Romanian intelligence services say a Russian-directed network was responsible for a fire near an arms manufacturing facility in Brașov. Investigations involving Germany and Poland have exposed what authorities describe as a wider operation targeting military and industrial defence infrastructure across Europe.

Romania has accused Russia of coordinating a cross-border sabotage network responsible for an industrial fire near an arms manufacturing facility, prompting a diplomatic confrontation with Moscow and investigations involving several European countries.

Romanian intelligence and prosecutors announced on 26th October that they had identified three foreign nationals allegedly involved in the operation, which caused a fire on an industrial site in Brașov on 14th September.

The suspects, two Belarusian nationals and one Ukrainian, are alleged to have participated in a network directed by individuals operating from Russia.

Two suspects have been detained in Germany, while a third has been located in Poland.

Romania is seeking their extradition as investigators examine possible connections to other attempted attacks against military and industrial installations.

Russia has rejected the allegations.

The case has drawn attention to the security of European defence production facilities at a time when NATO governments are seeking to increase military manufacturing capacity and sustain assistance to Ukraine.

Fire near a Romanian arms manufacturer

The investigation concerns an industrial complex in Brașov, a city with an established defence manufacturing sector.

The fire occurred on 14th September at premises situated close to CARFIL SA, a subsidiary of Romania’s state-owned defence company ROMARM.

According to the Romanian Intelligence Service, the incident was caused by individuals belonging to a sabotage network coordinated from the Russian Federation.

The fire damaged premises occupied by several commercial businesses.

Although the industrial site is associated with the CARFIL complex, authorities have not established publicly that the arms manufacturing facility itself sustained damage.

That geographical distinction is important when assessing the consequences of the operation.

CARFIL manufactures military equipment and ammunition and has pursued partnerships involving drones, explosives and other defence technologies.

Its proximity to the incident has heightened concerns about the security of industrial facilities supporting Romania’s armed forces.

Suspects identified in three countries

Romania’s Directorate for Investigating Organised Crime and Terrorism, known as DIICOT, says the evidence connects three individuals to the incident.

According to Romanian national news agency AGERPRES, the Bucharest Court of Appeal issued European arrest warrants following the investigation.

Two suspects were detained in Germany while allegedly preparing similar operations.

The third was located in Poland, where authorities received a further European arrest warrant issued on 26 October.

Romanian prosecutors are pursuing extradition procedures.

The nationalities of the suspects do not establish responsibility on the part of Belarus or Ukraine. Romanian authorities attribute the alleged coordination to individuals based in Russia.

The investigation also indicates that the Brașov incident may not have been an isolated operation.

Romanian intelligence claims the network’s potential targets included government-owned and private arms manufacturers, military-related facilities and other strategic industrial sites in several European countries.

Those claims remain subject to ongoing criminal investigation.

Bucharest summons Russian ambassador

The Romanian government escalated the matter diplomatically on 27th October.

Foreign Minister Dan Neculăescu summoned Russia’s ambassador, Vladimir Lipaev, to deliver a formal protest concerning the alleged operation.

According to the Romanian Foreign Ministry’s account reported by AGERPRES, Bucharest stated that evidence gathered during the investigation demonstrated Russian responsibility.

The ministry described the operation as part of a broader pattern of hostile activity affecting European states.

President Nicușor Dan also condemned the alleged sabotage, linking it to attempts to undermine European security and solidarity.

Moscow rejected the accusations.

The Russian Embassy maintained that the allegations were unfounded and disputed Romania’s account of the evidence presented during the diplomatic meeting.

The conflicting positions mean the attribution remains contested, notwithstanding the conclusions announced by Romania’s intelligence authorities.

A recruitment model designed for deniability

The Romanian Intelligence Service has provided details about how it believes the wider network recruits and directs participants.

According to its statement, recruitment can begin through social media with offers of payment for apparently minor activities, such as photographing or observing particular locations.

Subsequent assignments may become more serious, involving property destruction, arson or other acts of violence.

Individuals may be targeted because of financial difficulties or other personal vulnerabilities.

The service also identified methods allegedly used to conceal movements, payments and communications.

These include encrypted messaging applications, telephone numbers registered outside the country of operation and accommodation or transport arrangements booked under other identities.

Such methods can complicate investigations because the individuals physically carrying out an operation may have limited knowledge of the organisers.

Romanian authorities emphasised that individual indicators should be assessed in context and do not themselves prove involvement in sabotage.

Defence factories become a security concern

The case has implications beyond Romania.

European governments are investing in ammunition production, air defence systems and military technologies, partly in response to the continuing war in Ukraine.

The resulting expansion of manufacturing capacity creates additional infrastructure requiring protection.

