French President Emmanuel Macron said French services received no CIA warning about a possible Russian drone attack from Mediterranean merchant ships, pushing back on an El Mundo report that US intelligence had alerted France, Italy, and Spain, RTL reported.

Macron’s denial comes amid drone attacks and sabotage cases that European governments have linked to Russia. France is preparing stronger defenses against that wider threat, even as Macron says its services received no specific CIA warning. Italy’s defense minister has also cautioned against fueling alarm over an unconfirmed report.

Asked about the report during a televised interview on 24 September, Macron said: “The CIA did not inform French services of such an attack.” He said Russia was multiplying hostile and sometimes criminal acts against European countries. Covert acts such as sabotage and cyberattacks are often described as hybrid warfare. Asked whether France itself could be attacked, Macron answered yes.

Italian Defense Minister Guido Crosetto separately wrote on X that El Mundo’s alert “finds no confirmation.” He said it served no one to add “more fuel to the fire” at an already tense time.

The Spanish newspaper reported that the possible operation would use Gerbera drones, small Russian aircraft capable of carrying several kilograms of explosives. The drones would be hidden in shipping containers aboard merchant ships and launched toward targets along Europe’s southern coast. El Mundo cited a source close to Lithuania’s Defense Ministry, and analysts familiar with a CIA report said to have circulated among European foreign ministries. Euromaidan Press covered the account on 24 September. Bythe time of publication, neither Spain’s government nor the CIA had publicly addressed it.

Macron pointed to the failed attack at Leipzig/Halle Airport in eastern Germany in August. A drone carrying explosives was found near a Ukrainian cargo aircraft. German officials attributed the attempt to Russia. Macron said France had not experienced a comparable incident.

The wider hybrid warfare threat

Beyond the disputed Mediterranean alert, authorities have investigated other incidents throughout Europe as possible Russian sabotage.

Germany followed its accusation over Leipzig with diplomatic measures against Moscow. Berlin ordered Russia’s last consulate in Germany closed and ended an agreement permitting a Russian cultural center. German investigators also identified two suspects, including a Russian man they linked to military intelligence. Moscow denied involvement.

Poland’s justice and interior ministers said Russian intelligence ordered the May 2024 arson of Warsaw’s Marywilska 44 shopping center.

Finnish President Alexander Stubb said Russia would continue such attacks to frighten Ukraine’s allies into reducing support. He urged vigilance without overreacting, saying Finnish intelligence saw no imminent military threat.

The Institute for the Study of War (ISW) published a map in its analytical report on 24 September that contrasts the claimed Russian encirclement with the location of Russian forces as assessed by the experts. Based on the evidence observed by ISW, the nearest area where Russian forces are present is 10.2 kilometers from the southeastern outskirts of Dobropillia.

Russia has been spreading disinformation about its successes around Dobropillia as part of what ISW calls a cognitive warfare effort to portray Ukrainian defenses as on the verge of collapse. Russia's Defense Ministry published a map claiming the city was surrounded. ISW's own map challenges it. The Ukrainian military says the city remains under its control.

Russian Defense Ministry claims it is already destroying encircled Ukrainian troops in Dobropillia and moving further

Units of Russia's Center Grouping of Forces continue combat operations against encircled Ukrainian forces in the Dobropillia area of Donetsk Oblast while simultaneously advancing toward Oleksandrivka, the Russian Defense Ministry claimed. ISW analysts, meanwhile, said they have not observed evidence supporting Russia's claim that the city is encircled. They also noted that Ukrainian officials "directly refute" the claim.

ISW observed evidence that Russian infiltrators, small groups, were operating east and northeast of Dobropillia on 19 and 20 September. The institute did not assess that these infiltrators had consolidated their positions.

Ukrainian forces maintain positions south and northeast of Dobropillia, military observer Kostiantyn Mashovets said on 20 September, according to ISW.

Russian forces have not made major gains in the Dobropillia direction, the chief of staff of an artillery reconnaissance battalion said on 22 September, according to the institute. On the same day, a Russian milblogger described the "alleged Russian encirclement of Dobropillia" as potentially meaning not the direct presence of infantry, but only the establishment of fire control over Ukrainian logistics, including roads west of Dobropillia and toward Sviatohorivka, according to ISW.

ISW noted that Russia's pervasive military culture of lying—what Russian milbloggers themselves call "beautiful reports"—has degraded the Defense Ministry's own ability to understand the battlefield and enabled inflated claims like the Dobropillia encirclement.

Russia uses this disinformation as a "diversion"

In its statement, the Russian Defense Ministry itself described Dobropillia as a "strongly fortified settlement" whose seizure would threaten key Ukrainian supply lines running from Dnipropetrovsk Oblast toward the Fortress Belt—the Sloviansk-Kramatorsk-Druzhkivka urban agglomeration.

Russia has recently renewed its attempts to break through toward Dobropillia.

