Estonia is automatically diverting emails using Russia’s .ru internet domain into quarantine for additional security checks before they reach state institutions connected to the country’s secure government network, Justice and Digital Affairs Minister Liisa Pakosta told Estonia's public broadcaster ERR.

The measure is intended to protect Estonian government computer systems amid a post-2022 surge in cyberattacks that officials link to Russia. It applies only to institutions operating inside the secure state network, leaving local governments and some state bodies outside.

Many Estonian residents, particularly Russian speakers, still use .ru email services, ERR noted. Because the filter is triggered solely by the address ending, legitimate messages will be screened alongside potentially malicious ones and may take longer to arrive.

Pakosta said the safeguard was necessary because cyberattacks against Estonia had increased “exponentially” since 2022 and that many were linked to Russia. She said such attacks had not succeeded against Estonia, while major public-sector cyberattacks had succeeded in both Latvia and Lithuania.

The rerouting is automatic and handled centrally, so agencies do not need to take any action, Pakosta said. A large proportion of state institutions have already moved behind the government’s unified cyber shield, while the transition continues.

Pakosta described the quarantine as one small measure within Estonia’s wider cybersecurity work. Estonia’s courts have gone further, saying they will ask parties in legal proceedings to stop using .ru addresses for official communication, according to ERR.

How the Baltic states are hardening against Russia

Estonia's email quarantine forms part of a broader Baltic effort to limit Russian influence and strengthen defenses against military, cyber, and covert threats.

Estonia, Latvia, and Lithuania are constructing a Baltic Defense Line, a planned network of bunkers, anti-tank ditches, and other barriers, along their borders with Russia and Belarus. Latvia has also banned imports of Russian and Belarusian books, clothing, toys, and other goods.

The threat extends beyond cyberattacks: an Estonian court found that Russia’s military intelligence agency, the GRU, ordered the 2024 firebombing of a Ukrainian restaurant in Tallinn, part of a wider Russian sabotage campaign targeting European supporters of Ukraine.

Wolfgang Kubicki, chair of Germany’s pro-business liberal Free Democratic Party (FDP), proposed that Berlin summon Russia’s ambassador and use the prospect of Taurus missiles for Ukraine as leverage against further hybrid attacks during an appearance on German broadcaster ntv.

Kubicki’s proposal does not change German policy. The FDP has no seats in the Bundestag, Germany’s federal parliament, while Chancellor Friedrich Merz has ruled out supplying the missiles. However, it recasts military aid to Ukraine as a potential cost Moscow would face for hybrid attacks inside Germany. Berlin has since formally blamed Russia for the Leipzig/Halle operation that prompted his remarks.

Kubicki said “a reasonable person” would tell the ambassador that Germany had so far withheld Taurus missiles. If the hybrid threat continued, Berlin should do everything possible to ensure Ukraine received the weapons it needed to defend itself against Russia, he added.

Taurus, the weapon Kubicki spoke about, is a German-Swedish cruise missile launched from military aircraft, with a range exceeding 500 kilometers. Ukraine has sought it for years to strike military targets far behind Russian lines.

Germany refused to supply Taurus missiles in 2025 while funding hundreds of Ukrainian-made long-range systems. Merz again ruled out a transfer in March, arguing that Ukrainian weapons were more effective.

Leipzig sharpens Germany’s hybrid-war debate

Germany formally blamed Russia on 1 September for the attempted drone attack at Leipzig/Halle Airport and said it would close the Russian consulate in Bonn and terminate the agreement under which the Russian House cultural center operates in Berlin, DW reported. Interior Minister Alexander Dobrindt cited evidence from German and allied intelligence services, as well as investigations across Europe. Russia has denied involvement.

The operation that prompted Kubicki’s warning involved an explosives-laden drone that struck the wing of a Ukrainian Antonov An-124 heavy cargo aircraft on the evening of 4 August but failed to detonate, Die Zeit reported. The airport handles civilian freight and NATO logistics, while Ukraine’s Antonov Airlines uses it as a base.

Investigators later found evidence that three drones were involved and discovered about 50 grams of suspected military explosive near the runways.

Polish Prime Minister Donald Tusk said authorities had detained a Russian citizen recruited by Moscow to kill a man in Warsaw. The target holds US and Ukrainian passports, the Associated Press (AP) reported on 13 August. Tusk said Polish security services stopped the alleged attack “at the last minute.” 

