On 13 August, the Ukrainian-Crimean Tatar partisan movement ATESH said its agents had disabled a communications tower near Pylna in northern Kharkiv Oblast. The group said the damage disrupted links between two Russian motor rifle regiments near the border.

Pylna lies on the Russian border and was among the villages seized when Moscow opened the northern Kharkiv front in May 2024. The claimed tower attack is part of a wider Ukrainian resistance effort behind Russian lines. Moscow's forces still depend on infrastructure in occupied territory to communicate, move supplies, and hold the line. Ukraine’s underground fighters exploit that dependence from within, targeting communications, transport, and fuel supplies to create problems for Russian units at the front.

ATESH said the tower carried data between Russian command posts and coordinated units in the area. The movement said its loss disrupted command channels and delayed border-zone mobile groups. It did not say how agents disabled the tower or how long the interruption would last.

The partisans stated that the communications between Russia’s 345th and 380th motor rifle regiments were hit hardest. The regiments operate in neighboring sectors and rely on stable links for joint action and rapid responses, according to the group. ATESH claimed their offensive tempo and ability to support each other had fallen.

Neither the claimed ATESH sabotage nor its reported effects have been independently verified.

ATESH attacks on Russian supply lines

The tower claim follows ATESH’s 10 August account of sabotaging an electric locomotive near Voronezh. The group said it carried military supplies toward the Kupiansk front in Kharkiv Oblast. In June, ATESH also said agents damaged power and rail equipment near Russia’s Novomoskovsk Azot plant, whose output feeds explosives production.

ATESH has also reported intelligence work inside Russian forces. In July, the group said an agent reported a Ukrainian strike on five military fuel trucks in occupied Luhansk. Together, the claims describe a campaign against transport, fuel, and communications behind the front.

Ukrainian resistance works behind the front

The claimed tower operation is one part of the Ukrainian resistance behind Russian lines. Underground networks also gather intelligence and sustain civil defiance. 

A Euromaidan Press investigation documented groups planting explosives, tracking Russian positions, distributing leaflets, and painting Ukrainian symbols despite the threat of imprisonment and torture.

ATESH says its network includes Ukrainians, Crimean Tatars, anti-war Russians, and sources inside Russia’s military and occupation administrations. Its claims are often impossible to verify independently. Taken together, they portray a campaign to make Russia’s rear less secure while other groups preserve Ukrainian identity under occupation.

Russia may expand hybrid attacks against Poland and the Baltic states, including infrastructure sabotage or false-flag attacks, Bloomberg reported on 12 August, citing an unnamed European intelligence official. 

The warnings come amid concern that Moscow wants to intimidate Ukraine’s supporters. The CIA warning follows Russian threats, incursions, alleged sabotage plots, and disinformation against Poland and the Baltic states. Most Western military aid reaches Ukraine through Poland, while the Baltic states rank among Kyiv’s strongest supporters. Sabotage of transport, energy, or communications can slow aid delivery and test NATO while hiding Russia’s role.

Separately, a European government official told Bloomberg that the CIA had warned countries in the region of a possible future Russian attack. The CIA declined to comment.

The same official said Russia might instead be creating the impression of an impending attack to sow fear as part of an information operation. The official saw no signs that Moscow was preparing a conventional attack or invasion.

Moscow tests NATO’s eastern flank

Poland and Lithuania had already raised similar concerns. In July, Poland said it had credible intelligence that Russia was planning new provocations. Lithuania later warned that Moscow might rebuild captured Ukrainian drones for false-flag strikes on critical infrastructure.

In September 2025, between 19 and 23 Russian drones entered Polish airspace, shutting down airports and damaging buildings. Poland closed four airports as NATO aircraft responded.

Meanwhile, five people are on trial in Lithuania over attacks allegedly organized for Russian military intelligence in 2024, Bloomberg reported. Lithuania has reinforced infrastructure sites and deployed troops since June.

These warnings and incidents place the CIA alert within a wider pattern of pressure on NATO’s eastern flank and Ukraine’s supporters. 

How Russia strikes without starting a war

Bloomberg cited several recent unexplained drone incidents in Germany alongside the CIA warning. Citing Die Zeit, Euromaidan Press reported that an explosive-laden drone struck the wing of a parked Ukrainian An-124 at Leipzig-Halle airport and failed to detonate. A US Defense Department official in Europe told CNN that Washington assessed the drone belonged to Russian intelligence. 

Bloomberg also reported that a cargo plane hit an unidentified object and that drones appeared over a military base the following day. It did not connect either incident to Russia.

More broadly, Russian hybrid operations have grown sharply since the full-scale invasion. CSIS found that attacks in Europe tripled from 2023 to 2024, after quadrupling the previous year. Separately, the US Helsinki Commission mapped nearly 150 operations in NATO territory attributed to or suspected of Russia between February 2022 and November 2024.

Retired Lt. Gen. Ben Hodges told Euromaidan Press in February that attacks on ports, railways, and cables can probe routes needed for NATO reinforcements. Their deniability raises the political cost of responding.

By hiding its role, Moscow can disrupt support for Ukraine and test NATO without openly starting a war.