Finland shut more than 2,000 people into a rock-hewn shelter that is normally a sports hall in Kuopio on 2 September, with some remaining overnight to practice operating the facility, the Associated Press reported. The two-day exercise, Shelter 2026, was the largest civil defense drill in Europe since World War II, by AP's account. Its scenario had cyberattacks cutting power and water while the threat of Russian missile strikes grew.

What two hours underground exposed

Three colleges got the alarm at 11:30 on 2 September, and students had about half an hour to reach the shelter, called Luola, or the Cave, Yle reported that evening. Staff barred the doors behind them. Partitions divided the sports hall into rooms of about 200 people. There were not enough beds, so people rested in shifts, and 60 dry toilets served everyone. The internet worked poorly, and the air grew heavy after an hour. The site holds up to 7,000 people under emergency law.

Antti Haataja, preparedness chief at the North Savo Rescue Department, said the move underground went calmly and faster than he expected. A real emergency would put those inside to work, he added, including emptying the toilets. More than a hundred people stayed through the night into 3 September, Yle said, while AP described hundreds sleeping on trestle beds.

Explore further

Finland ends nuclear weapons ban as parliament approves major NATO-aligned defense shift

Finland is reading Ukraine's experience

Retired Finnish Army Colonel Asko Muhonen, who organized the drill, said Finland has to learn from Ukraine, where people sometimes have only minutes to reach a metro station. What matters is cover they can actually get to, not a shelter that survives a nuclear blast. Ukraine's parliament is advancing a Finnish-style bill that would put one within 10 minutes of everyone.

Dmytro Untila, 20, a Ukrainian student in Kuopio, was at home in Odesa when Russian missiles hit the city on 24 February 2022, and waited the strike out in his building's entrance hall, having nowhere better to go. Training like this would have helped in Ukraine, he said, "because nobody knew this could happen."

The pressure Finland and its neighbors are drilling against

Finland shares more than 1,300 km of border with Russia and joined NATO with Sweden after the full-scale invasion of Ukraine. Shelters answer only part of the pressure. Russia is running a campaign of sabotage across Europe, Western officials say, a Russian aircraft is suspected of having entered Finnish airspace on 20 August, and US intelligence has warned that Poland and the Baltic states may face wider Russian hybrid attacks for backing Kyiv.

EU foreign ministers have given broad backing to an entry ban on Russians who fought in Ukraine and to stricter tourist visa rules for Russian citizens, DW reported. The bloc's foreign policy chief announced that support on 2 September, after an informal meeting in Wicklow, Ireland, without setting out what the tightening would involve. She tied the visa question to the risk of sabotage in Europe.

"Broad support," and nothing pinned down

EU foreign policy chief Kaja Kallas spoke to reporters after the ministers finished. 

"There was broad support for moving ahead with a ban on entry to the EU for Russian ex-combatants and tougher visa restrictions for Russian tourists," she said.

She did not name the restrictions planned for Russian tourists, say when they might take effect, or say which categories of Russian citizens they would cover.

The bloc has no unified position on tightening visa rules further, Kallas acknowledged. Some member states have so far argued against additional steps in that direction, she said.

Explore further

Russia’s former soldiers may face a locked EU border—if France and Italy stop balking

Many EU countries say tourist visas serve sabotage preparation

Reporters asked Kallas about accounts that one suspect in the Leipzig attack may have entered the EU on a tourist visa issued by Italy. German authorities have to confirm or refute those accounts, she said. If the information is correct, it shows that visas can be used to enter the bloc by potential wrongdoers who intend to harm it, she added. Many EU countries pointed out that tourist visas are used in preparing sabotage, because the people who carry it out need to get onto EU territory, she said.

Explore further

Russia’s ex-combatants entering the EU is a risk flagged in a leaked threat assessment

"It is not normal": Russians in Europe while Russia bombs Ukraine

Many ministers raised the visa question while the meeting was discussing Russia's war against Ukraine, Kallas said.

"It is not normal when a country bombs Ukraine, kills civilians—in July and August more than ever during this war—and at the same time Russians enter and enjoy the hospitality of European countries. That should not be," she said.

EU representatives said in July that the ban, kept separate from the tourist visa rules, was agreed in principle but still needed an evidence standard for refusing entry. The EU Council signs off after that, and the European Commission hoped at the time to finish by October.

Estonia is automatically diverting emails using Russia’s .ru internet domain into quarantine for additional security checks before they reach state institutions connected to the country’s secure government network, Justice and Digital Affairs Minister Liisa Pakosta told Estonia's public broadcaster ERR.

The measure is intended to protect Estonian government computer systems amid a post-2022 surge in cyberattacks that officials link to Russia. It applies only to institutions operating inside the secure state network, leaving local governments and some state bodies outside.

Many Estonian residents, particularly Russian speakers, still use .ru email services, ERR noted. Because the filter is triggered solely by the address ending, legitimate messages will be screened alongside potentially malicious ones and may take longer to arrive.

Pakosta said the safeguard was necessary because cyberattacks against Estonia had increased “exponentially” since 2022 and that many were linked to Russia. She said such attacks had not succeeded against Estonia, while major public-sector cyberattacks had succeeded in both Latvia and Lithuania.

The rerouting is automatic and handled centrally, so agencies do not need to take any action, Pakosta said. A large proportion of state institutions have already moved behind the government’s unified cyber shield, while the transition continues.

Pakosta described the quarantine as one small measure within Estonia’s wider cybersecurity work. Estonia’s courts have gone further, saying they will ask parties in legal proceedings to stop using .ru addresses for official communication, according to ERR.

How the Baltic states are hardening against Russia

Estonia's email quarantine forms part of a broader Baltic effort to limit Russian influence and strengthen defenses against military, cyber, and covert threats.

Estonia, Latvia, and Lithuania are constructing a Baltic Defense Line, a planned network of bunkers, anti-tank ditches, and other barriers, along their borders with Russia and Belarus. Latvia has also banned imports of Russian and Belarusian books, clothing, toys, and other goods.

The threat extends beyond cyberattacks: an Estonian court found that Russia’s military intelligence agency, the GRU, ordered the 2024 firebombing of a Ukrainian restaurant in Tallinn, part of a wider Russian sabotage campaign targeting European supporters of Ukraine.

A fire at a Polish plant that makes drone parts for Ukraine's and Poland's militaries is being investigated as possible sabotage by a foreign intelligence service, Militarnyi reported. Poland's National Prosecutor's Office opened the case on two counts: foreign-intelligence activity against the country and a terrorist offense.

Fires and break-ins like this fit a widening pattern — the factories and supply lines that keep Ukraine armed are increasingly targets far from the front line. Across the continent, prosecutors keep opening the same kind of arson case against plants tied to Ukraine's defense.

