Putin's autumn campaign against Europe – a non-exhaustive list of attacks (Part 2)

The first part followed Moscow's shadow war against Europe up to the end of summer. This continuation gathers what happened between August 23 and November 12, in the same structure: first the hybrid front – sabotage, arson, drones and missiles, cyberattacks, espionage cases – in chronological order, then the cognitive front, that is, election interference and disinformation.

By autumn, ships were already sinking and sailors dying in drone attacks on the Black Sea, in Bulgaria's and Romania's economic zones. Across Europe, supermarket refrigeration units were being switched off remotely, and Russian drones flew into the airspace of the Republic of Moldova almost daily. On September 1, Berlin officially held Russia responsible for the August 4 drone attack in Leipzig. On October 20, the Wall Street Journal reported that, according to American intelligence, Putin himself had ordered the escalation of sabotage operations – this incident and its aftermath marked a turning point in the hybrid war. The list below shows just how much of one.

Part I: The hybrid front

August 23 – Italy (Colleferro)

The Velletri prosecutor's office launched proceedings over the August 13 explosion in Colleferro, which occurred at the KNDS Ammo Italia munitions factory; investigators are also examining whether it is linked to the explosion that took place three days earlier, on August 10, at the EMCO munitions plant in Bulgaria. Source here; we wrote about the case on Ugaron here.

August 24–26 – Norway

For three days, a DDoS attack paralyzed the systems of Norway's digitalization agency (Digdir); according to the agency, it had never before been hit by an attack of this scale. A pro-Russian hacker group called Server Killers claimed responsibility and declared "cyberwar" on Norway, in retaliation for Oslo's renewal of its security cooperation with Ukraine on August 23. Services remained largely operational throughout. Source here.

August 25 – Slovakia (near Prešov)

Slovak police thwarted an attempt to set fire to the plant of Skyeton, a Ukrainian drone manufacturer. The incendiary substance was homemade napalm, a mixture of gasoline and polystyrene; around seventy people could have been working in the hall at the time. Two Latvian citizens and one Ukrainian citizen were arrested, one of them in Germany. German investigators later attributed the attempt to the same GRU-linked network behind the Munich arson attack and the Leipzig drone attack. Part of the network operated out of Slovakia. Source here and here.

August 31 – Poland (Skarżysko-Kamienna)

A fire broke out at the WB Electronics plant, which manufactures components for drones used by the Polish and Ukrainian armies. Security cameras recorded a masked figure climbing over the fence; a container of flammable liquid was found at the scene. Prosecutors are investigating on suspicion of a terrorist act carried out on behalf of a foreign intelligence service. The very next day, at the Westerplatte commemoration, Donald Tusk spoke of sabotage. Source here.

September 1 – Germany (Brandenburg and North Rhine-Westphalia)

Two high-voltage substations were damaged within twelve hours. In the morning, the power lines of the Turnow-Preilack substation – which connects the Jänschwalde lignite-fired power plant to the grid – were fired at with homemade, missile-like devices. In the evening, a deliberate short circuit was caused at a substation near Bergheim, which, according to RWE, knocked out five coal-fired units. Investigators are considering both a foreign state commission and a far-left attack – and let us add that the two are essentially the same thing. Source here.

September 1 – Germany (Berlin)

The German government officially held Russia responsible for the August 4 drone attack in Leipzig and ordered the closure of Germany's last remaining Russian consulate general, in Bonn. Foreign Minister Johann Wadephul terminated the lease of the Russian House in Berlin, and entry rules for Russian citizens were tightened. In response, Moscow closed all Goethe Institutes in Russia and the German consulate general in St. Petersburg. On August 25, investigators found a third drone, loaded with explosives, near Leipzig airport. Source here.

September 1 – Estonia, Latvia

Drones flew into Latvian and Estonian airspace. Air-raid alerts were issued in eight Estonian counties, and Turkish F-16s took off from Ämari air base. The same night, Ukrainian drones attacked the Russian oil port of Ust-Luga. According to Recorded Future, these were Russian drones; other sources say Russian electronic jamming diverted Ukrainian drones. Source here.

