"We are disabling the enemy's channels, disrupting command and control, and helping UAVs reach their targets," Atesh said.

Reviewing internal documents from Germany's armed forces, German media reports that this is the military's second-highest threat classification.

A former Ukrainian special forces officer has gone on trial in Hamburg over the 2022 Nord Stream explosions, with his lawyers arguing that Russian energy infrastructure used to finance aggression cannot automatically enjoy protection as a civilian installation.

The first criminal trial arising from the destruction of the Nord Stream gas pipelines has opened in Hamburg, confronting German judges with allegations against a former Ukrainian military officer and a dispute over whether Russian energy infrastructure constituted a legitimate wartime target.

Serhii Kuznietsov, 50, is accused of organising an operation that destroyed three of the four Nord Stream pipeline strands in the Baltic Sea in September 2022. German prosecutors have charged him with offences involving explosives, damage to infrastructure and participation in a war crime.

At the opening hearing on 14 October, Kuznietsov’s lawyers sought to have the proceedings dismissed, challenging both the evidence against their client and the prosecution’s classification of the pipelines as protected civilian infrastructure.

According to the account of the opening proceedings, the defence argued that the installations served Russia’s strategic interests and had been used to exert economic and political pressure on European countries.

Kuznietsov denies involvement in the explosions. His lawyers maintain that the prosecution has not established that he participated in, let alone directed, the operation.

German prosecutors allege Ukrainian involvement

The explosions occurred on 26 September 2022, approximately seven months after Russia launched its full-scale invasion of Ukraine.

Underwater detonations near the Danish island of Bornholm ruptured sections of Nord Stream 1 and Nord Stream 2, releasing large quantities of natural gas into the Baltic Sea.

German investigators allege that a group of Ukrainians used a rented sailing yacht, the Andromeda, to transport divers, explosives and equipment to the pipelines.

According to the prosecution, the operation involved military-grade explosive devices and was organised with the knowledge or direction of Ukrainian state authorities.

These allegations remain to be tested in court. Ukrainian officials have denied state involvement, and no German judicial finding has established responsibility on the part of Kyiv’s political or military leadership.

The defendant was arrested in Italy in August 2025 and subsequently extradited to Germany following lengthy legal proceedings.

As EU Today reported following the Italian Supreme Court’s ruling, Kuznietsov’s defence had challenged the legality of his transfer and questioned the evidence underpinning the German investigation.

His appearance in Hamburg now moves the case from extradition disputes to direct examination of the prosecution’s allegations.

Can a gas pipeline be a military target?

The central legal controversy concerns whether the Nord Stream infrastructure was entitled to protection as a civilian installation during an international armed conflict.

Under international humanitarian law, civilian objects are generally protected against attack unless their nature, location, purpose or use makes an effective contribution to military action and their destruction offers a definite military advantage.

Kuznietsov’s defence argues that Nord Stream had served Russian strategic interests by generating energy revenue and providing Moscow with leverage over European governments.

Defence lawyer Nicola Canestrini has described the pipelines as an instrument of Russian economic coercion rather than infrastructure serving an exclusively civilian purpose.

German prosecutors reject the proposition that those circumstances automatically justified their destruction. They maintain that the operation involved attacks against civilian infrastructure and therefore constituted a war crime.

The legal assessment is more complicated than determining who owned the pipelines.

Financial benefits to a belligerent state do not necessarily make every commercial installation a military objective. Equally, civilian ownership or use does not automatically exclude infrastructure from becoming a military target if the conditions established under the laws of armed conflict are satisfied.

The operational circumstances in September 2022 could become important. Nord Stream 1 had already ceased delivering gas, while Nord Stream 2 had never received German certification to begin commercial operations.

The court will therefore have to consider both the pipelines’ strategic significance and their actual contribution to Russia’s military operations at the time of the explosions.

Defence raises questions about state secrecy

Kuznietsov’s lawyers have also argued that his military status restricts his ability to discuss information that could be covered by Ukrainian state secrecy obligations.

According to the opening-day court reporting, the defence contends that these restrictions undermine his ability to challenge the prosecution’s case.

The proceedings also raise questions concerning the legality of his extradition from Italy and the precise offences for which his transfer was authorised.

These are separate from the underlying question of responsibility for the explosions. A procedural objection could affect the conduct of the trial without resolving the factual allegations.

Berlin faces an uncomfortable political dispute

The case has implications for relations between Germany and Ukraine, although criminal responsibility must be determined independently of diplomatic considerations.