Since 2022, AP has mapped about 200 acts of sabotage, arson, and disruption across Europe that officials have linked to Russia. European governments say the campaign aims to intimidate Ukraine’s supporters and disrupt military aid, while Ukrainian authorities report similar recruitment tactics inside Ukraine.

The suspect was detained on 7 August and remanded for three months, Warsaw police said. Tomasz Siemoniak, the minister overseeing Poland’s intelligence services, said the operation involved US services.

PM Tusk called it the first Russian-ordered attempt of its kind against a US citizen in another NATO country. He said the target was “inconvenient to the Putin regime,” without explaining why.

In their bulletin, Reuters reported that Russia’s Warsaw embassy did not immediately respond to a request for comment. Moscow denies conducting a sabotage campaign in Europe.

Russia has already gone after a German arms CEO and critics of the Kremlin

European authorities had already reported plots against arms-industry figures supplying Ukraine. CNN reported in 2024 that US and German services foiled a plot against Rheinmetall chief Armin Papperger. 

Former Bellingcat investigator Christo Grozev said an intelligence insider told him he was on Russia’s kill list. He also warned Putin critic Garry Kasparov that a Russian agent trained in assassination had infiltrated exile groups to approach him.

Russia has also been accused of targeting Kremlin opponents abroad. In June, Kremlin critic Robert Kuzovkov was shot dead in Poland. Tusk said the killing resembled a political assassination, but Warsaw has not attributed it to Russia.

Russia uses disposable agents, not career spies

The alleged recruitment in Warsaw resembles tactics reported elsewhere in Europe. German investigators identified a former Ukrainian bricklayer and an untrained Romanian woman as the suspected operatives surveilling Stefan Thumann, head of Bavarian drone maker Donaustahl. German intelligence later classified the case as a suspected planned assassination.

Ukrainian authorities have reported similar recruitment at home. The SBU said an FSB-directed foreign pair killed Colonel Ivan Voronych in Kyiv in July 2025. Both suspects later died in a shootout with law enforcement.

Ukrainian police say Russian recruitment can escalate from surveillance and simple deliveries to arson, terrorism, and murder. Since the start of 2026, police and the SBU have registered 31 terrorist attacks and prevented another 14.

Newly analyzed airport camera footage shows a quadcopter drone loaded with Semtex explosive flew straight at a parked Ukrainian An-124 Ruslan cargo aircraft and struck its wing at Leipzig/Halle airport in Germany on the evening of 4 August, the media outlet Die Zeit reported on 10 August. The device bounced off the wing, fell to the ground, and failed to detonate. The drone attacked the aircraft at around 19:30 local time, the media outlet reports.

Russia's hybrid attacks are increasingly moving from the information domain into the physical one, including on the territory of other countries. This incident makes sabotage on NATO member states' territory potentially more dangerous if suspicion of Russian involvement is confirmed.

Footage contradicts the warning-shot theory

The drone struck the wing near the fuel tanks, then bounced off the aircraft's surface and fell to the ground. The explosive device also ended up on the ground and did not detonate. The device contained Semtex plastic explosive. Approximately four hours later, a tourist bus driver accidentally noticed it lying on the ground, put his foot on it, and reported the find to airport security.

Video analysis contradicts the earlier theory that the incident may have been intended only as a warning. The nature of the attack indicates an attempt to cause actual damage.

Investigators examining foreign state involvement

German Interior Minister Alexander Dobrindt suggested that a state actor may have been behind the explosive-laden drone found at the airport. On 7 August, Germany's National Security Council convened under Chancellor Friedrich Merz. Earlier, the United States assessed that the drone discovered at Leipzig/Halle Airport in Germany overnight into 5 August belonged to Russian intelligence, a US Department of Defense official in Europe told CNN.

The cargo aboard the Ukrainian aircraft targeted in the sabotage attempt consisted of military equipment and ammunition that had arrived in Germany from France and was being prepared for further transportation, Süddeutsche Zeitung stated, citing a confidential German police report. However, Germany's Federal Ministry of the Interior denied this claim, according to dpa.

The An-124 Ruslan, struck by the drone, is operated by the Ukrainian company Antonov Airlines. After Russian forces destroyed its main base in Hostomel in 2022, the company has been using Leipzig/Halle airport as a temporary base for its aircraft.