September 2 – Germany (Munich)

Molotov cocktails were thrown from a car at a construction site in front of the headquarters of defense technology company Rohde & Schwarz, not far from the headquarters of drone maker Helsing. Two Bulgarian nationals were arrested, and bomb disposal experts defused one unexploded bottle. Bavarian police are treating the case as a politically motivated attack. Source here.

September 4–9 – United Kingdom (Swindon)

Counter-terrorism officers arrested and charged 31-year-old Joshua Cammidge. According to the charges, he worked for the "GRU Volunteer Corps," operating under GRU direction: from March to September he sent Google Maps screenshots of four drone manufacturing sites in Swindon, looked into how he could obtain jamming equipment, and offered to carry out the sabotage himself. Source here.

September 8 – Romania

Romania's Directorate for Investigating Organized Crime and Terrorism (DIICOT) detained a 40-year-old Russian man living in Romania, who had been under surveillance by the Romanian intelligence service (SRI) since February. Acting on an intermediary's instructions, the man photographed NATO allies' bases, communication hubs, critical infrastructure, and Ukrainian Antonov cargo planes stationed in Romania, in Bucharest as well as in Cluj, Constanța, Călărași and Ilfov counties. The Russian embassy called the accusations "speculation." On the same day, a Russian drone flew over Romania southeast of Iași and crashed in Moldova. Source here and here.

September 8–9 – Republic of Moldova

Moldovan airspace was closed because of a Russian drone, and the shutdown also affected the plane of Ukrainian President Volodymyr Zelensky, who was on a visit to Chișinău. The next day, a Russian drone struck near the Moldovan border, at the Starokozache border crossing; sixteen people had to be evacuated to safety. Source here:

September 14 – Romania (Brașov)

A fire broke out in the Carfil industrial park in Brașov, right next to Carfil SA. The company, part of the state-owned defense industry group ROMARM, manufactures grenade launchers, ammunition, and drone components. The flames spread to the premises of eight businesses. On October 26, the SRI announced that the arson had been carried out by a sabotage network directed from Russia (see below: October 26–28). Source here.

September 14 – Poland (Rusinowo)

The Polish military retrieved a Russian Gerbera-2 drone carrying a live warhead from the Baltic Sea near a beach. According to Defense Minister Władysław Kosiniak-Kamysz, the drone had come in over the sea from the direction of the Kaliningrad region. A day earlier, a Russian drone had hit the locomotive of a passenger train traveling from Kyiv to Warsaw, about two kilometers from the Polish border. Source here.

September 14 – Denmark (Gedser)

A Russian warship fired two signal flares at a Danish Air Force Fennec helicopter that was photographing the ship over international waters as part of a routine mission. One of the flares passed right by the helicopter. Copenhagen summoned the Russian ambassador, and Prime Minister Mette Frederiksen called the action reckless. Russian Defense Minister Andrei Belousov subsequently decorated the commander of the corvette Soobrazitelny. Source here and here.

September 15 – Lithuania (Pratkūnai)

This was the first time a NATO fighter jet shot down a drone in Lithuanian airspace, between Kaunas and Kaišiadorys. According to the Ministry of Defense, an explosive device was found among the wreckage and was defused. The crisis management center said the drone had come from the direction of Belarus. Air-raid alerts were issued in Vilnius, Trakai, and Kaunas, and flights were delayed at the airports. Source here.

September 15 – United States

The U.S. Department of Justice indicted five people linked to Russian intelligence services for financing terrorism and organizing assassinations. According to the indictment, the group had been working against dissidents and allies of Ukraine since 2024. In the summer of 2026, they attempted to kill a Russian opposition figure living near Washington, and in 2024 they organized an attack against a company in Šiauliai that manufactures radios for the Ukrainian army. Source here.

September 18–19 – Luxembourg

Unidentified drones forced the closure of Luxembourg's Findel Airport twice within two days, and nineteen incoming flights had to land elsewhere. Prime Minister Luc Frieden said the government was taking the matter very seriously. Source here.