A masked intruder and a two-hour fire

The fire started shortly after midnight on 31 August in the assembly hall of the WB Electronics plant in Skarżysko-Kamienna and spread to the storage rooms. Five crews put it out in under two hours. No one was hurt, but the storage rooms were destroyed, leaving at least 15 million zloty ($4 million) in damage. The plant had no permanent guards on site; a security company monitoring it remotely reported the fire.

Prosecutors say the blaze was set deliberately with a planted charge of flammable material, and no one has been charged. Security cameras recorded a masked person who climbed a fence and got onto the site.

Why Poland is looking at Moscow

Czesław Mroczek, deputy head of Poland's Interior Ministry, told RMF FM radio that many signs point to arson, and that a Russian trail is the obvious inference. An attack on the defense industry can suggest Russian involvement, he said, since European states have faced sabotage for years while backing Ukraine. Mroczek said protection plans for key defense plants must be richer than what this site had. No one has been detained, and investigators are still tracing how the intruder got in and who may have ordered it.

Explore further

After CIA head’s visit to Moscow, Poland’s PM warns Russia is preparing to escalate war. He puts critical window at seven or eight months

What the plant actually makes

WB Electronics is the core of WB Group, Poland's biggest private arms holding, whose firms build reconnaissance and strike drones such as the FlyEye and the Warmate. The Skarżysko-Kamienna site itself makes drone components for unmanned systems, used by both Polish and Ukrainian forces. Ukraine received FlyEye drones back in 2022 under its Army of Drones program, and in 2025 WB Group launched drone production inside Ukraine.

An explosives-laden drone aimed at a Ukrainian cargo aircraft at Leipzig/Halle Airport was part of a Russian state operation, Interior Minister Alexander Dobrindt said on 1 September.

Germany has moved from suspecting foreign sabotage to formally blaming Russia for the Leipzig attack. The finding has prompted diplomatic and security measures against Moscow while the criminal investigation continues.

Police investigations, the attack pattern, and intelligence findings established Russian responsibility, Dobrindt said. The drones' configuration, components, explosives, and detonation systems resembled those used in other Russian hybrid operations—covert sabotage and disruption below the threshold of open war—and in Russia's war against Ukraine, Foreign Minister Johann Wadephul said.

The first drone, carrying explosives, was found near a Ukrainian cargo aircraft on the evening of 4 August and defused. Investigators believe a DHL freighter may have collided with a second drone while aborting its landing after the airport closed; that drone was never recovered. A third drone was found on 14 August in a field at Kabelsketal, where investigators subsequently discovered roughly 50 grams of suspected military explosive.

Leipzig/Halle is an international freight hub used by Ukrainian Antonov aircraft and NATO's strategic airlift program, through which allies charter heavy transport aircraft to move oversized military cargo.

Berlin will close the Bonn consulate on 18 September, end the operating agreement for the Russian House, a Moscow-backed cultural center, tighten entry controls for Russian nationals, seek to add more targets to EU sanctions lists, and pressure Russia's shadow fleet—opaquely owned tankers used to move Russian oil outside Western restrictions. Wadephul also summoned the Russian ambassador. Russia's Berlin embassy will remain open.

Russian Foreign Ministry spokesperson Maria Zakharova told Interfax that Moscow would respond to Germany's “anti-Russian action,” without specifying how.

NATO Secretary General Mark Rutte said the alliance stood in full solidarity with Germany, and European Commission President Ursula von der Leyen described Berlin's measures as a strong response.

Dobrindt said Germany expects further Russian hybrid attacks. The Leipzig incident follows a widening campaign of suspected Russian sabotage across Europe, including a 2024 incendiary-device attack at the same airport that Western security officials suspected Russian intelligence organized.

How the Leipzig attack unfolded

Euromaidan Press reported on 12 August, citing Die Zeit, that footage showed an explosives-laden quadcopter striking the wing of a parked Ukrainian Antonov An-124 before falling without detonating. The article also noted that a US Defense Department official told CNN that Washington assessed the drone belonged to Russian intelligence.

On 25 August, EP reported, citing Tagesschau’s NDR/WDR/SZ investigation, that investigators had expanded the case to three drones and found the third with suspected military explosive nearby in Kabelsketal, 10 days after the original attempt.

Wolfgang Kubicki, chair of Germany’s pro-business liberal Free Democratic Party (FDP), proposed that Berlin summon Russia’s ambassador and use the prospect of Taurus missiles for Ukraine as leverage against further hybrid attacks during an appearance on German broadcaster ntv.

Kubicki’s proposal does not change German policy. The FDP has no seats in the Bundestag, Germany’s federal parliament, while Chancellor Friedrich Merz has ruled out supplying the missiles. However, it recasts military aid to Ukraine as a potential cost Moscow would face for hybrid attacks inside Germany. Berlin has since formally blamed Russia for the Leipzig/Halle operation that prompted his remarks.

Kubicki said “a reasonable person” would tell the ambassador that Germany had so far withheld Taurus missiles. If the hybrid threat continued, Berlin should do everything possible to ensure Ukraine received the weapons it needed to defend itself against Russia, he added.

Taurus, the weapon Kubicki spoke about, is a German-Swedish cruise missile launched from military aircraft, with a range exceeding 500 kilometers. Ukraine has sought it for years to strike military targets far behind Russian lines.

Germany refused to supply Taurus missiles in 2025 while funding hundreds of Ukrainian-made long-range systems. Merz again ruled out a transfer in March, arguing that Ukrainian weapons were more effective.

Leipzig sharpens Germany’s hybrid-war debate

Germany formally blamed Russia on 1 September for the attempted drone attack at Leipzig/Halle Airport and said it would close the Russian consulate in Bonn and terminate the agreement under which the Russian House cultural center operates in Berlin, DW reported. Interior Minister Alexander Dobrindt cited evidence from German and allied intelligence services, as well as investigations across Europe. Russia has denied involvement.

The operation that prompted Kubicki’s warning involved an explosives-laden drone that struck the wing of a Ukrainian Antonov An-124 heavy cargo aircraft on the evening of 4 August but failed to detonate, Die Zeit reported. The airport handles civilian freight and NATO logistics, while Ukraine’s Antonov Airlines uses it as a base.

Investigators later found evidence that three drones were involved and discovered about 50 grams of suspected military explosive near the runways.

In Lithuania, a photograph of a company executive with a black mourning ribbon was placed next to funeral wreaths, and similar objects turned up near a Czech defense company, Delfi reported on 30 August. Law enforcement officials are investigating whether the two incidents are connected.

Russia is trying to obstruct the defense assistance that NATO countries provide to Ukraine. To this end, Russia uses various forms of intimidation: exerting political pressure, carrying out cyberattacks, and recruiting people to conduct sabotage against foreign defense companies. Russia is suspected of using a new form of psychological pressure against the executives of companies that supply aid to Ukraine: through the use of elements symbolically associated with death.