Industrial sites may be vulnerable not only to direct attacks but also to disruption affecting nearby businesses, transport networks, power supplies and specialist contractors.

The Brașov investigation illustrates how an incident outside a defence factory’s perimeter can nevertheless raise questions about the security of the wider industrial complex.

It also demonstrates the importance of cooperation between European intelligence services and criminal investigators.

The detention of suspects in Germany and the identification of another in Poland show that investigations into alleged sabotage may cross several jurisdictions.

The wider European response

Romania’s allegations come amid growing concern over hostile activities involving cyberattacks, disinformation, surveillance and physical sabotage.

Attributing such incidents to a foreign government requires intelligence assessments, criminal evidence and international cooperation.

The public allegations against Russia do not replace the judicial process concerning the three suspects.

However, the investigation has already prompted a diplomatic response and additional scrutiny of industrial security.

For European governments seeking to expand their defence industries, the immediate challenge is protecting production facilities and associated infrastructure without allowing relatively small-scale disruptive operations to undermine wider manufacturing programmes.

The outcome of Romania’s criminal proceedings will be important in establishing the responsibility of those accused and clarifying how the alleged network operated across national borders.

Main Image: By MAPN – http://www.mapn.ro/fotodb/20051020_expomil?page=1, CC BY-SA 3.0, https://commons.wikimedia.org/w/index.php?curid=14997305

An investigation involving 17 European public-service news organisations has documented hundreds of suspected hybrid attacks across Europe in just over six months, revealing the scale of a security challenge that increasingly extends beyond conventional espionage and cyberwarfare.

The investigation, coordinated by the European Broadcasting Union, examined incidents reported between 1st April and 15th October 2026, including sabotage attempts, arson, airspace violations, suspicious drone activity and the exploitation of migration routes along the European Union’s eastern borders.

Published on 23rd October, the resulting interactive map provides a geographical picture of incidents publicly linked to Russia by intelligence agencies, law-enforcement authorities, government officials or reporting. The degree of attribution varies considerably, however, and many incidents remain under investigation.

The findings point to a fundamental problem for European security: hostile activities can be conducted across national boundaries without necessarily triggering the legal, military or political mechanisms designed to respond to conventional aggression.

Sabotage Without Conventional Warfare

Among the cases examined is an incident in Munich in September, when two Bulgarian nationals allegedly threw incendiary devices from a moving vehicle onto a construction site near several defence companies.

Police arrested the suspects after a witness reported the incident. Bavarian Interior Minister Joachim Herrmann and regional criminal investigators subsequently indicated that political motives were being considered. Investigators reportedly suspected possible involvement by Russia’s military intelligence service, the GRU, although the allegations have not been established in court.

The case illustrates growing concern about so-called disposable agents: individuals recruited to undertake relatively limited operations without formal intelligence training or a longstanding relationship with an intelligence service.

Such arrangements can complicate investigations. Even where perpetrators are identified, establishing a legally demonstrable connection between their actions and a foreign intelligence organisation may prove considerably more difficult.

Germany’s Federal Criminal Police Office has registered a mid-three-digit number of suspected sabotage and reconnaissance cases since the beginning of 2026, according to information provided to investigators involved in the European mapping project.

Only a small proportion have been publicly attributed to Russia. Four German incidents were included in the map, demonstrating the distinction between a broad national caseload and cases meeting the investigation’s publication criteria.

Europe’s Eastern Borders Under Pressure

The geographical distribution reveals substantial activity along NATO’s eastern flank, particularly around the Baltic states, Belarus and the Black Sea.

Incidents include repeated airspace violations, suspected reconnaissance operations and attempts to facilitate unauthorised border crossings. Lithuanian authorities have accused Belarus of deliberately exploiting migration as an instrument of political pressure.

Commercial shipping has also become increasingly exposed. Drone attacks involving vessels near Romania and Bulgaria have raised concerns about the extension of the war’s consequences into maritime areas adjoining EU and NATO territory.

These developments reinforce earlier warnings about Russia’s expanding sabotage campaign, particularly the difficulty of distinguishing isolated security incidents from coordinated operations intended to test national responses.

Teija Tiilikainen, director of the European Centre of Excellence for Countering Hybrid Threats, identified Russia’s invasion of Ukraine as an important factor behind the increasing pressure. According to her assessment, Moscow’s objectives include weakening Western unity and undermining continued support for Ukraine.

The Legal and Institutional Challenge

The central difficulty is not simply the absence of criminal legislation. Arson, espionage, sabotage and unlawful interference with critical infrastructure are already punishable under national laws.

Rather, the challenge involves establishing foreign direction, coordinating investigations across jurisdictions and identifying when a series of apparently separate offences constitutes a wider hostile campaign.

