Journalists from 17 European public service broadcasters, coordinated by the European Broadcasting Union’s (EBU) Eurovision News Spotlight network, published an interactive map on 23 October 2026. It documents hybrid incidents linked to Russia across 17 European countries between 1 April and 15 October. Journalists compiled a database of hundreds of reported incidents, categorizing each by type and the source and strength of its alleged links to Russia, then verifying them through open-source research.

The map comes as officials warn the campaign is growing. On 28 September, EU foreign policy chief Kaja Kallas said in Brussels that Russia was planning more acts of sabotage to divide societies and intimidate them into abandoning their support for Ukraine. The points on the map represent an incomplete list of publicly known cases attributed to Russia or suspected of being linked to it, the report states.

The map covers airspace violations, sabotage attempts, “disposable” agents with no formal intelligence training, migration used as a weapon, and Russian military activity near or across European borders. It excludes cyberattacks, influence operations, and espionage by trained intelligence officers.

The EBU calls the result a very conservative estimate, not an official tally. Russia has consistently denied responsibility for the incidents. Many single points represent several incidents of the same type in one area or in quick succession. In Moldova, for example, Defense Minister Anatolie Nosatîi said on 30 September that the government had recorded 84 drone incursions.

Four German incidents are on the map, out of many more

The map shows four incidents in Germany, according to BR.

• On 2 August, German authorities arrested a 33-year-old Ukrainian man in Thuringia on suspicion of photographing a Bavarian weapons manufacturer for a foreign intelligence service as part of an alleged sabotage plot.
• On 4 August, a drone carrying explosives and a detonator struck the wing of a Ukrainian An-124 cargo plane at Leipzig/Halle Airport but failed to explode.
• On 3 September, attackers threw firebombs from a car onto a construction site next to defense firms in Munich, and German security authorities suspect Russian intelligence.
• On 14 September, investigators learned of a crashed drone found near the Bundeswehr’s Wunstorf air base.

Internal papers from the new Joint Hybrid Defense Center, seen by Correctiv, record 163 suspected sabotage cases in 2026 up to 19 August. The targets included rail lines, military facilities, substations, and radio masts. The same papers record 1,034 drone overflights of critical infrastructure, military sites, and defense companies, and 25 espionage investigations. The papers cover possible attacks by Russia, China, and Iran, and media did not report a breakdown of the sabotage cases by country.

European leaders sound the alarm over Russian hybrid attacks

On 15 April, Swedish civil defense minister Carl-Oskar Bohlin said pro-Russian groups had moved from denial-of-service attacks to attempts at destructive cyberattacks, including one on a Swedish power plant in 2025. On 1 September, German Foreign Minister Johann Wadephul named Russia as the perpetrator of the Leipzig attack and accused Moscow of “blatant hostility” toward Germany.

On 18 September, French President Emmanuel Macron said Russia’s hybrid attacks would not go unanswered and ordered a plan to protect France’s critical infrastructure. On 1 October, German Chancellor Friedrich Merz said Germany was preparing for new hybrid attacks, “including serious ones.” NATO Secretary General Mark Rutte on 14 October called the attacks a sign of Russian weakness at a press conference in Tallinn and said NATO would react where needed without being “rattled.”

Russia attacked Ukraine with 140 drones, including Shahed and Gerbera attack drones and Parodiya decoys, and four missiles overnight on 26 October, the Ukrainian Air Force reported. The missiles were one Kh-31P anti-radiation missile and three Kh-59/69 air-launched guided missiles, launched from occupied parts of Zaporizhzhia and Kherson oblasts.

Jet-powered Shaheds are becoming a larger part of Russia’s aerial campaign, challenging Ukraine’s air defenses and prompting efforts to develop faster interceptors. Alongside guided bomb attacks and strikes on energy infrastructure, these attacks add to the pressure on Ukraine’s defenses as winter approaches, and Ukraine says Russia has a plan for it.

Air defenses downed or suppressed 112 drones, including 56 of the 70 jet-powered Shaheds, and three Kh-59/69 missiles, according to preliminary Air Force figures. Hits were recorded at 15 locations, and debris fell at four more.

Four wounded in Zaporizhzhia

Russian strikes on Zaporizhzhia overnight wounded two women aged 22 and 30, and two men aged 40 and 61, the State Emergency Service (DSNS) said. The strikes damaged the windows of a hotel and two buses, a private house, and four outbuildings, and three cars caught fire. The oblast administration had first reported one wounded.

Later in the morning, Russian forces hit a shopping center building that had already closed, the administration said. The building caught fire. According to preliminary information, no one was hurt.

Guided bombs hit two districts of Izium

At about 02:40 on 26 October, Russian forces struck two districts of Izium in Kharkiv Oblast with guided aerial bombs, and three people needed medical help, the city military administration said, as Suspilne Kharkiv reported. More than 10 private houses and a youth sports school were damaged, and several streets lost power and internet.

Russia struck a burning Odesa Oblast plant twice more as firefighters worked

Overnight, a Russian attack destroyed an industrial enterprise in Odesa Oblast and set it on fire, the DSNS reported. As firefighters put out the blaze, Russian forces struck the site twice more. The rescuers were in shelter and were not hurt, but fire equipment was damaged. At another address, four garages were damaged and a car was destroyed. The oblast administration said there were no casualties.