Wreaths outside a Vilnius drone maker, and a suspect in custody

In Vilnius, funeral wreaths were left near the offices of RSI Europe, a company that manufactures unmanned systems and supplies Ukraine with FPV drones and remote detonation systems. Next to the wreaths, unknown individuals placed a photograph of company head Tomas Milašauskas, tied with a black mourning ribbon. Milašauskas is alive and well.

"We are not afraid. This is ordinary intimidation, a provocation, the usual methods of Russians' work. Our reaction is absolutely normal—we continue to work, we do not react and do not get distracted, because their goal is to distract our attention and direct it where it should not go," Milašauskas told LNK Žinios, as relayed by Delfi.

Milašauskas said that this was the first time RSI Europe had faced such a provocation. But the company had previously faced attempts to interfere with its operations, including cyberattacks.

A similar incident occurred in Czechia at almost the same time. Funeral wreaths also appeared near the offices of Czech defense group CSG, which makes ammunition and military equipment. A photograph of CSG executive director David Chour was placed nearby, Delfi reported.

Lithuanian police have already detained one suspect and launched a pre-trial investigation. National Crisis Management Centre head Vilmantas Vitkauskas said he believed the monitoring and the measures taken after earlier talks with defense firms made the detention possible. The detainee is a Ukrainian citizen, LNK's sources said. Preliminary information suggests that he may have been hired to deliver the wreaths, while the person who ordered them may have been a Belarusian citizen.

“This is probably only the beginning”

Lithuanian officials are treating the use of mourning symbols against defense companies as a possible provocation linked to Russian intelligence, after warning the sector to expect such attempts. Remigijus Motuzas, chairman of the Lithuanian parliament's Foreign Affairs Committee, said:

"I think that such cases may become more frequent—and they have already become more frequent. This is probably only the beginning," he said.

He said the warnings are serious enough to require particular vigilance, although security at infrastructure facilities in the country has already been strengthened.

The Lithuanian authorities are also paying particular attention to the fact that photographs and videos of the wreaths quickly spread on social media and Telegram channels following the incidents. Posts accompanying the material promoted claims that NATO is allegedly fighting Russia with Ukraine’s hands, while European companies assisting Kyiv are supposedly making money from the war. Lithuanian officials consider this information component characteristic of information operations by Russian intelligence services.

Slovak police foiled a planned arson attack on a drone factory in the country's east, the force said on 25 August. Investigators charged three foreigners with preparing the attack on commission and seized incendiary material and equipment at the scene. The plant belongs to the Ukrainian drone maker Skyeton, Militarnyi reported.

Had the attack in Slovakia gone ahead, it risked a large fire, danger to life and health, and damage on a large scale, police stated. About 70 employees could have been in the building at the time, by preliminary estimates. Property inside the production hall is worth tens of millions of euros, according to the findings so far.

Officers seized a larger quantity of incendiary mixture, along with tools, mobile phones, an action camera, and a hand-made plan. The police Criminalistics and Expertise Institute gave a preliminary finding that the substance was a mixture of gasoline and polystyrene, commonly called napalm. Slovakia's anti-crime unit ÚBOK, part of the Police Presidium, identified the people preparing the attack and stopped it. Nobody was hurt and no property was damaged, police said.

The charges, and where the three were detained

An ÚBOK investigator charged the three foreigners with preparing a particularly serious crime of general endangerment, committed as co-perpetrators on order. Officers detained two of them in Slovakia, and the investigator moved to have both taken into custody. German authorities detained the third on a European arrest warrant. The investigation continues, and the legal classification of the men's actions may still change.

Explore further

About 50 grams of suspected military explosive lay in a German field 10 days after the attempt on Ukraine’s plane

The plant, and a company Russia has already hit

Slovakia, a NATO and EU member, borders Ukraine on its eastern edge. Skyeton builds the Raybird, a fixed-wing reconnaissance drone that has served with Ukraine's Armed Forces since 2018 and stays airborne for up to 28 hours. The company began production in Slovakia in 2024, and more than €10 million in foreign investment went into the plant, one of several sites Ukrainian firms opened abroad to cut the risk of Russian attacks.

That risk is not theoretical. Russia destroyed Skyeton's Kyiv office in May, and the company said it had already spread production capacity across Ukraine and abroad in anticipation.

A Skyeton representative told Militarnyi:

"The recent attempt on our production in Slovakia is another sign that Ukrainian arms makers are already a bone in their throat, which means we are on the right path." 

2024

WSJ: Russian sabotage groups suspected for arson attack on plant producing air defense systems for Ukraine

Arson against Ukraine's defense partners in Europe

Companies working for Ukraine have been hit across several countries this year and earlier. 

In March, suspects who claimed a pro-Palestinian motive set fire to the Pardubice production of Archer, a Ukrainian maker of thermal imaging sights, destroying nearly all of the company's capacity in Czechia.

Estonia opened a Russian-link investigation this month into a suspected arson at a military robot maker supplying Ukraine, and Lithuania charged six people in January over an attempt to burn a factory that supplied radio-wave scanners. 

A powerful explosion of undetermined cause hit EMCO, one of Bulgaria's largest private arms makers, which produces artillery ammunition for Ukraine, on 10 August.

German investigators now count three drones around the failed 4–5 August attack on a Ukrainian cargo plane at Leipzig airport, Tagesschau reported on 25 August. Officers found the third machine and a suspected military explosive in a field near the runways. Security circles assume Russian intelligence services helped plan the attempt, and Russia denies any role.

A third drone and about 50 grams of suspected hexogen

Investigators found the third drone on the early evening of 14 August in a field in Kabelsketal, security circles told NDR, WDR, and the newspaper Süddeutsche Zeitung (SZ). The area borders the airport's western edge in Saxony-Anhalt. Forensic technicians from Germany's Federal Criminal Police Office (BKA) arrived that day, and the next day they reportedly found a substance at the site. First assessments put it at about 50 grams of hexogen, a military explosive known internationally as RDX. The perpetrators may have had a far larger attack in mind than what has become public, according to Tagesschau. 

The target was a Ukrainian plane

The drone found on the tarmac was meant to hit a Ukrainian Antonov cargo aircraft that moves military goods, according to the investigation cited by the public broadcasters NDR and WDR and SZ. The bomb never went off, because its detonator was apparently defective. The plane had been apparently loaded with ammunition the previous day. Leipzig/Halle carries military freight for the German armed forces and NATO allies, and Ukraine's Antonov Airlines uses it as a base, Euronews reported the same day.

Explore further

A bomb-laden drone hit a Ukrainian An-124 in Germany, then lay unnoticed for hours

The first drone turned up on the airport grounds at around 23:42 on 4 August. Shortly afterward, at about 00:03, a second drone reportedly collided with a cargo plane of the delivery company DHL. That aircraft had broken off its landing because the first find shut the airport, and it probably hit the drone at fence height at several hundred kilometers per hour. Neither that drone nor parts of it have turned up, NDR, WDR, and SZ reported. The German broadcasters placed the damage on the tail unit, while Bild gave a different account, putting the collision about six kilometers out with minor damage to the nose, Euronews said.