Germany’s domestic intelligence chief, Sinan Selen, has described the environment as a grey area between war and peace. German foreign intelligence chief Martin Jäger has similarly identified Russia as the country’s most dangerous adversary.

European governments are beginning to address these difficulties collectively. At their 15th–16th October summit, EU leaders condemned intensifying hybrid attacks and called for stronger resilience, greater use of existing countermeasures and accelerated work on drone security.

On 8th October, the Council also extended sanctions targeting Russian destabilisation activities until October 2027. The restrictions cover 80 individuals and 20 entities.

Meanwhile, a European Commission research initiative, published on 23rd October, proposes combining anticipation, active defence and retaliatory measures into a more coherent deterrence strategy.

From Individual Incidents to Collective Security

The investigation’s significance extends beyond the number of incidents recorded. By bringing together information previously dispersed among national authorities and separate investigations, it makes possible a wider assessment of the methods, geographical concentration and recurring characteristics of suspected hostile operations.

Nevertheless, the map does not establish Russian responsibility for every incident it records, nor does it constitute a complete European database. Russia has repeatedly denied conducting the hybrid attacks attributed to it.

For European governments, the unresolved question is how to move from recognising a pattern of hostile activity to demonstrating responsibility and responding effectively.

As EU foreign policy chief Kaja Kallas has warned, the consequences already extend beyond infrastructure disruption to risks affecting civilian lives.

The emerging security challenge therefore concerns not only the detection of individual perpetrators, but also Europe’s ability to connect incidents across borders, establish responsibility and prevent successive operations from becoming an accepted feature of the continent’s security environment.

Italian authorities are examining whether foreign interference helped intensify violent protests across the country, as Defence Minister Guido Crosetto warns that social media is being used as an instrument of hybrid warfare. Prime Minister Giorgia Meloni has introduced emergency security measures and deployed additional troops to Milan, while further demonstrations are planned for Saturday, 24 October.

Italy is investigating the possibility that foreign actors, including Russian operatives, helped amplify the violent unrest that swept Milan and other Italian cities on 17–18 October. The inquiry introduces a national security dimension to demonstrations initially driven by rising living costs, dissatisfaction with public services and broader economic grievances.

According to information disclosed about the government’s intelligence inquiries, officials working under Prime Minister Giorgia Meloni have requested assessments of whether foreign provocateurs contributed to the disorder. No public evidence has established that Moscow organised the violence, and Meloni’s office has declined to comment on the reported intelligence discussions.

The developments follow EU Today’s earlier coverage of the Milan disturbances, which documented extensive looting, attacks on police and the detention of hundreds of young people, many of them minors. Since then, Rome has moved beyond emergency consultations, approving legislation that expands police powers and introduces tougher criminal penalties for violent demonstrations.

On Saturday, 24 October, Italian security forces are preparing for another wave of protests, with additional military personnel, drones and specialist police units deployed in several major cities. The immediate question is whether the government can prevent further disorder while establishing how much of the unrest was locally organised and whether foreign information operations influenced its development.

Crosetto warns of hybrid warfare through social media

Defence Minister Guido Crosetto introduced the hybrid warfare argument during a Defence Procurement Forum in Rome on Tuesday, 20 October. In remarks recorded by Italian public broadcaster Rai, he described the disturbances as the culmination of a form of conflict being conducted through TikTok, YouTube and other social media platforms.

Crosetto argued that young Italians were undergoing what he called a form of counter-education outside their families and schools, absorbing political attitudes and values increasingly hostile to democratic institutions. He criticised Western governments for failing to recognise the consequences of this process, although he did not publicly present intelligence establishing Russian responsibility for the riots.

His comments also exposed differences within the governing coalition. Deputy Prime Minister Matteo Salvini questioned suggestions of Russian involvement, arguing that the immediate priority was identifying violent groups and preventing their movement into Milan.

Russian information operations under scrutiny

European investigators have identified activity by established Russia-linked disinformation networks, including Operation Overload and Doppelgänger, which have circulated and amplified material concerning the unrest.

These operations have previously used manipulated content, misleading narratives and coordinated online distribution to influence European audiences. In the present case, investigations into the online amplification of the violence have identified foreign exploitation of the disturbances, rather than proof that foreign governments organised them.

The European Commission has consequently declined to initiate emergency intervention against social media platforms, citing insufficient evidence linking foreign manipulation directly to the organisation of the protests.

France has taken a similarly cautious position. President Emmanuel Macron acknowledged that foreign actors had manipulated information after the violence but said there was no established evidence that they caused the disturbances. French Foreign Minister Jean-Noël Barrot has separately identified hostile narratives originating from Russia, China and Iran.

