Ukraine’s Defense Intelligence (HUR) warned that Russia may stage sabotage in Central and Eastern Europe, including the Baltic states, and blame Ukraine for the attacks, in a Telegram post on 23 October.

The warning comes three days after The Wall Street Journal reported that US intelligence traces Europe’s sabotage wave to Putin’s personal order. If Russia stages new attacks and pins them on Ukraine, as HUR warns, European anger could turn on Kyiv rather than the Kremlin. This goes further than HUR’s statement on 2 October, which named potential Russian targets in Europe but did not mention a plan to blame Ukraine for attacks.

HUR says Moscow wants to discredit Ukraine’s army

Russia is stepping up its hybrid strategy to destabilize the European Union, according to HUR. The agency identified two aims: reducing foreign support for Ukraine by discrediting its Defense Forces, and intimidating European governments and societies.

The accusations would be spread through Russian propaganda channels and international platforms accessible to the Kremlin.

Potential targets include infrastructure and Russian Orthodox Church sites

HUR listed several potential targets for Russian provocations:

• critical infrastructure and areas bordering Russia;
• the Kaliningrad exclave;
• areas of EU countries with Russian-speaking populations;
• Kremlin-controlled sites, including properties belonging to the Russian Orthodox Church network;
• historical sites associated with Russia.

The list reflects HUR’s assessment of potential targets, not confirmation that attacks at these locations are planned.

Earlier warnings and reported sabotage

On 2 October, HUR said Russian intelligence services had been ordered to increase activity in EU and NATO countries. It named military facilities, critical infrastructure, communications systems, and Starlink ground stations as potential targets and said it had alerted partners.

Warnings of Russian false flags on NATO’s eastern flank predate HUR’s. In August, Bloomberg reported, citing an unnamed European intelligence official, that Russia might expand hybrid attacks against Poland and the Baltic states, including false-flag attacks. A European government official separately told the agency that the CIA had warned countries in the region of a possible Russian attack. Lithuania’s military intelligence had warned earlier in August that Moscow might reassemble captured Ukrainian drones for false-flag strikes on critical infrastructure in the Baltic region.

Meanwhile, The Wall Street Journal reported on 20 October that US intelligence agencies believe the attempted drone attack on Leipzig-Halle Airport in Germany in early August was among the opening shots of a sabotage campaign ordered by Russian President Vladimir Putin. The Journal cited European officials briefed on the intelligence findings.

According to the newspaper, at least three drones carrying military-grade Semtex explosives were involved. One struck an Antonov cargo plane used to transport military aid to Ukraine but failed to explode. Another collided with a different aircraft, while a third detonated near the airport perimeter. German newspaper Welt am Sonntag has since named two suspects, citing German investigation files. Earlier German media reports described the sequence differently.

The Journal also reported sabotage attacks on Starlink stations in Poland, Lithuania, and Bulgaria in recent weeks. In August, Slovak authorities said they had foiled a planned arson attack on a Ukrainian drone factory, the Journal reported.

Russia denies involvement in sabotage in Europe. Responding to Berlin’s accusations over the Leipzig incident in early September, Putin asked where the evidence was.

US President Donald Trump said Elon Musk had restored Ukraine’s Starshield speeds, but the restrictions remained in place on 23 October, according to Ukrainian officials.

The cap, in place since 14 October, has disrupted interceptor drone missions against jet-powered Shaheds flying above 400 km/h for more than a week. On 16 October, Trump told reporters that, from what he understood, nothing had changed with the service. His latest claim that Musk restored it appears to acknowledge the restriction, even as he denies ordering it.

Ukraine says restrictions remain

“At the moment, there is no confirmation that the restrictions have been lifted,” a Defense Ministry official told LIGA.net on the morning of 23 October. The official said connections continued to drop at above 161 km/h.

Presidential adviser Serhii Beskrestnov wrote on Telegram on 23 October that no lifting had been recorded. He said occasional operation above the limit could result from SpaceX algorithms or usage conditions.

A day earlier, President Volodymyr Zelenskyy said US Secretary of State Marco Rubio had promised to return with information in “48 plus hours,” according to his remarks to reporters in Kyiv. A Ukrainian official separately told The Kyiv Independent that reports of restored speeds were “all false.”