Energy facility hit in Khmelnytskyi Oblast

On the evening of 25 October, a Russian attack damaged an energy facility in Kamianets-Podilskyi district of Khmelnytskyi Oblast, causing emergency power outages, the oblast administration said. Windows were also damaged in two residential buildings. No casualties were reported.

Meanwhile, Russian drones attacked the Nikopol district of Dnipropetrovsk Oblast more than 10 times overnight, damaging a high-rise and an administrative building, the oblast administration reported. No one was hurt. Mykolaiv Oblast also came under Shahed attack overnight, with no casualties, according to its administration.

The attack continued into the day. On the morning of 26 October, a Russian strike hit a civilian infrastructure site in Vinnytsia, the oblast administration said. Preliminary reports showed no casualties.

Strikes on 26 October kill three in Donetsk and Dnipropetrovsk oblasts

On 26 October, Russian aircraft dropped four guided bombs on homes and shops in the center of Yasnohirka near Kramatorsk, killing one person and wounding 10, the DSNS said. Among the wounded is a 13-year-old girl, Donetsk oblast head Vadym Filashkin said. In Sloviansk, a Russian airstrike destroyed a private house, and rescuers recovered the body of its owner, the DSNS said.

A Russian drone strike on Pavlohrad in Dnipropetrovsk Oblast killed one person and injured seven, including two children, the DSNS said. The injured include two 10-year-old girls, the oblast administration said.

Six hurt in Kharkiv Oblast over the past day

Over the past 24 hours, Russian attacks hurt six people in Kharkiv Oblast, oblast head Oleh Syniehubov said. In Kharkiv, a 60-year-old man and a 14-year-old boy suffered acute stress reactions. Two women aged 51 and 71 were wounded in Krasnopavlivka. His count lists two wounded men in Izium, aged 72 and 52, while the city administration says three people there needed medical help. Russian attacks also set fire to a house in Kotliary, a production building in Vilshany, a building in Derhachi, a house in Mykolaivka, and a site in Kharkiv’s Kholodnohirskyi district, the DSNS reported.

In Sumy Oblast, Russian attacks over the past day injured five people, the National Police said, including two women aged 76 and 56 hit by a drone in Sumy community.

On 25 October: two killed in Kherson and Donetsk oblasts

In Chernihiv Oblast, Russian attacks on 25 October injured a man at a hangar in Pryluky district and a woman at a grain store in the Novhorod-Siverskyi area, the oblast administration said. Drones also damaged a school in a village of Koriukivka community, and a strike destroyed 700 metric tons of potatoes at an enterprise in Mena community, the administration said. A large warehouse fire broke out in Koriukivka district, the DSNS said.

In Kherson Oblast, Russian attacks killed one person and wounded eight in the 24 hours to 06:00 on 26 October, the oblast administration reported. On 25 October, a Russian drone strike on a minibus in Kherson’s Central district killed one person and wounded six, the administration said after one more man sought medical help. Police said the minibus was hit by an FPV drone.

In Donetsk Oblast, Russian forces killed one person in Kramatorsk and wounded 10 across the oblast on 25 October, Filashkin said. Russia hit Kramatorsk with drones and six KAB-250 guided bombs, and 18 hits on Sloviansk wounded four, police said.

On 25 October, a Russian attack on Synelnykove district of Dnipropetrovsk Oblast sent a 30-year-old man to hospital, the oblast administration said. In Vinnytsia, the number of people injured in the Russian attack on the morning of 25 October rose to seven, two of them hospitalized, the DSNS said. In Uman, an 86-year-old woman burned in the Russian attack on 21 October died in hospital, the Cherkasy oblast administration said.

An investigation involving 17 European public-service news organisations has documented hundreds of suspected hybrid attacks across Europe in just over six months, revealing the scale of a security challenge that increasingly extends beyond conventional espionage and cyberwarfare.

The investigation, coordinated by the European Broadcasting Union, examined incidents reported between 1st April and 15th October 2026, including sabotage attempts, arson, airspace violations, suspicious drone activity and the exploitation of migration routes along the European Union’s eastern borders.

Published on 23rd October, the resulting interactive map provides a geographical picture of incidents publicly linked to Russia by intelligence agencies, law-enforcement authorities, government officials or reporting. The degree of attribution varies considerably, however, and many incidents remain under investigation.

The findings point to a fundamental problem for European security: hostile activities can be conducted across national boundaries without necessarily triggering the legal, military or political mechanisms designed to respond to conventional aggression.

Sabotage Without Conventional Warfare

Among the cases examined is an incident in Munich in September, when two Bulgarian nationals allegedly threw incendiary devices from a moving vehicle onto a construction site near several defence companies.

Police arrested the suspects after a witness reported the incident. Bavarian Interior Minister Joachim Herrmann and regional criminal investigators subsequently indicated that political motives were being considered. Investigators reportedly suspected possible involvement by Russia’s military intelligence service, the GRU, although the allegations have not been established in court.

The case illustrates growing concern about so-called disposable agents: individuals recruited to undertake relatively limited operations without formal intelligence training or a longstanding relationship with an intelligence service.

Such arrangements can complicate investigations. Even where perpetrators are identified, establishing a legally demonstrable connection between their actions and a foreign intelligence organisation may prove considerably more difficult.

Germany’s Federal Criminal Police Office has registered a mid-three-digit number of suspected sabotage and reconnaissance cases since the beginning of 2026, according to information provided to investigators involved in the European mapping project.

Only a small proportion have been publicly attributed to Russia. Four German incidents were included in the map, demonstrating the distinction between a broad national caseload and cases meeting the investigation’s publication criteria.