Camera footage analyzed after the attempt showed a quadcopter carrying Semtex plastic explosive fly into the wing of a parked An-124 Ruslan without detonating, and Washington assessed that the drone belonged to Russian intelligence. The same airport saw a parcel ignite in July 2024, before crews could load it onto a DHL cargo plane, in what security services treated as a suspected Moscow-linked arson plot.

State-protection officers at the BKA work under orders from Federal Prosecutor General Jens Rommel to establish how the attack was meant to run and who is responsible. Investigators are following several leads, among them recovered DNA. Germany ranks among Ukraine's biggest military backers, and its authorities suspect Russia of orchestrating many of the drone incidents as part of a campaign of sabotage, espionage, and disinformation, Euronews said.

Polish officers have detained a Ukrainian accused of trying to murder a figure from Ukraine's weapons sector on Moscow's orders, Reuters reported. Investigators say his homemade explosive failed to detonate, and he fled to Poland, where officers detained him. The case is the latest in a run of Russian-directed plots targeting people tied to Ukraine across Europe.

A car bomb that failed

The suspect, named only as Serhii P. under Polish privacy rules, allegedly went after a figure in Ukraine's weapons sector in Irpin, a town in Kyiv Oblast just northwest of the capital. The ABW, Poland's Internal Security Agency, said he planted an improvised explosive device under a car used by the potential victim. The device was meant to be set off remotely with a cellphone, but it "did not detonate due to a malfunction," the agency said.

The suspect, a 63-year-old Ukrainian, fled to Poland after the attempt collapsed and was arrested in Warsaw on 5 August 2026, the Ukrainian outlet NV says. Polish authorities announced the arrest on 20 August and said it kept him from using Poland as a hideout while he dodged investigators. Prosecutors charged him with trying to kill with a bomb and with holding explosives without a permit. The charges carry a floor of 15 years behind bars and a ceiling of life, they said.

Explore further

Ukraine detains organizer of defense industry event struck by Russian missile that killed 10, charged with negligence

The ABW framed the case as proof that Russian intelligence runs operations far beyond its own borders, using people who move between countries to do the work. For years, Kyiv and Western capitals have said Moscow enlists people — Ukrainians among them — to run sabotage and spying missions, a charge Russia keeps rejecting.

A pattern across Europe

The plot fits a wider Russian campaign. Weeks earlier, Warsaw detained a Russian man whom Moscow had allegedly recruited to murder a Ukrainian-American in the same city. 

Earlier this year, Ukrainian investigators recently exposed a coordinated scheme to kill a Russian dissident and Ukraine supporter in Lithuania, German prosecutors filed sabotage charges against a Ukrainian and a Latvian, and an earlier plot targeted the chief of German arms-maker Rheinmetall.

Poland and the Baltic States have been named prime targets for Russian sabotage over their backing for Kyiv.

Croatian police arrested a Ukrainian diver in Pula on 19 August 2026 over his alleged role in the 2022 Nord Stream pipeline explosions, Croatian broadcaster HRT reported. German prosecutors confirmed to AP that the suspect was Volodymyr Zhuravlov (Zhuravliov in Ukrainian official transliteration). Legal Tribune Online reported that he was detained on the set of Zmiinyi (Snake) Island.

The arrest gives German prosecutors a third chance to secure Zhuravliov after two attempts in Poland failed. If Croatia extradites him, he would become the second suspected member of the alleged team to face proceedings in Germany. Berlin has pursued other suspects in the Nord Stream case across Europe, but the identity of the person who ordered the sabotage remains unknown.

Previous arrests and arrest attempts

Germany’s Federal Public Prosecutor’s Office said Zhuravliov was a trained scuba diver who took part in the dives needed to place explosives on Nord Stream 1 and 2 near Denmark’s Bornholm island. Prosecutors say the group sailed from Rostock aboard a yacht that middlemen rented from a German company using forged identity documents.

The 2024 European arrest warrant accuses Zhuravliov of jointly causing an explosion, anti-constitutional sabotage, and destroying structures. He would appear before an investigating judge at Germany’s Federal Court of Justice following extradition, prosecutors said. A Croatian court must first approve his surrender.

LTO reported that investigators first sought Zhuravliov’s arrest in Poland in the summer of 2024, but he crossed into Ukraine before police detained him. Polish police arrested him near Warsaw in autumn 2025. However, a court rejected Germany’s extradition request after finding that the pipelines could be treated as a legitimate military target during an armed conflict. Zhuravliov has denied involvement.

His lawyer, Tymoteusz Paprocki, told AP that Zhuravliov understood the Polish ruling applied only within Poland.

Another Ukrainian suspect, Serhii K., was arrested near Rimini in August 2025 and extradited to Germany that November after unsuccessful appeals. Prosecutors allege he coordinated the operation rather than joining the dives. They charged him in Hamburg in June 2026.

What was Nord Stream?

Nord Stream 1 and 2 ran beneath the Baltic Sea, carrying—or designed to carry—Russian gas directly to Germany while bypassing Ukraine. Explosions on 26 September 2022 damaged three of their four lines at a depth of about 80 meters.

No court has established who ordered the attack. Ukraine’s Prosecutor General’s Office says no facts demonstrate Ukrainian state involvement and is examining whether Russia staged a false-flag operation using Ukrainians. LTO reported that Germany’s Federal Court of Justice found strong grounds in December 2025 to believe that a state had initiated and directed the sabotage, but did not identify which state.

A deliberately set fire at a Tallinn building used by Milrem Robotics did not disrupt its deliveries of military ground robots to Ukraine, CEO Kuldar Väärsi told Reuters on 19 August 2026. Estonian prosecutors said three suspects had been detained in Latvia.

The Milrem arson case fits in a broader pattern of suspected or confirmed sabotage against Ukraine’s military supply chain. Similar attacks throughout Europe have hit plants making drones, thermal optics, and other equipment for the front. Milrem supplies unmanned ground vehicles (UGVs) that help Ukrainian units move supplies and evacuate wounded without putting drawing upon valuable manpower.

The fire broke out overnight on 15 August in Tallinn’s Lasnamäe district after a resident reported suspicious activity. Nobody was injured, and Milrem has not disclosed what was damaged.

Milrem says it is one of only two foreign suppliers with unmanned ground vehicle (UGV) fleets in active Ukrainian service and expects more than 200 of its systems to be operating there by year-end.

The Netherlands is funding more than 150 additional Milrem vehicles for Ukraine. In June, Milrem and VDL Defentec opened a Dutch production line to support the delivery of more than 100 THeMIS UGVs. Väärsi the fire had not affected production, supply chains, or delivery schedules for this year or next.