Germany remains a major supplier of military and financial assistance to Kyiv. At the same time, German prosecutors are pursuing allegations that Ukrainian personnel damaged infrastructure in which German companies had invested heavily.

The pipelines themselves remain politically contentious. As EU Today previously examined, the owner of Nord Stream 2 has separately challenged the EU’s plans to eliminate Russian gas imports, demonstrating that the commercial and legal consequences of Europe’s former energy relationship with Moscow remain unresolved.

The Hamburg trial will not determine the legality of Russia’s invasion, nor will it establish Ukrainian government responsibility merely because a former officer stands accused.

It will examine the evidence against Kuznietsov and the circumstances in which the destruction of infrastructure connected to an aggressor state can constitute a criminal offence.

Further hearings are scheduled, with the evidentiary proceedings expected to begin on 27 October. The outcome will depend on whether prosecutors can establish the defendant’s alleged role and overcome the legal challenges raised by his defence.

On the first day of the trial, prosecutors accused Serhii Kuznetsov of being an accomplice to war crimes by committing an attack against civilian infrastructure. Kuznetsov has denied any involvement.

Former special forces officer Sergiy Kuznietsov facing charges including 'war crime,' attacking civilian infrastructure; Kyiv consistently denies it was behind Baltic Sea blast

German industry expects Russian sabotage against the country’s companies to persist and take more forms, the deputy head of the Federation of German Industries (BDI) told Handelsblatt. His warning follows alarms from Germany’s intelligence services, which describe the country as a main target of Russia’s covert campaign in Europe.

Russia keeps striking Ukrainian cities and power plants every day while trying to weaken the European support that keeps Ukraine fighting. Germany is home to arms makers producing with and for Ukraine, so pressure on its companies targets the supply behind Ukraine’s defense.

Industry expects attacks to last and change form

The warning came from Holger Lösch, the BDI’s deputy managing director.

“German industry is preparing for the threat to persist and for attack methods to become more varied,” he told Handelsblatt. “Companies don’t end up in the crosshairs by chance,” he added.

Russian influence and sabotage operations are no longer an abstract scenario, and companies, critical infrastructure, and defense supply chains are already among their targets, Lösch said. Companies now receive more threat warnings, and their cooperation with the authorities has improved significantly, he noted. “What is still missing are joint procedures to quickly derive concrete measures from warnings,” Lösch said, calling the protection of the economy a cornerstone of national security.

German intelligence describes a Russian shadow war

The warning comes a week after a public hearing of the intelligence oversight panel of the Bundestag, Germany’s parliament, on 5 October. There, Martin Jäger, head of Germany’s Federal Intelligence Service (BND), said Russia was waging a shadow war against Germany. “Germany has become a main obstacle to Russian hegemonic power projection in Europe and thus a target of Russian action,” Jäger said. “The danger of attacks against targets in Germany remains real and present,” he warned.

Sinan Selen, head of the Federal Office for the Protection of the Constitution (BfV), Germany’s domestic intelligence agency, told the same hearing that Russia was showing a readiness for sabotage and killings.

German Chancellor Friedrich Merz said on 1 October that Germany was preparing for further hybrid attacks, “including serious ones,” and would respond “quickly and very clearly,” as it did after the drone attack at Leipzig airport.

Drone bombs, arson, and paid saboteurs on German soil

In August, a drone carrying Semtex explosives hit the wing of a Ukrainian An-124 cargo plane at Leipzig/Halle Airport but did not explode. Germany blamed Russia on 1 September, and German Foreign Minister Johann Wadephul said Germany was not at war with Russia but was a “target of war.”

German authorities suspect Russian intelligence of commissioning an arson attack near two Munich defense firms, and a confidential Federal Criminal Police Office (BKA) assessment counted more than 165 suspected sabotage cases in Germany between January and August. The same assessment recorded 747 suspicious drone incidents involving 1,068 drones over critical infrastructure, military sites, and defense companies.

Germany’s Military Counterintelligence Service (MAD) warns that the threat from low-level agents, locals paid small sums for one-off jobs such as arson or photographing military sites, has increased significantly. European intelligence agencies also report that Russia is increasingly targeting defense company executives, including at smaller drone makers, and the BfV has advised some German firms to hire close protection.

As long as Germany keeps backing Ukraine, Russian pressure on its companies is unlikely to ease, and the gap between warnings and action that industry flagged leaves smaller firms, with fewer resources for security, the most exposed.