Europe’s Eastern Borders Under Pressure

The geographical distribution reveals substantial activity along NATO’s eastern flank, particularly around the Baltic states, Belarus and the Black Sea.

Incidents include repeated airspace violations, suspected reconnaissance operations and attempts to facilitate unauthorised border crossings. Lithuanian authorities have accused Belarus of deliberately exploiting migration as an instrument of political pressure.

Commercial shipping has also become increasingly exposed. Drone attacks involving vessels near Romania and Bulgaria have raised concerns about the extension of the war’s consequences into maritime areas adjoining EU and NATO territory.

These developments reinforce earlier warnings about Russia’s expanding sabotage campaign, particularly the difficulty of distinguishing isolated security incidents from coordinated operations intended to test national responses.

Teija Tiilikainen, director of the European Centre of Excellence for Countering Hybrid Threats, identified Russia’s invasion of Ukraine as an important factor behind the increasing pressure. According to her assessment, Moscow’s objectives include weakening Western unity and undermining continued support for Ukraine.

The Legal and Institutional Challenge

The central difficulty is not simply the absence of criminal legislation. Arson, espionage, sabotage and unlawful interference with critical infrastructure are already punishable under national laws.

Rather, the challenge involves establishing foreign direction, coordinating investigations across jurisdictions and identifying when a series of apparently separate offences constitutes a wider hostile campaign.

Germany’s domestic intelligence chief, Sinan Selen, has described the environment as a grey area between war and peace. German foreign intelligence chief Martin Jäger has similarly identified Russia as the country’s most dangerous adversary.

European governments are beginning to address these difficulties collectively. At their 15th–16th October summit, EU leaders condemned intensifying hybrid attacks and called for stronger resilience, greater use of existing countermeasures and accelerated work on drone security.

On 8th October, the Council also extended sanctions targeting Russian destabilisation activities until October 2027. The restrictions cover 80 individuals and 20 entities.

Meanwhile, a European Commission research initiative, published on 23rd October, proposes combining anticipation, active defence and retaliatory measures into a more coherent deterrence strategy.

From Individual Incidents to Collective Security

The investigation’s significance extends beyond the number of incidents recorded. By bringing together information previously dispersed among national authorities and separate investigations, it makes possible a wider assessment of the methods, geographical concentration and recurring characteristics of suspected hostile operations.

Nevertheless, the map does not establish Russian responsibility for every incident it records, nor does it constitute a complete European database. Russia has repeatedly denied conducting the hybrid attacks attributed to it.

For European governments, the unresolved question is how to move from recognising a pattern of hostile activity to demonstrating responsibility and responding effectively.

As EU foreign policy chief Kaja Kallas has warned, the consequences already extend beyond infrastructure disruption to risks affecting civilian lives.

The emerging security challenge therefore concerns not only the detection of individual perpetrators, but also Europe’s ability to connect incidents across borders, establish responsibility and prevent successive operations from becoming an accepted feature of the continent’s security environment.

• There are clear parallels between the AI boom and the dot-com bubble, tech investor Paul Wick says.
• But solid demand, strong earnings, and less mania make for a "healthier" backdrop, Wick said.
• Seligman's chief investor brushed off Michael Burry's worries but flagged some trends to watch.

The AI boom has shades of the dot-com bubble, but fears of an imminent crash and mass unemployment are overblown, a veteran tech investor says.

At the turn of this century, there was an explosion in dot-com startups being formed, and a huge infrastructure buildout with telecoms "aggressively" spending on wired and wireless networks, Paul Wick told Business Insider in an interview this week.

The chief investor of Seligman Investments — a group within Columbia Threadneedle Investments that manages over $40 billion of assets and comprises a hedge fund, a mutual fund, and a venture capital arm — said there were clear parallels between that period and the current boom in AI startups and data-center spending. He also noted that energy prices and interest rates jumped then as they've done this year.

But Wick noted there isn't the same IPO frenzy now, or the same "frenetic environment" where stocks soar fivefold or tenfold in a day. He also said that by late 2000, a slowdown in IT spending was being forecasted for 2001, whereas enterprise spending on AI remains strong and recent tech earnings have been robust.

Simply put, the situation seems "healthier" now than in 2000, he said.

Business Insider asked Wick about Michael Burry's warnings this year around AI. "The Big Short" investor has called out aggressive accounting, circular financing, hidden debt, and overinvestment in depreciating assets like microchips as reasons to be skeptical that the boom has legs.

Wick said that Burry, known for predicting and profiting from the collapse of the mid-2000s housing bubble, has been "early or downright wrong on many other things."

Burry has previously defended his track record, citing his correct predictions and sharing charts showing the timing of his market calls.

As for concerns about Nvidia's efforts to grow the AI ecosystem by investing in data center developers and software companies, Wick emphasized that the chipmaker is "extraordinarily profitable."

He cast doubt on whether Nvidia should spend its spare cash only on buybacks, rather than bolstering its customers, especially as several of the industry's biggest players are working to develop their own AI chips to reduce their reliance on Nvidia.

But he also flagged some industry trends to watch, including enterprise clients opting to use older models or build their own, and token pricing coming under pressure as users embrace open-source models, raising questions over the size of the market opportunity for the likes of OpenAI and Anthropic.

Navigating a new world

Wick weighed in on how a young person can get ahead in the AI era.

