plane taking off from Moldova on his way to a king’s funeral, Norway’s PM says

How the plane and the drone crossed paths

Zelenskyy flies an Airbus A319 corporate jet, and the threat to it probably came from a jet-powered Geran drone that crossed Romanian and then Moldovan airspace at around 17:00 that day, Militarnyi wrote, publishing the drone's track from the monitoring channel Oko Hora. That fits the return leg in the army's log, though no authority has tied a specific aircraft to the delay.

Norwegian Prime Minister Jonas Gahr Støre told the broadcaster NRK the plane was almost hit as it prepared to leave, without naming his source. His office later described a danger recorded in Moldovan airspace that forced the delay. Norway's Finance Minister Jens Stoltenberg said Zelenskyy recounted the details himself at a closed meeting in Oslo.

Zelenskyy and First Lady Olena Zelenska attended the farewell ceremony for King Harald V, who died on 28 August. Around it, the president worked on air defense, meeting Støre and then executives of defense companies from partner countries about the FREYJA anti-ballistic missile program, which Norway's government casts as a cheaper alternative to the Patriot.

The next night, the border crossing

Overnight on 9 September, Russian drones struck the Starokozache crossing on Ukraine's border with Moldova, killing two people and injuring three. The dead were Ukrainians, and a Moldovan citizen was among the injured, Moldova's Foreign Ministry told the broadcaster TV8. Border guards reopened the crossing that afternoon.

Russia claimed it had struck the crossing because it was used for military logistics. Moldova's Foreign Ministry rejected that outright, saying no weapons move through its territory, and that the people crossing there are families, children with their mothers, and the elderly. It is one of the working crossings on the Odesa Oblast stretch of the Ukrainian-Moldovan border, where the heaviest traffic runs through Palanca and Giurgiulești.

Moldova's President Maia Sandu condemned both the strike and the Geran-type drone that had forced her country to close its airspace the day before, and said the events show Ukraine needs more air defense.

Explore further

Moldova is investing in air defense against the Russian drones crossing from Ukraine—Romania shoots down the ones that reach it

The pattern, and Moldova's empty sky

Russia has hit at least five checkpoints on Ukraine's western borders since late August, four of them facing Moldova and one facing Romania, and the drone that struck the Kotlovyna crossing on 20 August flew in through Moldovan airspace. Euromaidan Press has covered part of that campaign, including burned food cargo near the Giurgiulești crossing in August. The State Border Guard Service has called such strikes an act of terrorism, because people are present at the crossings when they are hit.

In the air, Moldova can do little. It is still buying its first serious air defenses, so it restricts airspace and waits while Romania scrambles jets against the drones that reach its side. It logged three airspace breaches in nine days in August, and more than 100 drones were detected near Romania in four days that month.