For European security authorities, the principal investigative question concerns the relationship between genuine domestic grievances and externally coordinated information campaigns. Foreign networks can exploit political divisions without necessarily directing the organisations or individuals involved in street violence.

Meloni introduces tougher security legislation

Meanwhile, Meloni’s government has proceeded with a substantial legislative response. Following cabinet approval on 20 October, Decree-Law No. 190 of 22 October 2026 entered into force on 23 October.

The legislation introduces penalties of two to five years’ imprisonment and fines of €10,000 to €20,000 for specified forms of organised violence during public demonstrations. Those organising or encouraging qualifying violent groups, including through digital communications, face potential prison terms of four to twelve years. It also expands provisions concerning juvenile offenders and preventive policing. The decree must undergo parliamentary consideration within 60 days.

Separately, the Italian Defence Ministry confirmed the deployment of 500 additional soldiers to Milan under Operation Strade Sicure until 31 December. The soldiers will reinforce security around sensitive locations and support existing police operations without acquiring additional judicial policing powers.

New demonstrations test the government’s response

Security arrangements have been intensified ahead of demonstrations scheduled for Saturday, 24 October, in Milan, Rome, Turin, Bologna, Florence and other cities.

According to the latest security preparations, Rome is deploying approximately 1,500 officers, while Milan is preparing a combined police and military presence supported by aerial surveillance.

On Friday, Italian investigators conducted searches targeting approximately 100 people suspected of involvement in the previous weekend’s disturbances, including 51 minors. Authorities are also monitoring online calls for renewed protests, some organised by groups whose leadership and membership remain unclear.

The unrest presents Meloni with two parallel challenges: containing violence and determining whether hostile foreign networks have played a significant role in its escalation. Italy’s investigations may help establish whether the events represent primarily a domestic public-order crisis, the exploitation of existing tensions by foreign actors, or a combination of both.

For Brussels, the outcome could influence future enforcement of the EU’s Digital Services Act and its wider response to foreign information manipulation. For now, the evidence supports concern about Russian amplification of European unrest, but not a definitive conclusion that Moscow orchestrated the riots.

Latvia has called for a European Union-wide ban on tourist visas for Russian citizens, reopening a dispute between member states over border security, freedom of movement and the treatment of Russian nationals during Moscow’s continuing war against Ukraine.

Prime Minister Andris Kulbergs is pressing Brussels and other European capitals to adopt a common approach, arguing that continued visa issuance by some Schengen countries weakens restrictions imposed by states bordering Russia.

His intervention comes amid growing concerns over suspected Russian sabotage, espionage and other hostile activities across Europe. The Latvian government regards restrictions on non-essential travel as an additional measure to reduce potential security risks.

According to details of the Latvian proposal, Kulbergs has criticised the continued issuance of tourist visas by countries including France, Italy and Spain, maintaining that the consequences extend beyond the states granting entry.

The proposal would go considerably further than the restrictions already introduced by the EU since Russia launched its full-scale invasion of Ukraine in February 2022.

A divided European visa policy

The European Union suspended its visa facilitation agreement with Russia in September 2022, ending the preferential conditions previously available to Russian applicants.

The Council’s original decision introduced more demanding documentation requirements, higher application fees and stricter scrutiny, but it did not prohibit Russian citizens from obtaining short-stay visas.

National authorities therefore retained considerable discretion when assessing applications, subject to common Schengen rules.

In November 2025, the Commission introduced additional restrictions on multiple-entry visas, requiring Russian travellers covered by the new rules to apply again for subsequent visits.

The EU has also agreed a legal basis for restrictions targeting Russian military personnel and former combatants involved in the invasion of Ukraine, although implementation requires further measures.

Latvia argues that these steps remain insufficient because ordinary tourist visas continue to be available through some European consulates.

Once admitted to the Schengen area, a visitor can generally travel between participating countries without routine internal border checks. This creates difficulties for governments seeking to enforce stricter national entry policies.

Security concerns on the eastern border

Latvia shares borders with Russia and Belarus and has repeatedly warned that Moscow’s activities present risks extending beyond conventional military threats.

European governments have investigated incidents involving suspected sabotage, cyber operations, intelligence gathering and interference with transport infrastructure.

Such concerns have intensified following drone incursions and security alerts affecting NATO’s eastern members.

These concerns were also evident in EU Today’s reporting on suspected security breaches in Europe, although the circumstances of individual incidents must be investigated rather than assumed to involve foreign intelligence services.

The distinction is relevant to the Latvian proposal. European intelligence agencies have identified Russian-linked activities, but this does not establish that ordinary Russian tourists are collectively involved in intelligence operations.

Supporters of tighter visa restrictions argue that limiting discretionary entry could reduce opportunities for hostile activity and simplify security screening.