September 23 – Poland (Braniewo)

A Russian military helicopter briefly entered Polish airspace near the border with the Kaliningrad region, prompting the Polish air force to scramble fighter jets. The same week, Tusk warned that Russia could be preparing drone and missile attacks. Source here.

September 23 – Poland (Wola Krobowska)

A power-supply container at a Starlink ground station forty kilometers from Warsaw was set on fire; a bottle resembling a Molotov cocktail was found at the scene. The station is operated by the state-owned company Exatel and, together with its counterpart in Kaunas, provides satellite internet to Central and Eastern Europe, including Ukraine. On October 12, two Turkish citizens were arrested in Germany. Minister Tomasz Siemoniak said there was no doubt that Russian intelligence was behind the attack. Source here.

September 23 and 25 – Germany (Berlin Brandenburg Airport)

Drones forced traffic to be halted twice at Berlin Brandenburg Airport: first for forty-five minutes, then for nearly two hours two days later. Several planes were diverted to Dresden and Leipzig. According to dpa, 28 drones were detected over the airport in the first half of 2026, compared with a total of eight in 2025. Source here:

September 24 – Romania, Republic of Moldova

A drone flew over Romania for four minutes before crashing near Solca, in Suceava County. Moldova reported four drones; one of them, a Gerbera, crashed near Cernița in Florești district – the first one found on Moldovan territory. Poland scrambled its fighter jets twice. Between September 21 and 25, air-raid alerts were almost continuous along the Romanian border. The Moldovan defense minister said at the end of September that, as of then, 84 drones had entered the country's airspace in 2026. Source here and here.

September 30 – October 1 – Republic of Moldova (Anenii Noi, Orhei)

Near Hîrbovăț, not far from Bender, a drone struck a power pole and exploded forty meters up. Chișinău summoned Russia's envoy-designate, Ozerov. The next day, a Geran-4 drone exploded beside the Orhei highway, leaving a sizeable crater. Source here.

October 1 – Finland

The Finnish parliament and Helsinki police launched an investigation after roughly twenty MPs reported that someone had entered their homes while they were away. Nothing was taken, but they found doors unlocked, lights left on, furniture moved, and in one case someone had even left without flushing the toilet. On September 23, Deputy Speaker Paula Risikko was the first to notice that this was a pattern. Prime Minister Petteri Orpo considers it quite possible that a foreign state is behind it. Source here and here.

October 2–3 – Republic of Moldova (Chișinău)

On two consecutive days, Chișinău airport had to be evacuated because of bomb threats, immediately after Moldova had hosted an international investment conference. Source here and here.

October 3 – Republic of Moldova

During Russia's nighttime attack on Ukraine, five Russian weapons – Banderol missiles and drones – entered Moldovan airspace, and wreckage from six drones was found in four regions. Chișinău again summoned Russian Ambassador Ozerov. President Maia Sandu said the war had come "dangerously close" to Moldova. Source here.:

October 6 – Bulgaria (exclusive economic zone)

Aerial and naval drones struck two cargo ships in Bulgaria's exclusive economic zone. The Togo-flagged Alfa Watan sank; nine Syrian and one Egyptian sailor went missing. This was the first such attack in Bulgarian waters. Prime Minister Radev said it was a blatant violation of international law. Source here.

October 7 – Netherlands

A leaked internal Dutch military memo revealed a significant increase in drone activity over military bases. The military had kept these sightings secret until then. Source here.

October 11–12 – France, Netherlands, Belgium

In a single night, refrigeration and freezer systems were remotely switched off in about seven hundred French supermarkets, affecting stores belonging to Intermarché, Netto, Coopérative U, Carrefour, E.Leclerc, and Monoprix. The attackers gained access through controllers made by Danfoss, Copeland, and Dixell, which were connected to the internet without protection, accessible to anyone. In some refrigerators, the temperature rose to 50 degrees Celsius, fires broke out in several stores, and the damage ran into several million euros. The Paris prosecutor's office and France's cybersecurity agency (ANSSI) are investigating. The same weekend, the IT systems of Ahold Delhaize, which owns the Albert Heijn and Delhaize chains, were also attacked. Source here and here.