A senior European official told the Associated Press that the cap remained at about 160 km/h and that Ukraine had no clear explanation of who ordered it or why.

Conflicting reports of a lift

Trump said Musk had restored the speeds but declined to clarify whether he had contacted him.

“I guess the bottom line, he put it back,” Trump said.

Meanwhile, AP reported that the Wall Street Journal said Musk had agreed to lift the restrictions. The Ukrainian drone and mapping channel Kartohraf posted on the evening of 22 October that the cap had been lifted. The Economist’s Oliver Carroll said that frontline drone commanders thought it had likely been lifted but were still testing, according to his post on X.

Who ordered the cap?

The order came from inside the White House, according to a Reuters report on 15 October. Days later, the Wall Street Journal reported that Musk ordered the slowdown. Rubio denied White House involvement, and Defense Secretary Pete Hegseth said on 20 October that the US had not ordered the restriction. Meanwhile, Democratic Senator Richard Blumenthal announced an inquiry into how the service was slowed, AP reported.

Ukraine’s gains in Donetsk Oblast rely on drones the cap slows

The 3rd Army Corps’ Operation Vivaldi retook ground north of Lyman in Donetsk Oblast with drones, many of which rely on Starlink or Starshield, and those gains could erode if the cap stays.

At the same time, Radio Svoboda reported that Ukraine needs a limit of at least 450 km/h and that Germany pays for the service under a contract running until April 2027.

Sergei Kiriyenko, first deputy chief of staff of the Russian Presidential Administration, set the goals for the Ukraine strand of the operation, launched in early 2023 under the codename "Uganda." Alexander Kharichev, now head of the Kremlin's Directorate for Monitoring and Analysis of Social Processes, oversaw it, according to hacked correspondence published by The Insider on 21 October.

Doppelgänger disguises Russian narratives as local news through cloned media sites, fake accounts, paid ads, and fabricated videos. The FBI named Kiriyenko among its orchestrators in 2024, and its contractor, the Social Design Agency (SDA), run by Ilya Gambashidze, is still expanding, now targeting AI chatbots. The new files go inside the Ukraine campaign and show the operation reporting even exposed fakes to the Kremlin as achievements.

Telegram channels posing as Ukrainian

An internal briefing on narratives says the project ran its Telegram channels on the principles of agent work and psychological operations, the Russian version of the investigation shows. Early on, the team decided to disguise all its outlets as Ukrainian and to run its campaigns without direct Russian propaganda. Every channel carried Ukrainian news to look unconnected to Russia. Dropping pro-Ukrainian themes, the briefing warned, would eventually expose the client and wreck the whole plan.

Explore further

Russia-linked bot networks kept their weekly rhythm after drone strikes on three Yandex data centers—disinformation monitor LetsData

Four goals and a can of stew

Kiriyenko set four goals: discredit Ukraine's military and political leadership, split its elites, demoralize its army, and disorganize its population. The SDA prepared the project's pitch and carried out the work.

Political strategist Alexander Asafov proposed fakes of his own: in May 2023, that soldiers were bribing commanders to avoid the front, and in January 2024, that Ukraine was pulling air defenses back to Kyiv to protect the authorities.

After an Il-76 military transport crashed in Belgorod Oblast on 24 January 2024, Moscow claimed it had been carrying Ukrainian prisoners of war. Kharichev's subordinate Yevgeny Kazakov, chairing a meeting in his place, proposed sending a fake to the widows of Ukrainian soldiers: "They died for an expensive Il-76—the Russians have few of those." The idea was dropped.

The same meeting produced another fake, and three days later the team launched it: that recruitment centers had sent widows a can of stewed meat with a little flag as compensation. The same producers also oversaw letters falsely attributed to Deputy Defense Minister Nataliia Kalmykova, the Russian version says.

Debunks filed as results

The SDA collected coverage of its work in a folder for the Kremlin. It filed the "Zelensky's yacht" story, which JD Vance, then a US senator and now US Vice President, echoed, together with its debunk. The report also included a TikTok campaign about former Defense Minister Oleksii Reznikov's family that the BBC had already exposed.

The Insider concludes that the team has had more failures than successes. The US sanctioned Gambashidze and the SDA in March 2024, and the UK followed in October.