Unmanned ground vehicles (UGVs) are tracked or wheeled machines with no crew aboard. ArmyInform reported that Ukrainian troops use them to carry ammunition, fuel, and food along exposed routes. A Ukrainian commander identified only as Nazar told ArmyInform that frontline units still rely mainly on UGVs for logistics, although some robots carry explosives.

Three suspects detained as investigators examine possible Russian role

State Prosecutor Gardi Anderson said prosecutors suspect all three detainees of taking part in the arson. Latvian authorities are holding them while the two countries arrange their transfer to Estonia. An Estonian court approved prosecutors’ requests to place two in pretrial detention. A decision on the third remained pending.

Estonian Prime Minister Kristen Michal said investigators were examining whether the fire was the result of sabotage and whether Russia was involved. Authorities have not disclosed the suspects’ alleged motive, whether anyone directed them, or released evidence connecting the attack to Moscow.

Arson has hit other European suppliers to Ukraine

In March, a fire destroyed nearly all of the production capacity at a Czech plant that makes drones and thermal optics for Ukraine. Authorities detained four suspects while investigating possible terrorism and Russian involvement.

Lithuania also charged six people over an attempt to burn a factory supplying radio-wave scanners to Ukraine. Investigators said Russia-based organizers with GRU links coordinated the operation and connected the network to attempted attacks elsewhere in Europe.

Russia has denied Western accusations that it conducts sabotage in Europe.

Estonia is investigating whether Russia was behind a suspected arson attack at a Tallinn building used by Milrem Robotics, Prime Minister Kristen Michal said on 18 August.

Officials have not released evidence yet connecting Moscow to the fire.

The fire hit a site used by a defense contractor that makes unmanned ground vehicles, including THeMIS vehicles used in Ukraine. The Estonian investigation into the Milrem fire comes amid suspected or confirmed arson plots against other European factories supplying Ukraine.

Estonian prosecutors said the fire, which began overnight into 15 August, may have been deliberately set. A resident reported suspicious activity nearby. Investigators identified suspects and asked a court to detain them. No one was injured, and Milrem CEO Kuldar Väärsi told the Estonian outlet Postimees that it was too early to assess the damage.

The company executive said the site was not an office building but declined to identify its contents or what was damaged, including whether unmanned ground vehicles were inside. The company has not said whether production or deliveries were affected.

Milrem’s THeMIS vehicles have operated in Ukraine since 2022. By 2023, the company had delivered 15 of the vehicles to Ukrainian forces and border guards. A Dutch-funded order for more than 150 additional vehicles followed in 2025. A new Dutch production line began making them in June 2026 and handed over its first vehicles for Ukraine.

Other factories supplying Ukraine have faced arson

In March, a fire damaged a Czech facility belonging to LPP Holding, which had supplied hundreds of AI-guided drones to Ukraine. Czech authorities investigated possible terrorism and later detained a fourth suspect.

In January, Lithuania charged six people over an attempt to burn a factory supplying radio-wave scanners to Ukraine. Investigators said Russia-based organizers with GRU links coordinated the operation and connected the network to attempted attacks elsewhere in Europe.

Estonia has traced earlier attacks to Russian intelligence

Estonia has also uncovered Russian-directed attacks on its own territory. In 2024, Estonia’s security service detained 10 people over a Russian-coordinated operation that included damaging cars belonging to then-Interior Minister Lauri Läänemets and a journalist and defacing monuments. Officials said the operation sought to spread fear and tension. Journalists from The Insider, Re:Baltica, and Delfi reported how the GRU recruited Baltic residents for vandalism and arson.

In 2025, an Estonian court found that a Moldovan national working for the GRU burned a supermarket as a trial run before firebombing a Ukrainian restaurant in Tallinn. His cousin filmed the second attack.

Those cases explain why investigators are examining a possible Russian role in the Milrem fire, but they do not establish who caused it.

Ukraine has opened its own criminal investigation into the 2022 destruction of the Nord Stream gas pipelines, months after Germany charged a Ukrainian over the blasts, Suspilne reported. Prosecutors in Kyiv registered the case on war-crimes grounds and say they will test whether Russia staged the sabotage to discredit Ukraine. Serhii Kuznietsov is due to stand trial in Germany in October.

Kyiv will test a Russian false-flag version

Ukraine's Security Service, under the Prosecutor General's Office, opened proceedings on 9 July under the article on violations of the laws and customs of war. Kuznietsov's Ukrainian lawyer, Mykola Katerynchuk, told Suspilne about the case.

The Prosecutor General's Office confirmed it is supervising a probe into the "possible commission in September 2022, amid the international armed conflict between Russia and Ukraine, by citizens of Ukraine, of actions connected to the undermining" of both pipelines in the Baltic Sea. It said the case was registered after the "independent discovery in the media" that Germany had charged a Ukrainian citizen.

Given Russia's use of hybrid methods, investigators will also examine whether Russians organized the explosions as a "false flag" operation, using Ukrainian citizens or imitating their participation to discredit Ukraine.

The office said it used the laws-and-customs-of-war charge because it matches the qualification chosen by Germany's Federal Prosecutor's Office.

Explore further

Russia laid Nord Stream to bypass Ukraine amid preparations for war. Four years after it exploded, Kyiv says it had nothing to do with blasts

The case against Serhii Kuznietsov

The pipelines exploded on 26 September 2022. On 8 August 2025, Germany's Federal Court of Justice issued an arrest warrant for Kuznietsov, alleging he led a group of six who mined the pipelines and detonated them remotely.

Italian police arrested him on 21 August 2025, and Italy's Supreme Court later confirmed his extradition to Germany. A Polish court, by contrast, refused a German request for another Ukrainian suspect, Volodymyr Zhuravlov.

On 2 July 2026, Germany's Federal Prosecutor's Office published its charges — an attack on civilian objects, causing an explosion, and destroying structures. Kuznietsov denies guilt.

A Kyiv court has sentenced an unemployed man to 15 years in prison with confiscation of his property for carrying out arson attacks on behalf of Russian intelligence, Ukraine's Security Service (SBU) said on 13 August. The man was recruited while looking for "easy money" on Telegram channels and carried out two arson attacks in Kyiv before fleeing to Odesa, the SBU reported.

Russian intelligence increasingly recruits Ukrainians through Telegram for arson and sabotage. It targets people seeking quick money and treats them as disposable operatives, paying small sums for a single task and discarding them once they are caught.

The Russian agent carried out two arson attacks

According to the SBU, the man first set fire to a relay cabinet belonging to a railway signaling system. Russia intended the attack to disrupt freight logistics, including supplies to areas near the front.

The agent later burned a volunteer’s SUV used to deliver humanitarian aid and evacuate civilians from areas affected by Russia’s war. He carried out the attacks at night, using a flammable mixture and filming each incident on his smartphone before sending the footage to his Russian handler.

The SBU arrested him in Odesa in July 2025, where he had attempted to hide after carrying out the attacks. Investigators seized his phone, which contained evidence of his cooperation with Russia.