"It used to be that a degree in computer science was a ticket to success," he said.

A better option today might be to learn a trade, as there's "booming demand" for workers such as electricians and HVAC technicians, and they can make an "incredibly good living" without having to go to a four-year college, Wick said.

He also took aim at the "doom-and-gloom notion that AI is going to eviscerate demand" for human labor. He described that worry as a "little premature" as nobody knows for sure how AI will affect entry-level roles in the future, unemployment is yet to soar, and there's always inertia when it comes to businesses and consumers changing their behavior.

Ukrainian missiles reportedly struck a factory in the city of Oryol on 23 October, with OSINT projects reporting that the target was the Proton electronics plant, which produces components used in Russian weapons systems.

The strike comes amid Ukraine’s broader campaign to target Russian military production facilities and other infrastructure supporting Moscow’s war against Ukraine. Ukrainian strikes on such facilities aim to weaken Russia’s ability to manufacture and maintain the weapons it uses in its invasion.

The plant reportedly supplies electronic components for Iskander-M ballistic missiles, which Russia regularly uses to attack Ukrainian cities, as well as other weapons systems, including the Pantsir-S1 air defense system. 

The strike could disrupt production supporting Russia’s war effort. Photos show extensive damage to the building. Information about casualties remains unclear. 

Plant reportedly produces components for Russian weapons

Proton JSC manufactures semiconductor devices, LEDs, and electronic components for industrial and specialized equipment. According to Exilenova+, the plant’s products are used in the production of Iskander-M ballistic missiles, S-71 Kover missiles, and the Pantsir-S1 air defense system.

Exilenova+ reported that the plant was struck by Storm Shadow cruise missiles. The weapon type has not been independently confirmed, and the extent of damage to the facility remains unknown.

Russian authorities confirm strike on factory

Oryol Oblast Governor Andrey Klychkov announced a missile threat in the region before reporting that missiles had struck a factory in Oryol’s Sovetsky District, according to Liga.net.

Residents reported explosions, a fire in one part of the city, and columns of smoke rising over Oryol, according to local reports cited by OSINT projects Exilenova+, Supernova, and Astra.

Ukraine’s Defense Intelligence (HUR) warned that Russia may stage sabotage in Central and Eastern Europe, including the Baltic states, and blame Ukraine for the attacks, in a Telegram post on 23 October.

The warning comes three days after The Wall Street Journal reported that US intelligence traces Europe’s sabotage wave to Putin’s personal order. If Russia stages new attacks and pins them on Ukraine, as HUR warns, European anger could turn on Kyiv rather than the Kremlin. This goes further than HUR’s statement on 2 October, which named potential Russian targets in Europe but did not mention a plan to blame Ukraine for attacks.

HUR says Moscow wants to discredit Ukraine’s army

Russia is stepping up its hybrid strategy to destabilize the European Union, according to HUR. The agency identified two aims: reducing foreign support for Ukraine by discrediting its Defense Forces, and intimidating European governments and societies.

The accusations would be spread through Russian propaganda channels and international platforms accessible to the Kremlin.

Potential targets include infrastructure and Russian Orthodox Church sites

HUR listed several potential targets for Russian provocations:

• critical infrastructure and areas bordering Russia;
• the Kaliningrad exclave;
• areas of EU countries with Russian-speaking populations;
• Kremlin-controlled sites, including properties belonging to the Russian Orthodox Church network;
• historical sites associated with Russia.

The list reflects HUR’s assessment of potential targets, not confirmation that attacks at these locations are planned.

Earlier warnings and reported sabotage

On 2 October, HUR said Russian intelligence services had been ordered to increase activity in EU and NATO countries. It named military facilities, critical infrastructure, communications systems, and Starlink ground stations as potential targets and said it had alerted partners.

Warnings of Russian false flags on NATO’s eastern flank predate HUR’s. In August, Bloomberg reported, citing an unnamed European intelligence official, that Russia might expand hybrid attacks against Poland and the Baltic states, including false-flag attacks. A European government official separately told the agency that the CIA had warned countries in the region of a possible Russian attack. Lithuania’s military intelligence had warned earlier in August that Moscow might reassemble captured Ukrainian drones for false-flag strikes on critical infrastructure in the Baltic region.

Meanwhile, The Wall Street Journal reported on 20 October that US intelligence agencies believe the attempted drone attack on Leipzig-Halle Airport in Germany in early August was among the opening shots of a sabotage campaign ordered by Russian President Vladimir Putin. The Journal cited European officials briefed on the intelligence findings.

According to the newspaper, at least three drones carrying military-grade Semtex explosives were involved. One struck an Antonov cargo plane used to transport military aid to Ukraine but failed to explode. Another collided with a different aircraft, while a third detonated near the airport perimeter. German newspaper Welt am Sonntag has since named two suspects, citing German investigation files. Earlier German media reports described the sequence differently.

The Journal also reported sabotage attacks on Starlink stations in Poland, Lithuania, and Bulgaria in recent weeks. In August, Slovak authorities said they had foiled a planned arson attack on a Ukrainian drone factory, the Journal reported.

Russia denies involvement in sabotage in Europe. Responding to Berlin’s accusations over the Leipzig incident in early September, Putin asked where the evidence was.

As of October, Russia has up to 700 ballistic and several thousand cruise missiles in reserve, and its 2026 state order for Geran-type drones and decoys such as the Gerbera exceeded 100,000 units, Ukraine’s military intelligence (HUR) told NV in figures the outlet published on 20 October. The missile stocks are roughly the same as HUR reported to NV in July, the outlet found.