October 13 – Bulgaria (off Krapets and Byala)

Within a week, drones had sunk a second ship off the Bulgarian coast. The HS Dignity went down, eleven sailors went missing, and the Ukrainian-owned Chelsea 3 was damaged. Sofia summoned the Russian ambassador. Defense Minister Stoyanov stated that he believed these were most likely Russian drones, since it would make no sense for Ukraine to attack its own ships. Bulgaria asked NATO for fighter jets and counter-drone equipment. Source here and here.

October 14–15 – Romania (Sulina)

A drone struck the tanker Yara J in Romanian territorial waters – the first time since the start of the war that a ship had been attacked in the coastal waters of a NATO member state. The next day, the San Marino-flagged tanker Wine Trader caught fire, and seven sailors went missing. The same night, a drone hit the bulk carrier Sea Destiny in Romanian waters, and another struck the Dania J in the port of Izmail. By October 16, Romania had found drone wreckage on 81 occasions this year and recorded 53 airspace or maritime border violations. Source here and here.

October 14–16 – Republic of Moldova

More drones flew into Moldova; according to the government in Chișinău, these were certainly Russian drones. On October 16, a drone crashed and exploded near Codrenii Noi. Source here.

October 15–19 – Outer space (Cosmos 2612 and ICEYE-X36)

Starting on September 30, the Russian military satellite Cosmos 2612 carried out deliberate maneuvers to align with the orbit of the ICEYE-X36 radar satellite, and on October 18–19 it approached to within a few hundred meters – according to some measurements, just a few dozen meters. ICEYE is a Finnish-founded company that also operates through a U.S. subsidiary and sells radar imagery to Ukraine. According to LeoLabs, which tracks satellite orbits, they had never before seen such an advanced – and potentially dangerous – unauthorized approach. Source here and here.

October 17 – Romania (Sulina)

Two Romanian F-16s shot down two jet-powered Geran attack drones within four minutes over Romanian territorial waters. The following Tuesday, the North Atlantic Council held an emergency meeting to discuss the situation in the Black Sea, and France sent military aircraft to Romania. Source here and here.

October 19–23 – Republic of Moldova (cyberattack)

A serious cyberattack hit Moldova's e-government services agency (AGE), with the attackers gaining access to personal data as well. Authorities are investigating whether a foreign state is behind it. Maia Sandu convened the Supreme Security Council and warned of further destabilization attempts. Source here and here.

October 20 – United States, Europe

Citing three European officials, the Wall Street Journal reported that, according to American intelligence, Putin personally ordered the escalation of sabotage operations against NATO countries, with the Leipzig attack as one of the first steps. According to Chancellor Friedrich Merz's advisers, if more people had died in Leipzig, Berlin would have considered invoking Article 5. A Kremlin back channel sent word to Berlin that this would not be the last such incident. Source here.

October 21 – Germany (Wunstorf, Minden, Arrow 3)

WDR and Süddeutsche Zeitung obtained an internal Bundeswehr assessment that, for the first time, raises the level of Russian sabotage threat facing the German military to "significant," the second-highest level. The reason is a September discovery: a crashed drone was found near the Wunstorf air base, with a box full of explosives just a few meters away. The drone resembles the one used in the Leipzig attack, but investigators believe this one may have targeted Bundeswehr aircraft. According to an analysis by the Federal Criminal Police Office (BKA), it could have been lying there for as long as two years. The assessment also mentions drones that flew over the Saxony-Anhalt site of the Arrow 3 missile defense system and over Patriot maintenance facilities, as well as a hidden camera that was monitoring a railway station. Source here and here.

October 22 – Germany (Brandenburg)

A Ukrainian man, identified by prosecutors as Vadym Y., was arrested in Brandenburg. According to the Federal Prosecutor's Office, he had been working for a Russian intelligence service through an intermediary since at least July 2025. He gathered information on the production of armored vehicles, ammunition and explosives, as well as on people and facilities involved in defending NATO's eastern flank, partly from defense-industry workers. Source here.