A court found him guilty on two counts — sabotage committed under martial law, and intentional destruction of property by arson — both carried out as part of a group acting on prior conspiracy. He was sentenced to 15 years in prison with confiscation of his property.

Explore further

From “easy money” to murder: Russia escalates recruitment of Ukrainians for terrorist attacks inside Ukraine, police warn

Easy money, hard time: other Telegram recruits jailed too

The case follows several similar convictions. In a May case, an agent received 15 years for burning a railway relay cabinet near a Dnipro station in an attempt to disrupt frontline logistics. The SBU said the unemployed local, recruited through Telegram, filmed the arson and reported it to his handler, then was caught before he could carry out a planned series of attacks on the city's critical infrastructure.

In June 2026, another agent was sentenced to 15 years for preparing to burn an electrical substation in Kropyvnytskyi.

In July, SBU investigators reported that a GRU agent in Zaporizhzhia received 15 years for preparing explosives for Russian-organized attacks.

On 13 August, the Ukrainian-Crimean Tatar partisan movement ATESH said its agents had disabled a communications tower near Pylna in northern Kharkiv Oblast. The group said the damage disrupted links between two Russian motor rifle regiments near the border.

Pylna lies on the Russian border and was among the villages seized when Moscow opened the northern Kharkiv front in May 2024. The claimed tower attack is part of a wider Ukrainian resistance effort behind Russian lines. Moscow's forces still depend on infrastructure in occupied territory to communicate, move supplies, and hold the line. Ukraine’s underground fighters exploit that dependence from within, targeting communications, transport, and fuel supplies to create problems for Russian units at the front.

ATESH said the tower carried data between Russian command posts and coordinated units in the area. The movement said its loss disrupted command channels and delayed border-zone mobile groups. It did not say how agents disabled the tower or how long the interruption would last.

The partisans stated that the communications between Russia’s 345th and 380th motor rifle regiments were hit hardest. The regiments operate in neighboring sectors and rely on stable links for joint action and rapid responses, according to the group. ATESH claimed their offensive tempo and ability to support each other had fallen.

Neither the claimed ATESH sabotage nor its reported effects have been independently verified.

ATESH attacks on Russian supply lines

The tower claim follows ATESH’s 10 August account of sabotaging an electric locomotive near Voronezh. The group said it carried military supplies toward the Kupiansk front in Kharkiv Oblast. In June, ATESH also said agents damaged power and rail equipment near Russia’s Novomoskovsk Azot plant, whose output feeds explosives production.

ATESH has also reported intelligence work inside Russian forces. In July, the group said an agent reported a Ukrainian strike on five military fuel trucks in occupied Luhansk. Together, the claims describe a campaign against transport, fuel, and communications behind the front.

Ukrainian resistance works behind the front

The claimed tower operation is one part of the Ukrainian resistance behind Russian lines. Underground networks also gather intelligence and sustain civil defiance. 

A Euromaidan Press investigation documented groups planting explosives, tracking Russian positions, distributing leaflets, and painting Ukrainian symbols despite the threat of imprisonment and torture.

ATESH says its network includes Ukrainians, Crimean Tatars, anti-war Russians, and sources inside Russia’s military and occupation administrations. Its claims are often impossible to verify independently. Taken together, they portray a campaign to make Russia’s rear less secure while other groups preserve Ukrainian identity under occupation.

Russia may expand hybrid attacks against Poland and the Baltic states, including infrastructure sabotage or false-flag attacks, Bloomberg reported on 12 August, citing an unnamed European intelligence official. 

The warnings come amid concern that Moscow wants to intimidate Ukraine’s supporters. The CIA warning follows Russian threats, incursions, alleged sabotage plots, and disinformation against Poland and the Baltic states. Most Western military aid reaches Ukraine through Poland, while the Baltic states rank among Kyiv’s strongest supporters. Sabotage of transport, energy, or communications can slow aid delivery and test NATO while hiding Russia’s role.

Separately, a European government official told Bloomberg that the CIA had warned countries in the region of a possible future Russian attack. The CIA declined to comment.

The same official said Russia might instead be creating the impression of an impending attack to sow fear as part of an information operation. The official saw no signs that Moscow was preparing a conventional attack or invasion.

Moscow tests NATO’s eastern flank

Poland and Lithuania had already raised similar concerns. In July, Poland said it had credible intelligence that Russia was planning new provocations. Lithuania later warned that Moscow might rebuild captured Ukrainian drones for false-flag strikes on critical infrastructure.

In September 2025, between 19 and 23 Russian drones entered Polish airspace, shutting down airports and damaging buildings. Poland closed four airports as NATO aircraft responded.

Meanwhile, five people are on trial in Lithuania over attacks allegedly organized for Russian military intelligence in 2024, Bloomberg reported. Lithuania has reinforced infrastructure sites and deployed troops since June.

These warnings and incidents place the CIA alert within a wider pattern of pressure on NATO’s eastern flank and Ukraine’s supporters. 

How Russia strikes without starting a war

Bloomberg cited several recent unexplained drone incidents in Germany alongside the CIA warning. Citing Die Zeit, Euromaidan Press reported that an explosive-laden drone struck the wing of a parked Ukrainian An-124 at Leipzig-Halle airport and failed to detonate. A US Defense Department official in Europe told CNN that Washington assessed the drone belonged to Russian intelligence. 

Bloomberg also reported that a cargo plane hit an unidentified object and that drones appeared over a military base the following day. It did not connect either incident to Russia.

More broadly, Russian hybrid operations have grown sharply since the full-scale invasion. CSIS found that attacks in Europe tripled from 2023 to 2024, after quadrupling the previous year. Separately, the US Helsinki Commission mapped nearly 150 operations in NATO territory attributed to or suspected of Russia between February 2022 and November 2024.

Retired Lt. Gen. Ben Hodges told Euromaidan Press in February that attacks on ports, railways, and cables can probe routes needed for NATO reinforcements. Their deniability raises the political cost of responding.

By hiding its role, Moscow can disrupt support for Ukraine and test NATO without openly starting a war. 

Newly analyzed airport camera footage shows a quadcopter drone loaded with Semtex explosive flew straight at a parked Ukrainian An-124 Ruslan cargo aircraft and struck its wing at Leipzig/Halle airport in Germany on the evening of 4 August, the media outlet Die Zeit reported on 10 August. The device bounced off the wing, fell to the ground, and failed to detonate. The drone attacked the aircraft at around 19:30 local time, the media outlet reports.

Russia's hybrid attacks are increasingly moving from the information domain into the physical one, including on the territory of other countries. This incident makes sabotage on NATO member states' territory potentially more dangerous if suspicion of Russian involvement is confirmed.

Footage contradicts the warning-shot theory

The drone struck the wing near the fuel tanks, then bounced off the aircraft's surface and fell to the ground. The explosive device also ended up on the ground and did not detonate. The device contained Semtex plastic explosive. Approximately four hours later, a tourist bus driver accidentally noticed it lying on the ground, put his foot on it, and reported the find to airport security.