Ukraine enters the heating season facing what it says is a Russian plan to hit 60 infrastructure sites this winter. HUR’s figures suggest Russia has the weapons for it, even after its fall mass strikes. In June, HUR said Russia could fire up to 100 ballistic missiles a month while keeping its stocks steady. Its drone output, meanwhile, is shifting to jets that are harder to shoot down.

Russia produces 110 ballistic missiles a month

Russia can make more than 200 missiles a month, 110 of them ballistic, HUR said. About 115 of its ballistic missiles are Iskander-Ms, with production of up to 65 a month. A modernized Iskander with a projected range of 550 to 700 km is in development.

At the same time, Russia holds up to 400 S-300PM and S-400 air defense missiles adapted to strike ground targets, and makes about 40 a month. Meanwhile, Kinzhal production has been temporarily paused over poor accuracy, and the capacity has gone to conventional ballistic missiles.

Most new Kalibrs go into reserve

Russia plans to make more than 80 Kh-101 cruise missiles a month and is exceeding that, though defects in releasing them from aircraft have sent some batches back to the factories.

Russia has more than 450 Kalibrs and makes about 29 a month. Because Ukrainian air defense downs them effectively, Russia sends most new ones to its strategic reserve and to equip its fleets, HUR said. It also holds more than 600 Oniks anti-ship missiles, upgraded for ground strikes, and more than 120 Zircons.

Explore further

Ukraine recovers Russia’s undamaged Geran-3 jet kamikaze drone carrying camera and live-link equipment (VIDEO)

Russia now assembles 4,000 jet drones a month

Russia holds a reserve of about 6,200 Gerans and makes about 10,000 drones a month. Its main production hub is the Alabuga special economic zone in Tatarstan.

Since summer, Russia has shifted toward turbojet drones. “The reason is the saturation of Ukraine’s Air Force with mobile fire groups that shoot down low-speed targets en masse,” HUR said. Russia now assembles about 4,000 jet drones a month, mostly Geran-4s and Geran-5s, which fly at 400 to 500 km/h. It also makes about 2,000 cheaper propeller-driven Geran-2s, which HUR said are used to wear down air defense and locate air defense positions.

France, Germany, Austria and Poland are expanding or reviewing the authority of critical infrastructure operators to defend facilities against drones, raising legal and operational questions over the growing role of civilian companies in national security.

European governments are reconsidering who should be authorised to intercept hostile drones as energy companies and critical infrastructure operators confront an increasingly serious threat to electricity networks, transport systems and other essential facilities.

France has already introduced legislation permitting approved operators to deploy counter-drone systems, while Germany is reviewing similar arrangements and Austria has announced plans to extend certain protective powers to infrastructure companies.

Poland has moved further by authorising designated security units to disable or destroy drones entering restricted areas around important energy installations.

The changes reflect concerns that national police and armed forces cannot provide permanent protection for every substation, power station, railway facility or pipeline against relatively inexpensive unmanned aircraft.

France establishes a new approach

In August 2026, the French parliament approved legislation allowing authorised operators of critical infrastructure and their contractors to detect, jam and intercept drones near designated facilities.

The legislation followed a series of reported drone incursions over sensitive locations, including military installations.

Under the French approach, operators of strategically important infrastructure may eventually use approved counter-drone systems without relying exclusively on the immediate intervention of military personnel.

Potential beneficiaries include electricity operators and organisations responsible for transport infrastructure.

French authorities are testing detection equipment, electronic countermeasures and interceptor drones at Brétigny-sur-Orge, south of Paris.

The programme examines systems capable of identifying approaching aircraft, determining whether they present a threat and initiating an appropriate response.

France intends to expand the protection of sites classified as strategically important, with further deployment planned during 2027.

The initiative would introduce responsibilities traditionally associated with military or police operations into the management of civilian infrastructure.

Germany and Austria reconsider existing restrictions

Germany is examining the legal conditions under which private companies and infrastructure operators could participate in active counter-drone operations.

At present, responsibility for neutralising threatening aircraft remains primarily with the competent public authorities.

The debate has intensified following security incidents involving unmanned aircraft, including the discovery of an explosives-laden drone near a Ukrainian cargo aircraft at Leipzig/Halle airport in August.

German authorities attributed the incident to Russia, an allegation Moscow denied.

The German government’s review concerns not only the equipment that companies may possess but also whether trained security personnel should be permitted to deploy countermeasures without waiting for a separate police authorisation.

Austria announced plans in September to extend comparable powers to selected critical infrastructure operators, including major energy companies.

The government has acknowledged the practical limitations of protecting a large number of widely dispersed installations using state security personnel alone.

Poland has already established restricted drone zones around sensitive energy facilities, with designated security units authorised to intercept aircraft entering those areas under applicable national rules.

Electricity networks face particular risks

Electricity infrastructure presents a difficult security problem because essential installations are distributed across extensive geographical areas.

Transmission operators manage thousands of kilometres of high-voltage lines, while substations, transformers and switching stations connect generation facilities to consumers.

A successful attack against critical equipment can produce consequences extending well beyond the immediate site.

Large power transformers are particularly difficult to replace. Manufacturing, transporting and installing specialised equipment can require lengthy preparation, making rapid recovery uncertain after serious damage.

European utilities have traditionally concentrated on physical security, maintenance and restoring services after technical failures or accidents.