Opponents question whether a nationality-based prohibition would be proportionate or effective, particularly when intelligence operations may involve individuals travelling under other nationalities or using established residency arrangements.

Political and legal complications

A comprehensive tourist visa ban would require agreement on its precise scope, legal basis and implementation.

European governments would need to determine how the restrictions apply to Russian citizens with family members in the EU, people travelling for humanitarian purposes and individuals seeking protection from the Russian authorities.

The EU Visa Code already permits refusals where applicants present security risks, but a general prohibition based on nationality would involve a different policy decision.

Humanitarian exceptions would be particularly important for Russian dissidents, independent journalists and other individuals facing political persecution.

France has supported restrictions on entry by Russian combatants, while other member states are considering further measures. That does not necessarily mean they support Latvia’s broader proposal covering ordinary tourists.

Kulbergs is also seeking greater European financial assistance for countries facing the economic and security consequences of their proximity to Russia and Belarus.

Sanctions and Schengen controls

The renewed visa debate coincides with disagreements between Washington and Brussels over economic restrictions on Moscow.

EU leaders have maintained that sanctions should remain in place until Russia ends its aggression against Ukraine. Visa policy, however, requires separate legal and political consideration from economic sanctions.

Latvia’s proposal has not been adopted as an EU-wide rule. The immediate question is whether enough member states are prepared to move from tighter individual screening towards a general restriction on Russian leisure travel.

Until that agreement is reached, European countries will continue to apply different policies within a shared Schengen system, leaving the security concerns raised by Riga unresolved.

An apparent vehicle breach at Leipzig/Halle Airport has renewed questions about infrastructure protection. After an earlier drone incident blamed on Russia, Germany faces the challenge of responding firmly while allowing evidence to determine responsibility.

A damaged airport fence would ordinarily be a local policing story. At Leipzig/Halle, it carries a heavier significance. Following an attempted drone attack earlier this year, another security incident inevitably raises questions about whether Germany can adequately protect infrastructure operating in an increasingly hostile environment.

Yet the central distinction remains essential: an apparent perimeter breach is under investigation. Its cause, purpose and perpetrators have not been established. The implications deserve scrutiny; suggestions of another foreign operation remain speculation.

Police said damage was discovered shortly before 11pm on Saturday, October 17th. The northern runway was closed while federal and state officers searched the grounds. In a Sunday morning update, investigators said a vehicle had most probably broken through the fence. Initial searches found neither unauthorised people nor suspicious objects, with further searches planned.

Those findings provide reassurance without resolving the incident. Investigators still need to establish how the damage occurred, whether anyone entered restricted areas and whether the apparent breach was deliberate. Until those questions are answered, describing it as sabotage would run ahead of the evidence.

The operational picture also requires proportion. Although the northern runway remained closed, airport spokesman Uwe Schuhart said on Sunday morning that passenger and freight flights were continuing without restrictions because the second runway remained available. This was a significant security response, but not an airport-wide shutdown.

That distinction matters politically. Public confidence depends on authorities explaining both the seriousness of a suspected intrusion and the effectiveness of arrangements that keep essential services functioning.

Leipzig’s recent history nevertheless makes heightened vigilance understandable. Reuters recalled that investigators discovered an explosive-laden drone near a runway in August. German officials subsequently attributed responsibility to Russia, which denied the allegations. No connection between that episode and the latest fence damage has been established.

The earlier incident changes the context in which airport authorities must make decisions. Once a location has faced a potentially lethal threat, uncertainty becomes more expensive. An unexplained opening in a perimeter cannot be treated casually simply because the first search produces nothing suspicious.

This creates an uncomfortable imbalance. Damage that takes little time to inflict can require extensive searches, specialist personnel and precautionary closures. Whether caused by criminality, recklessness or hostile intent, a breach can impose costs far beyond the price of repairing a fence.

The wider German security debate gives those concerns additional weight. On October 12, Reuters reported warnings from Interior Minister Alexander Dobrindt about a “shadow war”. Domestic intelligence chief Sinan Selen described Russian activities encompassing disinformation, sabotage and assassination preparations, and said he expected further incidents resembling the earlier Leipzig drone episode.

Those warnings justify preparedness. They do not establish who damaged this fence. Conflating the two would weaken public understanding and risk turning every unexplained incident into an assumed act of geopolitical aggression.

For policymakers, the practical questions are more useful than premature attribution. How quickly was the damage detected? Could security personnel reconstruct movements around the affected area? Were protective measures proportionate to the risks? And what improvements, if any, would reduce the interval between a breach and a reliable assessment?