Video analysis contradicts the earlier theory that the incident may have been intended only as a warning. The nature of the attack indicates an attempt to cause actual damage.

Investigators examining foreign state involvement

German Interior Minister Alexander Dobrindt suggested that a state actor may have been behind the explosive-laden drone found at the airport. On 7 August, Germany's National Security Council convened under Chancellor Friedrich Merz. Earlier, the United States assessed that the drone discovered at Leipzig/Halle Airport in Germany overnight into 5 August belonged to Russian intelligence, a US Department of Defense official in Europe told CNN.

The cargo aboard the Ukrainian aircraft targeted in the sabotage attempt consisted of military equipment and ammunition that had arrived in Germany from France and was being prepared for further transportation, Süddeutsche Zeitung stated, citing a confidential German police report. However, Germany's Federal Ministry of the Interior denied this claim, according to dpa.

The An-124 Ruslan, struck by the drone, is operated by the Ukrainian company Antonov Airlines. After Russian forces destroyed its main base in Hostomel in 2022, the company has been using Leipzig/Halle airport as a temporary base for its aircraft.

Ukrainian partisans say they crippled a locomotive moving Russian military supplies to the front. Agents of the ATESH movement carried out a sabotage operation near Voronezh, destroying the cab of an electric locomotive used to support military transport, ATESH reported.

Disabling a single locomotive cripples the entire supply line. The locomotive was supposed to continue its journey toward the Kupiansk direction, and after the cab was damaged, operating the machine at its former pace became impossible, disrupting the schedule for forming and dispatching the next trains.

The target was a rail supply line to the front

ATESH said the sabotage hit a link in Russia's military logistics chain. The locomotive was part of the rail transport that moves Russian military cargo, and it was bound for the Kupiansk direction, one of the active sectors of the front in Kharkiv Oblast.

Russia depends heavily on railways to supply its forces. Its army moves ammunition, fuel, weapons, and heavy equipment to the front largely by rail, so the locomotives and the lines they run on are critical arteries of its war effort. A partisan network can reach them behind the front lines at a vulnerable point.

One damaged locomotive slows the whole chain

ATESH framed the value of the strike in terms of the cascade it sets off. The loss of even one link in the mainline causes delays in the delivery of ammunition, fuel, weapons, and heavy equipment.

Those delays compound at the front. When rear supply operations are interrupted, units lose combat effectiveness and suffer significant personnel losses, ATESH said, casting a single sabotaged locomotive as a blow that reaches the soldiers, depending on what it was carrying.

The strike fits ATESH's partisan campaign

Euromaidan Press cannot independently verify the Voronezh sabotage, which is ATESH's own account. But rail sabotage is a documented feature of the war behind Russian lines, and the movement's focus on the logistics that feed the front reflects a real vulnerability in an army that runs on rail.

Three men were found guilty on July 8 in connection with an arson attack on Ukraine-linked businesses in London, which British authorities say was orchestrated by Russia's Wagner mercenary group, Reuters reported.

The alleged ringleader, Dylan Earl, 21, had already pleaded guilty to aggravated arson over the 2024 blaze targeting companies that were supplying Elon Musk's Starlink satellite equipment to Ukraine, according to Reuters.

The systems are considered vital to Ukraine's communications and defense against Russia's ongoing invasion.

Earl also became the first person convicted under the U.K.'s National Security Act after admitting to a separate plot to attack a wine shop and restaurant in London’s upscale Mayfair district and to kidnap its owner, a prominent critic of Russian President Vladimir Putin.

Two others, Jake Reeves, 23, and Earl’s associate, also pleaded guilty to aggravated arson, with Reeves admitting to a charge under the National Security Act for receiving a material benefit from a foreign intelligence agency.

A jury at London's Old Bailey court convicted three additional men, Nii Kojo Mensah, 23, Jakeem Rose, 23, and Ugnius Asmena, 20, of aggravated arson. They had denied the charges. A fourth man, Paul English, 61, was acquitted.

Two other defendants, Ashton Evans, 20, and Dmitrijus Paulauskas, 23, were charged with failing to disclose knowledge of terrorist activity. Evans was convicted on one count and cleared of another. Paulauskas was acquitted of both charges and reportedly broke down in tears as the verdict was read.

Commander Dominic Murphy of the London Metropolitan Police reportedly said he was confident the Wagner Group and the Russian state were behind the attacks.

The U.K. has designated the Wagner Group as a terrorist organization.

Earl had exchanged hundreds of encrypted messages with a supposed Wagner handler using the alias "Privet Bot" on Telegram. According to reporting by the Organized Crime and Corruption Reporting Project (OCCRP), the account was previously advertised by Grey Zone, a Wagner-affiliated channel.

Prosecutors said Earl expressed interest in fighting for Wagner and was encouraged to recruit contacts from British soccer hooligan networks, Irish republican groups, and organized crime circles, Reuters reported. He and Evans also admitted to unrelated charges of dealing cocaine.

The Russian Embassy in London has denied any involvement in the warehouse attack and accused the British government of blaming Russia for domestic issues.

The Kremlin has consistently rejected accusations of sabotage and espionage, despite growing evidence and convictions tied to Russian-linked operations across Europe.

‘Neither side wasted time’ — Ukraine’s economy minister on minerals deal negotiations with Trump’s ‘business-oriented’ administration

Ukraine’s Economy Minister Yuliia Svyrydenko says her task is simple — to get the investment fund behind the closely watched minerals deal with the U.S. off the ground, and prove its detractors wrong. “There are so many criticisms from different parties that this fund is just a piece of paper we can put on the shelves — that it won’t be operational,” Svyrydenko, who is also Ukraine’s first deputy prime minister, tells the Kyiv Independent at Ukraine’s Cabinet of Ministers on July 4, the morning

The Kyiv IndependentLiliane Bivings

BRICS summit participants condemned recent attacks on Russia’s railway infrastructure, according to a joint declaration on July 6 from Rio de Janeiro.

"We condemn in the strongest possible terms the attacks on bridges and railway infrastructure deliberately targeting civilians in the Bryansk, Kursk and Voronezh regions of the Russian Federation on May 31, and June 1 and 5 2025, which resulted in the deaths of several civilians, including children," the document says.

Bryansk, Kursk, and Voronezh oblasts are all located near Ukraine’s northeastern border and have played a central role in Russia’s war effort, serving as key logistical hubs and launch sites for missile and drone attacks on Ukrainian cities–often targeting civilian infrastructure and causing casualties.

In their declaration, BRICS leaders also called for a negotiated peace agreement between Russia and Ukraine.

“We recall our national positions concerning the conflict in Ukraine as expressed in the appropriate forum, including the UN Security Council and the UN General Assembly,” the document said. “We expect that current efforts will lead to a sustainable peace settlement.”