The spread of drones creates additional demands for surveillance, early warning and the ability to respond before an attack reaches its target.

Russia’s repeated strikes against Ukraine’s electricity infrastructure have demonstrated the extensive disruption that attacks on power systems can cause.

European governments are now evaluating how comparable vulnerabilities could be exploited against their own networks.

Who bears responsibility for an interception?

Giving civilian operators access to counter-drone equipment raises unresolved legal questions.

Electronic jamming can interfere with communications and navigation systems beyond the targeted aircraft. A drone brought down over an industrial or residential area could injure members of the public or damage surrounding property.

Security personnel must also determine whether an unidentified drone is hostile, operating unlawfully or simply present because of an error by its operator.

A mistaken interception could expose infrastructure companies to compensation claims and other legal consequences.

European governments must therefore establish who can authorise an intervention, which countermeasures are permitted and how responsibility is allocated when damage occurs.

There is no uniform European approach.

Some operators support expanding their protective powers, while others argue that the use of force should remain the responsibility of the state.

Finland’s national electricity transmission operator, Fingrid, has expressed reservations about transferring such authority to energy companies.

The position reflects a wider concern that infrastructure operators should concentrate on maintaining essential services rather than assuming responsibilities for armed or coercive security operations.

A growing European security market

The regulatory debate is developing alongside a rapidly expanding market for counter-drone technology.

Manufacturers are offering equipment that integrates radar, optical sensors, electronic detection and software capable of classifying possible threats.

Interceptor drones and electronic countermeasures are increasingly being designed for use around civilian infrastructure rather than exclusively on military installations.

German defence company Rheinmetall has reported growing interest from private infrastructure operators in counter-drone protection.

However, the technology is advancing faster than the legal frameworks governing its use.

The immediate challenge for European governments is to establish protective arrangements that allow rapid intervention while preserving clear accountability.

A counter-drone system can identify an approaching aircraft within seconds. Determining who is authorised to stop it remains a matter for national law.

Dutch-Belgian supermarket group Ahold Delhaize has confirmed that malicious activity was responsible for the cybersecurity incident that disrupted its operations across Europe and the United States, forcing the company to take websites, applications and other computer systems offline.

In an official statement issued on Monday, 19 October, the company announced that it had filed a formal complaint with Dutch police and was cooperating with national cybersecurity authorities. Although physical supermarkets have remained open, the disruption has affected online shopping, deliveries and some distribution operations.

The company said investigators had so far found no evidence that sensitive information belonging to customers, employees or business partners had been taken. However, its investigation remains open, and the identity and objectives of those responsible have not been publicly established.

Online services interrupted across several countries

The disruption began on 12 October, when Ahold Delhaize detected suspicious activity within its information technology infrastructure.

The group responded by taking a number of systems offline as a precaution, affecting most of its retail brands in Europe and the United States. The consequences varied considerably between businesses, with some experiencing prolonged interruption to digital services while others were able to restore operations more quickly.

Albert Heijn, the Netherlands’ largest supermarket chain, has been particularly affected. Its website and mobile application have returned online, but home grocery deliveries are not expected to resume until Friday, 23 October.

Orders scheduled before that date have been cancelled, while the company continues preparations for a gradual restoration of its online delivery service.

The incident also interrupted some supply and distribution arrangements, resulting in shortages on supermarket shelves in parts of the Netherlands and Belgium.

In Belgium, Delhaize has restored its online shopping operations. Certain promotional and personalised services were still experiencing difficulties, although the parent company confirmed that its Belgian e-commerce business was operational again.

Dutch retailers Etos and Gall & Gall have also restored their websites. Meanwhile, several American supermarket brands owned by Ahold Delhaize have continued to experience service interruptions.

The group said it expected additional online services in the United States to become available over the coming days.

Dutch authorities investigate

Ahold Delhaize said it notified the Netherlands’ National Cyber Security Centre within 24 hours of detecting the malicious activity.

The company has subsequently provided updates to the authorities and, on Monday, confirmed that a formal police report had been submitted.

Chief executive Frans Muller defended the decision to shut down digital systems, arguing that the investigation had demonstrated the necessity of taking preventive action.

The company has not identified the perpetrators, confirmed whether ransomware was involved or disclosed the technical method used to gain access to its infrastructure.

These distinctions are important because malicious activity does not necessarily establish that information was stolen or that attackers obtained control over every system subsequently taken offline.

The retailer has instead described a controlled restoration process intended to ensure that affected systems can be brought back into operation without exposing the business to further risks.

Ahold Delhaize operates thousands of supermarkets and related retail businesses, including Albert Heijn, Delhaize, Food Lion, Giant Food, Hannaford and Stop & Shop.

Its geographical reach means that a disruption originating within shared corporate infrastructure can affect several national markets, even where individual retail chains maintain separate commercial operations.

Cybersecurity becomes a supply-chain concern

The attack comes amid increasing scrutiny of the vulnerability of European food retailers to digital disruption.

Earlier this month, investigators in France began examining cyberattacks against refrigeration control systems used by hundreds of supermarkets.

Those incidents reportedly affected equipment at chains including Carrefour, Intermarché and Monoprix, with some retailers forced to discard products after refrigeration systems malfunctioned.

There is no established connection between the French incidents and the attack affecting Ahold Delhaize.

Nevertheless, both episodes illustrate the dependence of modern retail operations on interconnected digital systems supporting stock management, refrigeration, logistics, payments and customer services.