Third Army Corps Commander Andrii Biletskyi said that Russian forces sought to bypass the fortified cities through Dobropillia and link up with troops advancing from north of Lyman, rather than launch a direct assault. ISW noted on 16 September that the Vivaldi operation disrupted Russia's two-pronged plan. In its 24 September report, ISW said Russia's claims about Dobropillia were partly intended to divert attention from Ukraine's elimination of the Russian salient north of Lyman, which has likely forced Russia's command to rethink its wider encirclement plans.

Several recent incidents across Europe were conducted by Russia or are likely attributable to Russia, ISW assessed in its 24 September report, though authorities have not officially linked the Polish and German incidents to Moscow.

Russia's full-scale war against Ukraine has expanded into a parallel campaign of provocations against European defense and logistical infrastructure. The Kremlin is using drones, arson, and undersea cable sabotage to degrade Europe's will and ability to support Ukraine, while deliberately intensifying the frequency of airspace violations to erode the boundary between hybrid and kinetic war.

Drones over Moldova and Romania

Four Russian drones flew over Bukovyna and targeted an energy facility and border crossings with Moldova and Romania, Chernivtsi Oblast Military Administration head Ruslan Osypenko reported. Ukrainian forces shot down three. The fourth flew toward Suceava County in northeastern Romania.

A drone crashed in Cernița, Florești district, Moldova—preliminarily identified as a Russian Gerbera type, the first such device found in the country. It carried an onboard camera, hit a tree, and exploded, Moldovan police said. Romania's Defense Ministry reported a second aerial vehicle entered Romanian airspace for four minutes and crashed near Solca in the same border region; geolocated footage confirmed it was also a Gerbera, ISW noted. Poland evacuated the Hrubieszów and Dorohusk border crossings for 30 minutes, Prime Minister Donald Tusk said. Three countries were put on alert by a single night of Russian strikes.

"Intentional and accidental Russian drone incursions into NATO and Moldovan airspaces are likely part of the Kremlin's efforts to normalize airspace violations by intensifying their frequency," ISW assessed.

Sabotage in Poland and Germany

A fire engulfed the power system and backup generator at a Starlink ground station in Wola Krobowska, central Poland, on the evening of 23 September. Deputy Prime Minister Krzysztof Gawkowski confirmed it was sabotage aimed at cutting internet access, including for Ukraine's military. Authorities have not identified who was responsible, but the act aligns with Russia's "new" doctrine of attacks, Gawkowski said. The station is now operating normally.

German authorities suspended operations at Berlin-Brandenburg airport for 45 minutes the same evening after staff reported a drone sighting, Die Zeit reported. Federal police could not confirm it. ISW assessed both incidents fit Russia's wider pattern of sabotage against European defense assets, though neither has been officially attributed to Russia.

Western intelligence warnings

A Lithuanian Defense Ministry source reported on 23 September that Russia could launch Gerbera drones from a shipping container in the Mediterranean against Spain, France, and Italy. Danish Defense Intelligence assessed on 24 September that Russia will intensify its hybrid war in coming months, including destructive cyber attacks and sabotage carrying a high risk of casualties, and that there is a low but growing risk of a limited Russian military attack on a NATO border state. It sees no indications of an outright invasion. The CIA reportedly warned Poland that Russia may sabotage underwater cables to disrupt its banking system, according to Newsweek Polska journalists.

NATO tracked and confronted Russian submersibles rehearsing deployment of a new cable-disabling weapon near Svalbard in spring 2026—no cables were damaged, but the operation demonstrated Moscow's intent, Reuters reported. Shadow fleet vessels likely served as drone-launch platforms for incursions into NATO airspace, ISW noted.

"The increasing frequency of such warnings suggests that Western intelligence agencies are picking up indicators that the Kremlin is looking to diversify its platforms and means for conducting attacks against NATO and European states and is considering conducting such attacks," ISW assessed.

ISW said it has not yet seen evidence that Russia has conducted the attacks the warnings describe.

Denmark's assessment—that a limited Russian military strike on a NATO border state could come in the coming months—suggests the boundary between hybrid provocations and military action is narrower than European policy has assumed. ISW's synthesis reframes what governments have treated as separate incidents into one campaign.

"Intentional and accidental Russian drone incursions into NATO and Moldovan airspaces are likely part of the Kremlin's efforts to normalize airspace violations by intensifying their frequency," ISW assessed.

"The increasing frequency of such warnings suggests that Western intelligence agencies are picking up indicators that the Kremlin is looking to diversify its platforms and means for conducting attacks against NATO and European states and is considering conducting such attacks," ISW assessed.

Indian police arrested the foreigners on terrorism allegations in March but later downgraded the charges

© AFP/Getty

Olena Kalynychenko is among thousands missing after devastating floods hit the Nepal-China border

© AFP/Getty