Intelligence services from five European countries warn that Russia is expanding assassination and sabotage operations against defence manufacturers supplying Ukraine. The threats coincide with an alleged plot against Poland’s prime minister and defence minister, raising concerns about Moscow’s efforts to undermine European military assistance through intimidation and political destabilisation.

European intelligence agencies have warned that Russia is intensifying efforts to assassinate executives of defence companies supplying Ukraine, extending its campaign of sabotage and intimidation into the European military-industrial sector.

According to intelligence assessments obtained from five European security services, Moscow has ordered an expansion of covert operations targeting senior figures at major arms manufacturers and smaller companies producing drones and military components. Germany’s domestic intelligence agency, the BfV, has reportedly advised executives to strengthen personal security, while some manufacturers have already increased protection for senior personnel.

The warnings emerged alongside reports of an alleged assassination plot against Polish Prime Minister Donald Tusk and Defence Minister Władysław Kosiniak-Kamysz. Polish authorities convened an emergency security meeting and subsequently detained a suspect. No connection between the Polish case and Russian intelligence has been established.

Europe becomes Moscow’s principal target

The apparent expansion of Russian covert operations reflects a shift in Moscow’s calculations concerning Western military assistance.

President Vladimir Putin had reason to anticipate that Donald Trump’s return to the White House would weaken American support for Kyiv. Trump repeatedly questioned US military expenditure on Ukraine and advocated a negotiated settlement with Russia. A substantial reduction in American weapons deliveries could have increased pressure on Ukraine to accept Moscow’s territorial demands.

Instead, European governments assumed greater responsibility for sustaining Ukrainian defence capabilities, including financing weapons purchases and expanding domestic production.

The European Union’s €90 billion support programme for 2026–2027 allocates €60 billion to defence procurement and industrial capacity. The EU has also established mechanisms allowing Ukraine to participate in European joint procurement programmes.

Disrupting European manufacturers therefore offers Moscow a means of restricting Ukraine’s military capabilities without directly confronting NATO.

Assassination threats can interfere with procurement even when attacks are never carried out. Large manufacturers can afford extensive security arrangements, but smaller companies producing electronics, drone components and specialised equipment often lack comparable resources.

Intimidation could delay contracts, discourage investment and persuade individual suppliers to withdraw from Ukrainian defence programmes.

Sabotage as an instrument of political pressure

Russia’s alleged interest in targeting defence executives is not unprecedented. In 2024, American intelligence reportedly uncovered a Russian plot to assassinate Armin Papperger, chief executive of Rheinmetall, one of Germany’s principal suppliers of ammunition and military equipment to Ukraine.

As EU Today previously reported, Moscow has also publicly identified European factories involved in Ukrainian drone production, increasing concerns that civilian industrial facilities could become targets of Russian operations.

European authorities have investigated suspected Russian involvement in arson, infrastructure attacks and clandestine networks. An earlier cross-border investigation into alleged assassination and sabotage preparations demonstrated how intermediaries could be recruited to conduct operations while obscuring their sponsors.

Such activity also carries political consequences. Attacks against infrastructure and industrial facilities can reinforce public fears about confrontation with Russia, particularly during elections when parties advocating accommodation with Moscow seek to exploit security concerns.

Poland has already experienced mounting Russian hybrid pressure, including threats to critical infrastructure and information operations intended to aggravate domestic political divisions.

Putin’s strategy against European rearmament

Ukraine’s continuing strikes against Russian refineries and military-industrial facilities have added economic and operational pressures to Moscow’s prolonged war effort. Russia retains substantial military production capacity, but the costs of sustaining the conflict remain considerable.

Interfering with European weapons manufacturing could serve two objectives: restricting Ukraine’s access to equipment and obstructing Europe’s longer-term rearmament.

The Kremlin does not necessarily need European governments to abandon Ukraine formally. Production delays, disrupted contracts and reluctant suppliers could reduce the practical effect of military assistance even while political commitments remain unchanged.

European governments have acknowledged the industrial challenge. In its June conclusions on European defence, the European Council called for accelerated manufacturing capacity, stronger supply chains and closer cooperation with Ukraine’s defence industry.

Russia’s apparent strategy seeks to exploit the dependence of these programmes on private companies and skilled civilian personnel.

The warnings from European intelligence agencies suggest that protecting defence executives, engineers and contractors is becoming part of the continent’s wider security responsibilities.