The consequences of a serious cyber incident can extend beyond the loss of access to websites. Interruptions to inventory systems, warehouse operations or communications with suppliers can affect the availability of physical products.

This creates particular difficulties for food retailers, where delays in transport and storage can result in the loss of perishable goods.

European regulatory implications

The incident also draws attention to the European Union’s NIS2 cybersecurity framework, which establishes stricter risk-management and incident-reporting obligations for organisations operating in designated sectors.

Food production, processing and distribution are among the activities covered by the directive, although its application to particular companies and operations depends on the relevant legal definitions and national implementing arrangements.

The legislation requires organisations within its scope to establish appropriate cybersecurity protections, address supply-chain risks and notify competent authorities of significant incidents.

Separately, the General Data Protection Regulation establishes notification requirements where personal-data breaches meet the relevant reporting threshold.

Ahold Delhaize’s statement that it has found no evidence of sensitive data being taken does not conclude the technical investigation, but it means that a confirmed theft of personal information should not presently be presented as a fact.

For the company, the immediate challenge remains restoring online services while maintaining normal supermarket operations. The wider commercial consequences, including the cost of the interruption and its effect on sales, have not yet been quantified publicly.

A cyberattack affecting approximately 700 supermarkets in France has exposed serious weaknesses in the digital systems used to control commercial refrigeration, raising concerns about the vulnerability of European food distribution networks and other essential infrastructure.

The attack began overnight on 11–12th October, when intruders gained access to remotely managed refrigeration equipment and altered operating settings, causing refrigerators and freezers to overheat.

Stores belonging to several major supermarket chains were affected, including Intermarché, Netto, Coopérative U, Carrefour and Monoprix. Some were forced to discard substantial quantities of fresh and frozen food.

French Finance Minister Roland Lescure confirmed that approximately 700 of the country’s 10,000 supermarkets had been affected, although the severity of the disruption varied between locations.

The Paris prosecutor’s office has opened an investigation into the attack, including the damage caused by destroyed merchandise and reported fires.

The incident has drawn attention to industrial control systems that are routinely connected to the internet but may receive less cybersecurity protection than corporate networks and customer databases.

Refrigeration systems remotely manipulated

Investigators have established that refrigeration equipment was targeted through vulnerabilities associated with remote monitoring and control systems.

The French cybersecurity authorities identified compromises involving products supplied by Danish manufacturer Danfoss and American company Copeland.

Some of the affected systems used older equipment that no longer received regular security updates.

According to information released by the companies and cybersecurity specialists, certain industrial controllers had been accessible through public internet connections, creating opportunities for unauthorised access.

Hackers reportedly manipulated defrost cycles and increased temperature settings, preventing equipment from maintaining the cold conditions required to preserve food.

The attack affected approximately 300 Intermarché and Netto stores, while Coopérative U reported disruption at around 80 outlets.

Several retailers managed to contain the damage, but others lost substantial quantities of stock.

The consequences extended beyond malfunctioning equipment. Businesses faced the cost of replacing spoiled food, repairing refrigeration systems and restoring normal operations.

The precise financial damage is still being assessed, although estimates from the retail sector indicate that losses across France could amount to tens of millions of euros.

Vulnerabilities in connected equipment

The incident illustrates the security problems created by the growing use of internet-connected industrial equipment.

Modern refrigeration installations allow contractors and maintenance specialists to monitor temperatures, adjust settings and diagnose faults remotely.

These arrangements can reduce operating costs and improve efficiency, but they also create additional access points that attackers may exploit.

Cybersecurity specialists have identified vulnerabilities in commercial refrigeration platforms manufactured by Danfoss and Copeland.

The manufacturers subsequently addressed identified flaws, although older or unsupported equipment remained a concern.

A critical problem for businesses is that industrial machinery often remains operational for many years after its original software has become obsolete.

Replacing entire refrigeration installations can involve substantial expense and operational disruption, encouraging operators to retain equipment that may no longer meet contemporary cybersecurity standards.

The risks are particularly difficult to manage when responsibility for maintenance, software updates and network security is divided between retailers, equipment suppliers and external contractors.

France’s delayed cybersecurity legislation

The attack has renewed scrutiny of France’s implementation of the European Union’s NIS2 Directive, which is intended to strengthen cybersecurity across sectors providing important economic and public services.

The directive establishes common requirements covering risk management, incident reporting, organisational responsibility and protection against cyber threats.

Its scope extends beyond traditional critical infrastructure such as energy, telecommunications and transport to include certain businesses involved in food production, processing and distribution.

EU member states were required to incorporate the directive into national legislation by 17 October 2024.

France was among the countries that received a formal warning from the European Commission in May 2025 over incomplete implementation.

French cybersecurity specialists have since warned that delays have complicated efforts to establish consistent obligations for organisations operating industrial and commercial systems.

However, NIS2 does not automatically cover every supermarket. Its application depends on the nature and size of an organisation and the provisions of national implementing legislation.

The incident therefore raises questions not only about the pace of legislative implementation but also about the practical protection of equipment already in use.

Wider implications for European infrastructure

The disruption demonstrates how a cyberattack can cause physical damage without directly targeting a conventional industrial facility.

Unlike breaches intended to steal customer information, the French incident interfered with machinery responsible for preserving essential products.

The distinction is important for European policymakers, who increasingly face threats to infrastructure that combines digital controls with physical operations.