The statement comes a few days after a phone call between U.S. President Donald Trump and Russian President Vladimir Putin on July 3, in which Putin said "Russia will continue to pursue its goals" in the war against Ukraine, Kremlin aide Yury Ushakov said.

Russian Foreign Minister Sergey Lavrov attended the summit in person, while Russian President Vladimir Putin participated via video link.

Brazil is a member of the ICC and a signatory to the Rome Statute, meaning it is obliged to arrest Putin if he enters the country.

The ICC issued a warrant for the Russian leader's arrest in March 2023 over the illegal deportation of Ukrainian children during Russia's full-scale invasion of Ukraine.

The BRICS declaration also condemned recent U.S. and Israeli airstrikes on Iranian nuclear facilities as violations of international law and criticized the presence of foreign forces in Syria and Gaza, calling for Israeli withdrawal from Syrian territory.

BRICS, originally composed of Brazil, Russia, India, China, and South Africa, has expanded in recent years to include Iran, Egypt, the UAE, Ethiopia, and Indonesia.

Lavrov meets Iranian counterpart Abbas Araqchi at BRICS summit, reiterates Russia’s offer to mediate disputes over nuclear program

Russia reiterated its offer to mediate the conflict over Iran’s nuclear program during a meeting between Foreign Minister Sergey Lavrov and his Iranian counterpart at the BRICS summit in Rio de Janeiro, Reuters reported on July 6.

The Kyiv IndependentSonya Bandouil

The Atesh partisan group set fire to a signal cabinet that helps control traffic on a railway line near the Russian-occupied city of Yasynuvata in Donetsk Oblast, a route used for Russia's military logistics, the group claimed on Telegram on June 28.

Yasynuvata lies some 22 kilometers (12.5 miles) from the occupied city of Donetsk and is considered to be a major railway junction in the region.

According to the group, the sabotaged section is located near Russian military units, warehouses, and industrial facilities.

Atesh said the attack disrupted the delivery of a train carrying fuel for Russian forces.

"On Ukraine's Constitution Day, we remind the occupiers that this is an independent and free country. And Donetsk will always be Ukrainian," the statement read.

The Kyiv Independent could not verify these claims.

The Atesh partisan group regularly conducts sabotage attacks in Russia and Ukraine's Russian-occupied territories.

In early June, Atesh claimed to have destroyed a signal cabinet on the new Volnovakha-Mariupol railway, which had been recently built by occupying Russian forces.

Ukraine war latest: Ukrainian drones reportedly strike 4 fighter jets in Russia

Key developments on June 27: * Ukraine war latest: Ukrainian drones reportedly strike 4 fighter jets in Russia * North Korea deployed 20% of Kim’s elite ‘personal reserve’ to fight against Ukraine in Russia, Umerov says * Pro-Palestinian activists reportedly destroy military equipment intended for Ukraine * Zelensky signs decree to synchronize Russia sanctions

The Kyiv IndependentThe Kyiv Independent news desk

Ukraine's security service (SBU) is teaching teenagers how to avoid recruitment by Russian intelligence online, the New York Times (NYT) reported on June 21.

"Maybe not all of these special operations are reported in the media — but believe me, the enemy is not sleeping... They are working actively and carrying out illegal activities, as strange as it may sound, directly inside your phones," SBU spokesperson Roksolana Yavorska-Isaienko told students.

Approximately 22% of Ukrainians recruited by Russian intelligence to conduct sabotage or terrorist attacks are minors, Artem Dekhtiarenko, SBU spokesperson, said on April 2.

Russian intelligence attempts to recruit Ukrainian civilians online, offering easy money in return for sharing sensitive data or preparing sabotage or terrorist acts.

Russian intelligence finds its recruits using social platforms, including Telegram, Discord, and TikTok.

Unsuspecting teenagers are often offered hundreds or even thousands of dollars to conduct simpler tasks such as delivering packages or taking photos of energy sites, the NYT reports.

More serious tasks are commonly assigned to teenagers once they have been blackmailed for conducting less serious operations beforehand or when their phones are hacked to reveal compromising photos.

Russian intelligence is actively attempting to recruit Ukrainian nationals for illegal operations across the EU, Ukraine's military intelligence agency (HUR) said on June 2.

"The recruitment of Ukrainians for hostile operations in Europe is yet another tool of hybrid aggression that the Russian Federation is waging against Ukraine and the entire European community," HUR said.

The SBU caught a Russian agent as he was filming a military airfield in preparation for a Russian strike, the agency reported on June 15.

The Russian Federal Security Service (FSB) recruited the unemployed 24-year-old via the Telegram messaging app to collect coordinates for air attacks on airfields and logistic depots, the SBU said.

The Russian FSB allegedly offered "easy money" and instructed the recruit to find military facilities and carry out reconnaissance on the ground.

Love, sex, survival — Ukrainian author on how war shapes intimacy in Ukraine

In Ukraine, Russia’s war of aggression has upended not just borders but the country’s cultural landscape. Conversations about identity, gender, and sexuality have gained new urgency. Women are increasingly stepping into combat roles once dominated by men, while relationships can dissolve as quickly as they form. Many people

The Kyiv IndependentKate Tsurkan

Ukraine’s military intelligence (HUR) ignited an electrical substation during a sabotage operation in the Russian city of Kaliningrad, causing $5 million in damage and cutting electricity to a military production site, a source in HUR told the Kyiv Independent.

In the early hours of June 14, Ukrainian agents drained the coolant from the substation’s power transformer before setting the facility on fire. The inferno inflicted major damage on the facility and caused a power cut, impacting nearby Russian military sites.

"We once again remind you that Russia no longer has a rear either in the east, in the west, or anywhere else on the planet. Everything Russian involved in the war against Ukraine will burn, sink, and be destroyed regardless of its level of protection or location," the source said.

Ukraine continues to carry out numerous secretive attacks within Russia and occupied Ukrainian territories, targeting military sites, like airfields, as well as key infrastructure like railways and oil refineries.

The attacks involve HUR, Ukraine’s Security Service (SBU) as well as partisan and sabotage groups.

HUR was behind explosions near Desantnaya Bay in Russia's far eastern Vladivostok on May 30, which reportedly damaged military personnel and equipment. The operations took place approximately 6,800 kilometres from the Ukrainian border, making it Ukraine's furthest incursion into Russian territory, if confirmed.

On June 1, the SBU launched Operation Spiderweb, a game-changing drone attack on four key Russian military airfields, damaging 41 planes, including heavy bombers and rare A-50 spy planes.

Ukrainian drones destroy Russian air defense systems in occupied Zaporizhzhia Oblast, military intelligence says

Ukraine’s military intelligence (HUR) destroyed three Russian air defense systems using drones in the occupied Zaporizhzhia Oblast on June 14, HUR says.

The Kyiv IndependentVolodymyr Ivanyshyn