For Moscow, intimidation offers the possibility of weakening Ukrainian military resistance without an open confrontation with NATO. For European governments, preventing covert operations from disrupting weapons production is increasingly inseparable from their commitment to sustain Ukraine’s defence.

NATO's Military Committee, the Alliance's highest military body, visited Kyiv on 6 October to reaffirm support for Ukraine, its chair, Admiral Giuseppe Cavo Dragone, said. It was the committee's first official visit to Ukraine's capital in eight years. The officers came to hear how Ukraine is fighting Russia and to draw lessons for NATO's own defense, and Dragone used the visit to warn Moscow.

Russia's war no longer stays inside Ukraine: its drones, saboteurs, and pressure campaigns increasingly reach NATO members. That turns Ukraine, the only European army facing Russia in combat, from a country the Alliance helps into one it learns from.

All 32 allies at the table

Dragone brought the military representatives of all 32 member states to hear the latest battlefield assessment directly from Ukraine's commander-in-chief, Mykhailo Drapatyi, and his staff. They also came to learn what more NATO can do to support Ukraine, he said in an address recorded in Kyiv.

"After eight years, the NATO Military Committee comes back to Kyiv for an official visit. But while we were not physically present here, Ukraine is in our thoughts, in our discussions, in our decisions and following action every single day," Dragone said.

The visit fulfilled a promise he made to Drapatyi during their last conversation in August, the admiral said. It also follows a June visit to Kyiv by the North Atlantic Council, NATO's main political decision-making body. "We are here in full strength with a clear message. The bond between NATO and Ukraine is stronger and stronger," he said.

With the whole NATO Military Committee, we visited Kyiv, yesterday, to reaffirm unwavering support for #Ukraine.

Discussions with Major General Drapatyi, Commander-in-Chief of the Armed Forces, focussed on Ukraine’s military priorities and lessons learned to strengthen… pic.twitter.com/kar2l1Xlq4

— Admiral Giuseppe CAVO DRAGONE - NATO CMC (@CMC_NATO) October 7, 2026

Lessons from Ukraine's commanders

The talks with Drapatyi focused on Ukraine's military priorities and lessons learned to strengthen Allied preparedness for current and future threats, Dragone wrote on X. The delegation also paid respects at the Wall of Remembrance of the Fallen for Ukraine in Kyiv.

In his address, Dragone said Ukraine's courageous and resilient spirit remains unbreakable and serves as an example to other nations.

"An example that combines with all the lessons we can learn from your commanders, from their experience, which will ultimately help our Alliance too to better face today's and tomorrow's threats," he said.

To Russia: "You are failing"

Dragone also addressed Russia directly. NATO stands unwavering with Ukraine in the face of Russia's continued aggression and its reckless hybrid activities in member countries, he said.

"To those who think that by perpetrating acts of sabotage, cyberattacks, and violation of the airspace in national NATO territory they will undermine this support and our resolve, I will respond: You are failing. NATO support for Ukraine continues to grow, and our unity is stronger than ever."

Russia bears full responsibility for such dangerous and unacceptable behavior, and allies will keep sharpening their tools and strengthening deterrence and defense, the admiral added.

Drapatyi became Ukraine's commander-in-chief in July, when President Volodymyr Zelenskyy replaced Oleksandr Syrskyi after a week of political turmoil.

Kyiv under fire, Russian troops pushed back near Lyman

The day after the visit, Russia struck Kyiv and 12 oblasts with about 70 missiles. In recent weeks, Russian attacks have cratered the capital's bridges and hit a school, a café, and warehouses, as well as a maternity hospital. Ukrainian troops also retook ground near Lyman in the Vivaldi counteroffensive.

Armed escorts in masks pushed a group of migrants from Belarus toward Latvia and threatened Latvian soldiers, and hours later masked people crossed into Latvia and stole border surveillance cameras, Latvian Interior Minister Jānis Dombrava said on 6 October. Latvia's military described the incident as part of a continuing hybrid campaign on the border, and Ukraine's foreign minister blamed Moscow.

Russia keeps probing the EU's eastern defenses with migrants pushed from its own soil and through its ally Belarus, alongside drone incursions and sabotage that ISW has linked into one Russian pattern across Europe.

Armed escorts threatened Latvian soldiers

Latvian soldiers stopped at least 20 migrants trying to cross the border illegally from Belarus, the Latvian National Armed Forces said. Masked escorts led the group, and this time they were armed, threatened the soldiers, and urged and drove the migrants toward Latvia, the military said.