The airport’s continued operation offers one encouraging lesson: resilience includes maintaining service while investigating danger. A second runway provided operational flexibility. Similar thinking should guide investment across critical infrastructure, where preventing every disruption may be impossible but limiting its consequences remains achievable.

There is also a clear accountability test. Once investigators establish what happened, authorities should explain the findings and any resulting changes without revealing details that would assist future intruders. An accident, an ordinary crime and a hostile operation would demand different responses.

For now, Leipzig presents a warning about vulnerability rather than proof of another attack. Germany needs the capacity to investigate rapidly, protect exposed facilities and sustain normal life under pressure. Its credibility will depend on demonstrating those capabilities—and maintaining the discipline to distinguish justified suspicion from established fact.

Main Image: WikiABG

Explosive Drone Discovery at German Airport Exposes Europe’s Growing Hybrid Security Challenge

Poland has launched a nationwide security operation after three knife attacks at educational institutions left one woman dead and more than a dozen people injured. Police have detained 117 people amid a wave of online threats, while intelligence officials are examining whether Russian disinformation networks exploited the violence to spread panic.

Poland is confronting an unprecedented school security crisis after a succession of violent attacks by young people triggered widespread fear, school closures and a nationwide police mobilisation. By Sunday, 11 October, officers had detained 117 people and conducted nearly 64,000 security checks at educational establishments, as the authorities attempted to contain both genuine threats and an escalating campaign of intimidation on social media.

The crisis reached its height on Friday, 9 October, when warnings circulated about a supposed nationwide killing campaign known as “Bloody Friday”. Videos, threatening messages and lists of potential targets spread through TikTok, messaging platforms and school discussion groups, prompting parents to keep children at home and several local authorities to suspend classroom teaching.

Although police have found no evidence of an organised nationwide conspiracy, the violence that preceded the rumours was real. Three separate attacks took place between 7 and 10 October, while investigators are examining hundreds of other incidents involving threats or suspected criminal activity.

Two attacks that triggered nationwide panic

The first major incident occurred on Wednesday, 7 October, at a vocational school in Ostrołęka, north-east of Warsaw. A 19-year-old student armed with a machete attacked pupils, teachers and other people in and around the building, injuring nine victims before harming himself.

Investigators subsequently discovered a homemade explosive device inside his backpack. The suspect was arrested, and prosecutors brought nine charges against him, including attempted murder. The discovery of explosives raised further questions about the extent of his preparations and the possibility of a substantially higher death toll.

The following day, a 15-year-old former pupil entered a primary school in Leszczydół-Nowiny, near Wyszków, and attacked three members of staff with a knife. A 37-year-old caretaker died from her injuries, while two teachers, including the headteacher, were wounded.

According to investigators, the teenager wore a helmet-mounted camera, raising suspicions that he intended to record the assault. The official prosecution statement confirmed the victim’s death and the detention of the suspect.

The attacks were followed by threatening messages from other teenagers, including a video attributed to a 17-year-old in the Przasnysz district who claimed to be participating in a competition involving killings. Police subsequently detained him. In Sierpc, another 17-year-old was arrested after allegedly discussing plans for violence at school; officers discovered two knives.

Thousands of schools under police surveillance

The rumours produced an immediate reaction. Schools in Wyszków, Ciechanów, Pułtusk and other municipalities cancelled classroom teaching or introduced remote lessons. Elsewhere, parents independently withdrew their children, leaving some classrooms largely empty.

Police launched an extensive preventive operation, deploying additional officers around schools and investigating online threats.

According to the figures released on 11 October, the authorities had recorded 275 incidents requiring investigation, detained 117 people and carried out nearly 64,000 checks at schools, nurseries and other educational facilities.

The situation deteriorated further on Saturday, 10 October, when a 21-year-old student attacked three people at a post-secondary educational institution in Warsaw. Two 17-year-old girls and a 24-year-old woman were injured. One victim required hospital treatment, although none of the injuries was considered life-threatening.

Interior Minister Marcin Kierwiński subsequently stated that investigators had established no links between the recent attacks. The authorities nevertheless remain concerned about imitation offences, particularly where threatening material circulates among teenagers through closed online communities.

Russia’s possible role in spreading panic

The events have also raised questions about whether hostile foreign actors deliberately amplified the crisis. Tomasz Siemoniak, Poland’s minister responsible for coordinating the intelligence services, warned that Russian organisations routinely exploit domestic emergencies to spread disinformation and undermine confidence in public institutions.

In his statement on 9 October, Siemoniak acknowledged the possibility of foreign involvement but stressed the need for evidence before assigning responsibility.

There is, at present, no publicly established evidence that Moscow organised the school attacks or directed the subsequent threats. Nevertheless, the rapid circulation of alarming videos, fabricated warnings and unverified target lists illustrates how genuine violent incidents can be exploited to disrupt everyday life without further physical attacks.