October 23 – Romania (off Constanța)

Drones sank the Comoros-flagged cargo ship Khoryv about 13 nautical miles from Constanța. One sailor died and three went missing. Romanian President Nicușor Dan openly accused Russia of escalating tensions on NATO's eastern flank. Ukraine, Romania, and Bulgaria jointly asked NATO to speed up maritime reconnaissance. Source here.

October 23 – Republic of Moldova (Chiștelnița)

A Geran drone armed with explosives crashed near Chiștelnița in Telenești district, close to an energy facility and about a hundred meters from a family home. Moldova expelled a staff member of the Russian embassy. In response, Russia summoned Moldova's ambassador to Moscow on November 10. Source here.

October 26–28 – Romania, Germany, Poland

The SRI and DIICOT announced that the fire in Brașov on September 14 was part of a sabotage campaign directed from Russia, targeting the defense industry across Europe. Of the three suspects, two Belarusian men have been in German custody since October 7 for allegedly plotting, in exchange for money, to set fire to a railway line and power line near Nuremberg. The third, a Ukrainian citizen, was arrested in Warsaw under a Romanian European arrest warrant. According to the SRI, the assignments are becoming increasingly serious, ranging from vandalism to arson and even murder. Source here and here.

October 28 – Bulgaria (Cape Kaliakra)

Three sea drones sank the Greek-operated container ship Contship Jet, sailing under the Liberian flag, which was traveling from Haifa to Constanța. The 18-member crew was rescued. In October, this was the fifth drone attack in Bulgaria's economic zone, occurring just as the Bulgarian, Romanian and Turkish defense ministers were meeting in Sofia. A French patrol aircraft had warned of the danger in advance, but the attack could not be prevented. According to a former Ukrainian naval officer, the drone seen in the footage does not resemble any known Ukrainian model. According to a tally by Al Jazeera, by the end of October at least eight ships had been attacked off the Romanian and Bulgarian coasts, with around 34 sailors killed or missing. Source here and here.

October 31 – Romania (six counties)

RO-Alert warnings were issued in six counties – Iași, Neamț, Vaslui, Botoșani, Bacău and Suceava – due to two drones, and four F-16s were scrambled. Source here and here.

November 1–2 – Europe (eleven countries)

The second wave of attacks on refrigeration systems hit around a hundred stores in eleven countries: Belgium, Sweden, Germany, the United Kingdom, Ireland, Luxembourg, the Netherlands, Estonia, Finland, Italy and Romania. The freezers were set as high as 55 degrees. At the Delhaize chain alone, forty stores in Belgium and Luxembourg were affected this way. On November 4, two pro-Russian hacker groups, NoName057(16) and Z-Pentest, jointly claimed responsibility for the attacks and threatened that water utilities and power plants would be next. The EU had already placed Z-Pentest on its sanctions list in July. The Kremlin called the accusations absurd, but according to the French cybersecurity firm Sekoia, the methods point to Russian state actors. Source here and here and here.

November 1–2 – France (EFS blood banks)

Three regional centers of the French blood supply service (EFS) were attacked: through the supplier of the refrigeration equipment, attackers gained access to the system controlling the cold storage units holding plasma, and attempted to change the setting from minus 30 degrees to plus 110 degrees. The monitoring system raised the alarm in time, the stocks were transferred, and not a single blood product was lost. According to the hacker groups, the Crédit Mutuel Arkéa bank was also attacked the same day. Source here.

November 2 – Romania

The Bucharest Court of Appeal ordered, in absentia, the arrest of Oemis Romagoza Durruthy. According to DIICOT, the Cuban man, who lives in Russia, works for the Russian intelligence services and directed the 2024 sabotage attempt in Ilfov County. A warrant has been issued for his arrest. Source here.

November 2–6 – Europe (air traffic)

Bomb threats targeting European airlines arrived by email in three waves. On November 2, a Wizz Air flight departing from Luton was diverted to Budapest; on the 3rd, seven flights and a cruise ship were threatened; on the 5th, at least 27 flights, and on the 6th, another eleven. Action had to be taken at numerous airports from Copenhagen through Prague, Warsaw – where Chopin Airport was briefly closed – Rome, Milan, Lisbon, Sofia and Brussels, all the way to Bucharest; some planes were escorted by fighter jets. No explosives were found anywhere. Irish broadcaster RTÉ and Sky News received similar threats. Source here, here and here.