"Unlike many previous incidents, this time the provocation was particularly demonstrative and aggressive," Dombrava said.

The incident confirms that deliberate provocations and hybrid threats on the border will continue, the armed forces said. Illegal migration is being used as a tool to pressure Latvia's border and, with it, the external border of the EU and NATO, they added.

Belarus began funneling migrants toward the EU in 2021, a campaign Poland's government called a hybrid attack in which the migrants end up as weapons. In 2023, Finland closed its border crossings with Russia, accusing Moscow of the same tactic, and by mid-July Latvia had logged 111 straight days of migrants pushed across from Belarus.

Masked people stole the cameras

Several hours after the standoff, people in masks entered Latvian territory, damaged a distribution cabinet, and stole surveillance cameras, Dombrava said. They returned to Belarus before the border guard patrol could arrive.

"Belarus should understand that such incidents could lead to more serious consequences for Belarus itself," he said.

Ukrainian Foreign Minister Andrii Sybiha said Ukraine stands in full solidarity with Latvia. "Make no mistake: Moscow is behind it," he wrote, adding that Russian President Vladimir Putin "deliberately weaponizes migration, with the help of Lukashenka, to destabilise Europe."

Tunnels, tear gas, and damaged cameras on the border

Latvia's border guards stopped 11,384 attempts to cross illegally from Belarus between the start of 2026 and 24 September. In January, Latvia's armed forces and border guard published evidence that Belarusian security agencies were organizing illegal migration across the border. Latvia has also recorded deliberate damage to cables, distribution cabinets, and camera poles on its eastern border, aimed at slowing the rollout of an automated border control system.

On 22 July, Latvian soldiers fired warning shots and used tear gas against migrants trying to cross. The next day, Prime Minister Andris Kulbergs said Russia and Belarus were stepping up their hybrid war against the Baltic States to distract from Russia's failures in Ukraine. Latvia temporarily halted crossings on the Belarus border on 31 July. In August, Latvian guards found the first tunnel dug from Belarus and turned back 15 migrants who used it.

Germany is expanding drone detection at its airports with a new system operated by German air traffic control provider Deutsche Flugsicherung (DFS), the German Federal Ministry for Transport (BMV) announced on 5 October.

Germany has accused Russia of attempting a hybrid attack at Germany’s Leipzig/Halle Airport near a Ukrainian An-124 aircraft using a drone carrying explosives. Earlier, Finnish President Alexander Stubb said Europe must be prepared for “continued hybrid and sabotage attacks” by Russia, adding that Russia seeks to sow panic through such actions.

On Monday, two more sites were added—Stuttgart and Hamburg. As of Monday, seven of Germany’s eight largest airports were equipped with the new drone detection system in their approach and departure areas.

Germany seeks responses to new hybrid threats

The Federal Ministry cited the reason for the new measure: drones near airports can affect air traffic very quickly.

Federal Transport Minister Steffen Bilger and Baden-Württemberg Transport Minister Nicole Razavi were briefed on the new system at Stuttgart Airport, where it is being put into operation, the ministry said. The system creates “an important technical basis for detecting potential threats at an early stage and quickly informing the competent authorities,” Bilger said.

“With today’s commissioning of the drone detection system at Stuttgart Airport, the federal government is fulfilling a key promise: it is not only talking about the dangers posed by unmanned aircraft, but is also following through with very concrete action. Protecting critical infrastructure and ensuring the safety of passengers at Stuttgart Airport require continuous adaptation to a changing security situation,” Razavi said, according to the ministry.

The new DFS system allows drones near airports to be detected at an early stage and information about possible threats to air traffic to be passed more quickly to the relevant authorities. This helps them assess risks and respond to them more quickly, the statement said.

DFS is responsible for detecting drones in approach and departure areas, while the Federal Police and other security services are responsible for preventing threats and defending against drones. The BMV, Federal Ministry of the Interior, DFS, Federal Police and airports coordinate their work to exchange information quickly and maintain a shared picture of the situation.

No further details about how the system operates have been disclosed.

The first stage of the expansion at Germany’s eight major commercial airports will be fully implemented this week, with the systems in Stuttgart and Hamburg being put into operation, the statement said.

The system will also be installed at the airport where a bomb-laden drone was found

The system will also be put into operation at Leipzig/Halle Airport this week, meaning that the first stage will be fully implemented at all eight of Germany’s largest commercial airports, according to the press release.