The episode also presents a challenge for European regulators. Poland is examining measures against dangerous online content, while its existing obligations under the EU Digital Services Act provide a framework for addressing systemic risks associated with major platforms.

For Donald Tusk’s government, the immediate priority is preventing further attacks as schools reopen under heightened security. The longer-term challenge concerns the interaction between online radicalisation, copycat violence and disinformation capable of transforming isolated crimes into a national emergency.

The European Commission is preparing proposals to impose tighter visa restrictions on Russian citizens entering the Schengen area, with new measures expected to be presented in January 2027 following pressure from several member states concerned about Russia’s expanding hybrid operations across Europe.

Poland, Sweden and Estonia are among the countries demanding a tougher approach to Russian visitors, particularly former military personnel who fought in Ukraine. The proposals could affect hundreds of thousands of Russian nationals who continue to receive visas for travel to the European Union despite restrictions introduced following Moscow’s full-scale invasion of Ukraine in February 2022.

According to a report published on Sunday, EU officials are finalising plans to address vulnerabilities in the Schengen visa system, which governments increasingly regard as a potential entry point for individuals involved in intelligence operations, organised crime and acts of sabotage.

Swedish Justice Minister Gunnar Strömmer said the Commission was working towards a January announcement, although Stockholm would prefer an earlier decision. He told Politico that vulnerabilities in the existing arrangements could be exploited by hostile actors.

The initiative is expected to feature in discussions surrounding the Foreign Affairs Council meeting on 12 October, when ministers will examine Russia’s intensifying hybrid campaign against EU member states.

Schengen visas remain a security concern

Despite the deterioration in relations between Brussels and Moscow, Russian citizens continue to receive substantial numbers of Schengen visas. Approximately 478,000 tourist visas were reportedly issued to Russian nationals in 2025, including a significant proportion allowing multiple entries.

The figures have renewed questions about whether existing screening arrangements adequately reflect the security environment created by Russia’s war against Ukraine.

In September 2022, the EU suspended its visa facilitation agreement with Russia, ending preferential treatment and introducing stricter application procedures, additional documentation requirements and more restrictive conditions for multiple-entry visas.

However, the decision did not amount to a general prohibition on Russian tourism. National authorities retained considerable discretion over applications, producing differences in how individual Schengen countries handle Russian visitors.

The Commission’s existing visa guidelines also preserve access for certain categories of travellers, including journalists, political dissidents, civil society representatives and people travelling for essential family reasons.

The new initiative would therefore concern not only the number of visas issued but also the extent to which national screening decisions can affect the security of other Schengen countries. Under the Schengen system, a visa issued by one participating state generally permits its holder to travel throughout the area.

Estonia calls for restrictions on former Russian soldiers

Estonia has taken a particularly forceful position, proposing an EU-wide entry ban targeting former members of the Russian armed forces who participated in the invasion of Ukraine. Estonian Foreign Minister Margus Tsahkna estimates that approximately 650,000 former Russian combatants could fall within the category of individuals requiring closer scrutiny.

Tallinn has advocated individual entry restrictions rather than relying exclusively on broader measures covering Russian nationals generally. Tsahkna warned that former soldiers, particularly those with combat experience and connections to Russian intelligence services, could present a serious security challenge if they entered European countries.

He suggested that Moscow could exploit former combatants to penetrate organised criminal networks or facilitate violent operations against European targets. These assessments remain security warnings rather than evidence that Russian veterans as a group are involved in such activities.

A coordinated European policy would also seek to prevent individuals refused entry by one member state from exploiting differences in national visa procedures elsewhere.

Restrictions on Russian diplomats also under consideration

The visa proposals form part of a wider effort to restrict the activities of Russian nationals whose presence in Europe may present security risks. EU foreign policy chief Kaja Kallas has previously indicated that member states are considering tighter controls on the movement of Russian diplomats within Schengen, alongside restrictions on visas for former combatants and a reduction in Russian tourism.

One proposal would prevent Russian diplomatic personnel from travelling beyond the member state in which they are accredited. Such restrictions would complicate cross-border activities by diplomatic officials suspected of conducting intelligence operations under official cover.

The issue has acquired greater urgency as European governments report an expanding pattern of Russian-linked sabotage, including suspected arson attacks, cyber operations and attempts to disrupt critical infrastructure.

Migration Commissioner Magnus Brunner acknowledged that the initial decline in visa issuance to Russian nationals had levelled off. He urged member states to reduce the number of visas granted and to strengthen scrutiny of applicants.

January proposals will test EU consensus

The immediate question is whether member states can agree on common restrictions that go beyond the existing visa framework. An outright prohibition on Russian tourism would represent a significant departure from the current approach, under which national governments retain responsibility for individual visa decisions.