November 3–4 – Poland (Mińsk Mazowiecki)

Two Ukrainian citizens, aged 24 and 25, were arrested; the next day they were charged with espionage and with setting cars on fire on behalf of Russia. According to investigators, the burned cars were fitted with license plates resembling those of the Ukrainian army, in order to stir up anti-Ukrainian sentiment. Source here.

November 4 – Republic of Moldova

In the early morning, between 4:23 and 4:25 a.m., a drone entered Moldovan airspace.

Source here.

November 5 – Poland

Polish services uncovered a six-member group that had been spying and smuggling weapon components into the Kaliningrad region via Lithuania. Source here.

November 5 – Romania (Neamț and Iași counties)

In the village of Boghicea, Neamț County, fragments of a drone were scattered across an area two to three hundred meters wide. SRI bomb disposal experts examined the site and detonated the remains under controlled conditions. In Iași County, a disintegrated drone was found in a forest. Source here and here.

November 5 – Republic of Moldova (Gordinești)

In Gordinești, Rezina district, a drone resembling a Gerbera was found. According to Moldovan data, the country's airspace was violated 19 times in October, six of which involved an explosion. As of that point, 67 airspace violations had been recorded in 2026, and 104 in total since 2022. Source here.

November 7 – Republic of Moldova

Two balloons flew into the area around Drochia and Soroca, and drone wreckage was found in four districts; the authorities recorded five impacts. Source here.

November 8 – Romania (Tulcea County)

F-18s and F-16s had to be scrambled three times in a single day due to drones detected near Chilia Veche and Snake Island; an RO-Alert warning was issued in Tulcea County. Source here.

November 9 – Romania

On the day Ursula von der Leyen visited Bucharest, a drone entered Romanian airspace. An RO-Alert warning was issued in Tulcea County, and F-16s were scrambled. Source here.

November 10–11 – Lithuania, Latvia, Estonia, Finland

Balloons forced the closure of the Vilnius and Kaunas airports. The same night, four drones arrived from the direction of Belarus; NATO fighter jets fired at them twice but missed both times. One of the drones flew on through Latvia and Estonia toward Russia, while Finland restricted air traffic. Rocket debris was found near Biržai. According to Lithuanian official Vitkauskas, it was the most unsettling night in the country's history. Source here, here and here.

November 11 – Romania

The SRI announced that the Turla hacker group, linked to the Russian FSB, carried out the cyberattack that hit a Romanian state institution in December 2025. The attackers used malware previously described by the cybersecurity firm ESET as a tool for obtaining NATO and EU correspondence. Source here.

November 11 – Republic of Moldova

Two Russian S8000 Banderol missiles entered Moldovan airspace. Source here.

November 12 – Republic of Moldova

In Ștefan Vodă district, the wreckage of an unidentified drone was found in a vineyard. The same day, Moldova's Intelligence and Security Service (SIS) and the Prosecutor's Office for Combating Organized Crime and Special Cases (PCCOCS) detained a person suspected of spying for Russia. The suspect was also found to have ties with structures in the breakaway Transnistria region. Source here, here.

November 12 – Romania (Tulcea County)

An RO-Alert warning was issued in the northeastern part of Tulcea County over a possible drone incursion. Source here.

November 12 – Poland

Charges were filed against Ukrainian citizen Volodymyr B., who prosecutors say helped carry out the 2025 railway sabotage in Poland, ordered by Russia. In October, the trial also began for three Ukrainian men and one Belarusian man charged with arson. Source here.

Part II – The Cognitive Front

A. Elections:

September 6 – Germany (Saxony-Anhalt)

According to German authorities, the Storm-1516 network, linked to the GRU, tried to undermine confidence in postal voting in the final days of the state election. Earlier, it had attacked Sven Schulze, the CDU candidate, through a fake website imitating the Süddeutsche Zeitung. At the same time, the AfD and the "Ein Prozent" association recruited "election observers." Source here.