A quadcopter drone carrying a Semtex explosive flew directly toward a parked Ukrainian An-124 Ruslan cargo aircraft and struck its wing at Leipzig/Halle Airport in Germany on the evening of 4 August, Die Zeit reported on 10 August. The drone hit the aircraft at around 19:30 local time, bounced off the wing, and fell to the ground without detonating, according to the media outlet.

Germany has accused Russia of attempting the drone attack and announced further sanctions against Russian citizens and institutions, Tagesschau reported on 1 September.

At the crime scene, investigators found the drone configuration, explosives and detonation technology that had already appeared in other Russian hybrid operations and in Russia’s war against Ukraine, Federal Interior Minister Alexander Dobrindt said during a joint press conference with Federal Foreign Minister Johann Wadephul, the media outlet reported.

The German government assumes that Germany has been and will be a target of further such Russian attacks. Germany is not at war with Russia but is a “target of war,” Foreign Minister Wadephul said, according to the outlet.

EU foreign policy chief Kaja Kallas has warned that Russia is intensifying hybrid operations across Europe, citing sabotage attempts, airspace violations and Russian drones and missiles crossing into Moldovan territory.

Her intervention adds pressure for a more coordinated European response to hostile activity below the threshold of conventional warfare.

Russia is putting lives at risk across Europe through an expanding campaign of hybrid activity, EU foreign policy chief Kaja Kallas said on Monday, after another series of Russian drones and missiles entered Moldovan airspace.

Speaking in Brussels alongside Moldovan Prime Minister Vasile Tofan and Enlargement Commissioner Marta Kos, Kallas said Europe had experienced an increase in sabotage attempts and airspace violations during recent weeks.

“Russian missiles and drones violated Moldovan airspace again over the weekend,” she said, describing the incidents as unacceptable.

According to the official EU record of the press conference, Kallas said the Kremlin was seeking to create fear and interfere with European decision-making, and argued that the response should include greater resilience and continued support for Ukraine.

Her remarks follow Russia’s renewed large-scale attacks against Ukraine’s energy system and continued reports of drones crossing borders beyond Ukrainian territory.

Moldova’s defence authorities reported that three drones entered Moldovan airspace during Russia’s 30 September attack on Ukraine. Moldova, which shares a long border with Ukraine and is seeking EU membership, has repeatedly accused Moscow of attempting to destabilise the country.

The latest incidents broaden a European debate that has been developing for months: how governments should respond to hostile operations that are deliberate and potentially dangerous but fall short of an overt military attack.

EU Today reported on 28 September that European governments were discussing an emergency security protocol intended to improve coordination when member states face sabotage and other hybrid threats.

That followed earlier warnings concerning suspected attacks on infrastructure, cyber operations, interference campaigns and airspace violations across several European countries.

The problem is partly one of attribution and partly one of thresholds.

A conventional armed attack on a NATO member may trigger consultation under Article 4 or, in sufficiently serious circumstances, collective defence provisions under Article 5. The European Union also has its own mutual assistance provision under Article 42.7 of the Treaty on European Union.

Hybrid activity is frequently designed to remain below those thresholds.

Cyberattacks, covert sabotage, GPS interference, disinformation, drones and operations conducted through intermediaries can impose costs without giving governments an obvious basis for a military response.

Kallas’s warning comes as Germany has also reported an increase in activity it attributes to Russia.

Chancellor Friedrich Merz has warned that Germany faces growing hybrid pressure involving drones and cyber operations. European security services have separately investigated suspected Russian involvement in sabotage and attacks on infrastructure in several countries.

Moscow has denied Western accusations that it is directing such operations.

The EU has already used sanctions against individuals and entities accused of Russian hybrid activity, while governments are considering faster systems for sharing intelligence and attributing incidents.

EU Today examined the debate in September as the European Parliament considered proposals for quicker attribution, stronger intelligence-sharing and improved protection of critical infrastructure.

Moldova occupies a particularly exposed position.

The EU has provided €317 million through the European Peace Facility for Moldovan defence modernisation, according to Kallas, including €120 million allocated in 2026 for air defence. Brussels is also supporting Moldova through its EU Partnership Mission, which provides assistance against hybrid and cyber threats.

Unlike Ukraine, Moldova is not a NATO member and has constitutional neutrality. Its ability to counter Russian missiles or drones entering its airspace is therefore closely connected to the development of its own detection and air-defence capabilities.

For the EU, repeated incidents involving Moldova, NATO airspace and European infrastructure are increasingly being considered as parts of the same security problem rather than isolated events.