More narrowly targeted measures against former combatants could prove easier to justify on security grounds, although identifying eligible individuals would require reliable information and cooperation between national authorities. The Commission has yet to publish its proposals, and the precise legal instruments under consideration remain unclear.

Foreign ministers meeting on Monday will discuss Russia’s hybrid campaign and possible European responses. The Council’s published agenda places the issue in the context of Moscow’s continuing aggression against Ukraine.

Whether the Commission ultimately proposes new binding restrictions or stronger common guidelines, the central difficulty remains the same: a Schengen system built around common freedom of movement must accommodate increasingly different national assessments of the security risks associated with travel from Russia.

Three armed men accompanying at least 20 migrants from Belarus threatened Latvian soldiers and attempted to force the group across the frontier, according to Latvia’s National Armed Forces.

Hours later, masked intruders crossed into Latvia, damaged an electrical distribution unit and stole surveillance cameras before retreating into Belarus.

Latvia has reported an unusually aggressive incident on its border with Belarus in which armed, masked men threatened Latvian troops during an attempted migrant crossing, followed several hours later by an incursion targeting surveillance infrastructure.

The confrontation began on Monday evening when at least 20 people approached the Latvian border from Belarus accompanied by three masked men. Latvia’s National Armed Forces said the escorts were armed, issued threats to Latvian soldiers and actively drove the migrants towards the frontier. Latvian troops prevented the group from entering the country.

Several hours later, masked individuals crossed from Belarus into Latvian territory and targeted equipment used to monitor the border. Interior Minister Jānis Dombrava said they damaged an electrical distribution cabinet and removed surveillance cameras before returning across the frontier ahead of the arrival of a Latvian border-guard unit. Latvian authorities have not publicly identified the intruders or established whether all of those involved in the second incident were the same men who had earlier accompanied the migrants.

Dombrava described the events as markedly more aggressive than previous episodes on the frontier. He warned that Belarus should understand that incidents of this kind could have “more serious consequences” for the country.

The episode comes amid sustained pressure on Latvia’s 172km border with Belarus. According to the Latvian State Border Guard’s latest figures, 21 people were prevented from crossing illegally from Belarus on Tuesday, taking the total number stopped at that frontier since the beginning of 2026 to 11,946.

Latvia has for several years treated irregular migration from Belarus not simply as an immigration issue but as a security operation. Riga accuses the Belarusian authorities of deliberately facilitating migrant movements towards the EU border as a means of exerting political pressure.

In January, the Latvian National Armed Forces published what it described as evidence of Belarusian state involvement in organising illegal crossings. The military said documented cases included migrants being transported in Belarusian military vehicles and Belarusian officials participating in operations to direct people towards Latvia. That earlier material does not, however, establish the identities or affiliation of those involved in this week’s armed confrontation.

Pressure on the frontier intensified during the summer. In July, Latvian soldiers used tear gas and fired a warning shot when a group attempting to enter from Belarus refused orders to withdraw and, according to Latvian authorities, threw logs towards security personnel.

The methods used to circumvent the fortified border have also become more elaborate. In August, border guards found Latvia’s first known tunnel used for an illegal crossing from Belarus after intercepting 15 people near Skrudaliena. A second tunnel was discovered nine days later near Krāslava after another 28 people crossed the frontier. The State Border Guard said both incidents formed part of the continuing pressure on Latvia’s eastern border.

Riga responded in August by launching Operation VILKATIS, bringing together border guards, police and the armed forces under a co-ordinated security operation. Surveillance drones and other military capabilities have been deployed to reinforce monitoring of the frontier.

On Tuesday, the same day Latvian authorities disclosed the latest confrontation, the government extended Operation VILKATIS until 31 December. The Cabinet described the instrumentalisation of migration by Belarus as a hybrid threat and said additional resources would continue to be used along the eastern border.

The involvement of armed escorts changes the immediate security calculation for Latvian personnel. Previous incidents have largely centred on migrants, smugglers and attempts to bypass physical barriers. This week’s episode included direct threats against serving soldiers, followed by an unauthorised crossing and deliberate interference with border-monitoring equipment.

Latvia has not publicly attributed the operation to a particular Belarusian military, security or border agency. The account released by Riga therefore establishes an armed incident originating from Belarusian territory, but not yet who ordered or organised it. For Latvia, however, it adds another element to a border that is already being managed as part of the country’s wider response to hybrid threats on NATO and the EU’s eastern flank.

Main Image: By Saeima – https://www.flickr.com/photos/saeima/53117747287/, CC BY-SA 2.0, https://commons.wikimedia.org/w/index.php?curid=136391897