Between late August and mid-September 2026, a series of coordinated hostile hybrid warfare acts allegedly linked to Russian intelligence and military services targeted NATO and EU countries, focusing on military, transport, and critical infrastructure assets. Key incidents include the Romanian intelligence service stopping a Russian-controlled espionage and sabotage operation against military sites and Ukrainian Antonov transporters on September 8; a British indictment of a 31-year-old for plotting an attack on a UK drone factory on September 9; arson attacks on Polish armament factories WB Electronics and a Leonardo supplier alongside sabotage of power grids in Germany; an explosion at the Bulgarian armaments manufacturer EMCO on September 12 attributed to Russian agents; derailment of a train near the Polish-Ukrainian border on September 13; recovery of a presumed Russian Gerbera drone from the Baltic Sea and drone debris near the German Wunstorf A400M base on September 14; revelations of Russian tests on undersea data cables near Svalbard; the downing of a drone by a NATO jet over Lithuania; a Russian frigate firing signal flares at a Danish helicopter; sabotage of the Dutch rail network reported on September 15; and stern public rhetoric with Polish Foreign Minister Sikorski warning of European air superiority and Putin advisor Patrushev threatening Poland’s statehood within days. NATO and the EU view the cluster of these events as connected hostile hybrid warfare acts amounting to undeclared war.

Between late August and mid-September 2026, a series of coordinated hostile hybrid warfare acts allegedly linked to Russian intelligence and military services targeted NATO and EU countries, focusing on military, transport, and critical infrastructure assets. Key incidents include the Romanian intelligence service stopping a Russian-controlled espionage and sabotage operation against military sites and Ukrainian Antonov transporters on September 8; a British indictment of a 31-year-old for plotting an attack on a UK drone factory on September 9; arson attacks on Polish armament factories WB Electronics and a Leonardo supplier alongside sabotage of power grids in Germany; an explosion at the Bulgarian armaments manufacturer EMCO on September 12 attributed to Russian agents; derailment of a train near the Polish-Ukrainian border on September 13; recovery of a presumed Russian Gerbera drone from the Baltic Sea and drone debris near the German Wunstorf A400M base on September 14; revelations of Russian tests on undersea data cables near Svalbard; the downing of a drone by a NATO jet over Lithuania; a Russian frigate firing signal flares at a Danish helicopter; sabotage of the Dutch rail network reported on September 15; and stern public rhetoric with Polish Foreign Minister Sikorski warning of European air superiority and Putin advisor Patrushev threatening Poland’s statehood within days. NATO and the EU view the cluster of these events as connected hostile hybrid warfare acts amounting to undeclared war.