September 13 – Sweden

The Matryoshka network spread fake videos bearing the SVT and Euronews logos claiming that the election was being rigged, and also slandered Prime Minister Ulf Kristersson. One video claimed that Russian interference was merely a myth. Researchers also identified several thousand suspicious X accounts registered in Nigeria and Ghana that followed Swedish politicians. Source here and here.

September 20 – Germany (Berlin, Mecklenburg-Vorpommern)

Fake videos circulated claiming that the AfD had been left off Berlin's postal ballots, or that votes cast for the party had been destroyed. Researchers traced the videos to Storm-1516: the method – staged "eyewitnesses," websites disguised as news portals – was the same as before the federal election in February. Source here.

September 29 – Republic of Moldova

Opposition figure Ion Chicu initiated a move to suspend President Maia Sandu. The Ukrainian press described this as yet another Russian hybrid attack against Moldova. Source here.

September 29 – October 4 – Bosnia and Herzegovina

Five days before the election, Putin received Milorad Dodik and Savo Minić, prime minister of Republika Srpska, at the Kremlin. He publicly backed their coalition and promised unchanged gas prices for the Bosnian Serb entity. The Russian ambassador was also present at the SNSD's closing campaign rally in Banja Luka, where Dodik declared that Bosnia was "dead." Dodik's party, even though he himself was barred from running, won the election, and he thanked both Putin and Trump for the victory. Source here and here.

October 3 – Latvia

Latvia's Constitution Protection Bureau (VDD) found no significant, organized Russian interference in the parliamentary election. NATO deployed German Eurofighters to the Lielvārde base for the duration of the election. Source here and here.

September 10 – November 3 – United States (midterm election)

Starting September 10, the Matryoshka network attacked the Democrats with AI-generated videos featuring Hollywood celebrities. In late October, Storm-1516-style fake videos appeared targeting Senate candidates Sherrod Brown and James Talarico; one of them was viewed by around 857,000 people in a single day. According to Graphika, the American campaign began immediately after the German and Swedish elections. Source here and here.

B. Narratives, threats, exposures

August 27 – Czech Republic, Poland

At the same time the Czech domestic intelligence service (BIS) published its annual report, it emerged that fake websites, social media profiles and AI-generated content were trying to create the impression that Czech-Polish relations had deteriorated. According to the BIS, recruitment for sabotage increased again in the second half of 2025, and the GRU is primarily behind it. In September, BIS director Michal Koudelka warned that Russia could attempt a military attack on a NATO member state "within months, not years." Source here and here.

August–October – France

In August, the Paris prosecutor's office opened an investigation into Russian interference in the 2027 presidential election. On September 18, Emmanuel Macron said that the Russian hybrid threat had intensified in recent weeks, and ordered a plan to protect critical infrastructure. On October 27, the agency for countering foreign digital interference (Viginum) exposed a propaganda network called GlobUs operating in Africa, linked to the former empire of Yevgeny Prigozhin. Foreign Minister Jean-Noël Barrot is pushing for EU sanctions. Source here and here and here.

September – Russia

Maria Zakharova, spokeswoman for the Russian foreign ministry, openly stated that, in Moscow's view, European defense companies supplying weapons to Ukraine are legitimate targets. Source here.

October 11–12 – United Kingdom

Andy Burnham is the first British prime minister to state publicly that Russia interfered in the 2016 Brexit referendum. Referring to his conversation with Merz in Berlin, he added that Russian disinformation is also seeping into German politics. Source here.

October 23 – Ukraine, Central and Eastern Europe

Ukraine's military intelligence agency (HUR) warned that Moscow may be preparing false-flag sabotage operations in the Baltics and Central Europe – including against historical memorial sites linked to Russia – in order to later blame Ukraine. Source here.

Early November – Austria

Austrian police documents revealed that Jan Marsalek, the fugitive manager working for the FSB, boasted to Orlin Roussev – the leader of a spy network convicted in Britain – that they had "brought down" Chancellor Sebastian Kurz through a "successful operation"; Kurz resigned in October 2021. Source here.

Conclusions

It hardly needs much explanation: while Moscow has not reduced the volume of its hybrid attacks, it has made a "qualitative" leap – the drone strikes in the Black Sea now also have victims who are neither Ukrainian nor combatants. It is a good indicator of the success of Russia's cognitive war against us that we have managed to get used even to this: it barely registers on European citizens' threshold of concern when sailors aboard a merchant ship flying the flag of a non-belligerent state go missing or die as a result of a Russian drone attack.

The cognitive war is making itself felt in other areas as well: in France, Le Pen is heading for victory, with the far-left's Mélenchon in second place — just as pro-Russian as his Nazi opponent. In Germany, the AfD is now openly campaigning for restarting Russian-German business ties, and as a result stands at over thirty percent. I have already written about how Russia has won the war — well, this is what I meant: it could not defeat Ukraine militarily, the Russian kinetic machine got stuck in the mud of Donetsk, but today Russia dominates the European and American territories outside Ukraine. Trump's astonishing diesel deal, tantamount to betrayal, is merely a glaring example of the Kremlin's successes on the cognitive front: most European citizens have grown weary of the war without Russia having had to fire a single bullet. This is probably the first war in history to have been won without an actual physical clash.

The European elite, both political and intellectual, continues to treat all of the above as separate incidents: for every drone attack in the Black Sea, there is a separate investigation, a separate statement of "deep concern," a separate declaration. If we look closely at the list above, it hardly needs explaining that this is a coordinated action, ordered and carried out by a well-known state actor, in which every attack plays a role, and every single hybrid attack or disinformation campaign serves the Grand Plan. And that plan is nothing other than to sow fear, wear down Western public opinion with the war, and to display and have the world acknowledge Russian superiority. The incident in Finland, where politicians' toilets were defecated in and not even flushed, means roughly the same thing that Serbian mobsters once signaled to the hopelessly unprepared, hyper-weak Hungarian border guards during the Yugoslav war: they would stick a single toothbrush into the ground at the green border, the message being: brush your teeth after you're done sucking. Humiliating, torturing and proclaiming the inferiority of the opponent has always been part of the Slavic military doctrine.

If anyone reading this in a European ministry right now feels a slight twinge of annoyance, that's a good sign: at least something has moved. Based on the list above, that has so far been far from a given. In Bulgaria's economic zone, drones attacked commercial ships five times in a single month. The response was to summon the Russian ambassador, who listened to what he was told, and then went home. In Romania, drone wreckage was found eighty-one times this year. The Dutch army simply kept it secret that drones were circling over its bases, as if the problem would disappear just because no one talks about it. In Lithuania, NATO fighter jets fired at a drone twice, and missed twice. Moldova expelled one diplomat, Berlin closed one consulate. One. All this after an attack in Leipzig about which the chancellor's advisers said: if there had been more fatalities, they might have considered invoking Article 5. Might have. Considered it.

The current official European position, then, is that the dead must reach a certain number before anyone gets up from behind their desk. Exactly how many, no one says — I suspect because no one knows. The thirty-four sailors who went missing or died in the Black Sea apparently did not reach that threshold. True, none of them was an EU commissioner.

Yet there is only one solution: striking back. And encouraging signs are coming from exactly the place I would least have expected: cowardly, weak Germany, where Russian citizens arriving at airports are now being questioned. What a shame this good habit hasn't become a pan-European national sport. I would say it's not too late yet, but it is. We should have bombed Moscow long ago, we should have seized the frozen Russian assets long ago and used them to buy missiles for Ukraine, we should have cut off contact with Trump long ago, long ago, long ago…

But let us be modest. I am not asking for a European strategy by tomorrow morning. I am only asking that, instead of yet another "deep concern," someone finally say out loud, under their own name, where exactly the point is at which Europe strikes back. Because as long as we fail to take decisive countermeasures, Moscow will simply keep killing. Throughout history it has never done anything else, and it never will: after all, its greatest imperial eras were always brought about by mass murder, genocide and subjugation — and by the fact that it was never punished for any of it.

If this text was annoying enough for someone, I would gladly welcome a rebuttal. Just don't send it in the form of a press release — there are already more than enough of those.

Compiled and edited by: Anna Karczag

Ugar Gesta