The European Union’s cybersecurity agency ENISA has organised cross-border exercises to test how authorities and companies would respond to disruption affecting essential services.

The attack itself has been established, but responsibility for it has not been publicly attributed.

French authorities have said there is no immediate threat to national food supplies. Nevertheless, the destruction of merchandise and interruption of ordinary retail operations have demonstrated the potential economic consequences of weaknesses in relatively commonplace equipment.

The continuing investigation must establish how access was obtained, which systems were compromised and whether the vulnerabilities were known to operators before the attack.

For Brussels and national regulators, the case provides a practical test of whether European cybersecurity legislation can translate into effective protection for the connected equipment on which ordinary commercial activities increasingly depend.

Russia attacked Kyiv with ballistic missiles in two waves overnight on 18–19 October. Information from partners did not arrive before the first wave, at around 23:00, Air Force spokesperson Yurii Ihnat said on national television. A warning came before the second wave, at around 03:00, but the window was short, he told NV.

Hours earlier, Ukrainian President Volodymyr Zelenskyy told NBC that US warnings of Russian ballistic launches were working again after three days without them, and that only the United States has that intelligence. Those warnings have for years given Ukrainian authorities several minutes to sound alarms and let civilians reach shelters before ballistic missiles hit.

“Once again, a Russian ballistic attack in several waves overnight, and once again there was no warning from partners,” Zelenskyy wrote. It was at least the third ballistic strike on Kyiv in a week to begin without warning from partners, following attacks on 12 October and 13 October.

Metro station damaged on Kyiv’s left bank

One person was killed and eight injured in Kyiv, Ukrainian Prime Minister Serhii Koretskyi said. A strike damaged a metro station on Kyiv’s left bank, and debris broke the rails beside it, Mayor Vitali Klitschko said. City authorities said the damaged station was above ground, closed Chernihivska and Lisova stations, and said red-line trains would run only between Akademmistechko and Darnytsia. The attack also damaged a 25-story building, a medical facility, and the Cosmo Multimall shopping center in the Solomianskyi district, NV reported, and Zelenskyy said a school was hit too.

The attack also damaged one of Ukraine’s main ice arenas, on Shalett Street in Kyiv, which hosts Ukrainian championship hockey games and youth training, hockey Telegram channel Flamingo reported. Parts of the facade, metal structures, and roof were damaged, but the ice surface showed no significant visible damage, according to preliminary information, Suspilne reported.

Damage in 11 oblasts, three missing in Irpin

Koretskyi said energy and infrastructure were the main targets, with damage in 11 oblasts. Russia also hit warehouses of medicines, railway stations, shops, and homes, he said. In Kyiv Oblast, Russian strikes injured six people in Irpin, including three children, and three more were missing, oblast head Tymur Tkachenko said. In Kharkiv Oblast, six people were injured, including two children, Koretskyi said. In Rivne Oblast, four people were injured, and one of them was hospitalized, regional police reported.

Zelenskyy said that more than 10 energy facilities were damaged and at least 550,000 families lost power. Ukrenergo reported new outages in 10 oblasts: Volyn, Zhytomyr, Rivne, Ternopil, Khmelnytskyi, Vinnytsia, Kirovohrad, Kharkiv, Odesa, and Mykolaiv. In Volyn Oblast, about 15 jet-powered Shahed-type drones targeted the region, and around 66,000 customers were without power on the morning of 19 October, oblast head Roman Romaniuk said. Kovel, Manevychi, and Lutsk were hit hardest, and no casualties were reported. In Vinnytsia Oblast, a critical infrastructure facility in Koziatyn was damaged, and power there would stay unstable for some time, city council secretary Iryna Repalo said, Suspilne reported.

Zelenskyy said Russia fired 16 ballistic missiles at Kyiv and Kyiv Oblast. The Air Force reported that Russia also used Iskander-K cruise missiles and 269 drones, and that by 09:00 air defenses had shot down or suppressed four Iskander-K cruise missiles and 243 drones. Its preliminary count did not list any ballistic missiles among the intercepted targets.

Rubio denies any pause and points to a software problem in Ukraine’s warning system

On 19 October, Rubio told reporters in Samarkand, Uzbekistan, that “there’s been no pause” in intelligence-sharing with Ukraine, Reuters reported. He said he did not know where Zelenskyy was getting such claims and that he should focus on ending the war. He also said he did not know whether a failure had happened the previous night, but that a few nights earlier there had been a software problem with “their early warning system,” and that US European Command was looking into the strikes, The Guardian reported. US officials had not mentioned a software glitch before, and in at least one case Ukraine was told that bad weather over southern Russia had hidden launch preparations, the newspaper noted.

Ihnat said Ukrainian specialists and their partners were working to establish why information about the first launch had not arrived. He added that similar gaps had occurred during earlier attacks.

Zelenskyy wrote that when missile supplies for Ukraine’s air defense are blocked while Russia gets sanctions relief or delays, “this is, unfortunately, a denial of reality on the part of partners.” A night earlier, Russia had hit Ukraine’s energy system again, while Ukrainian drones set fire to St. Petersburg’s oil terminal despite Washington’s pressure to stop refinery strikes.

Russia has started fitting its enlarged Gerbera-2 drones with a 10-kg warhead and an extra bag of incendiary mixture, Ukrainian military outlet Militarnyi reported on 18 October. The setup is designed to start a fire where the drone hits and is probably meant for attacks on critical infrastructure and warehouses, the outlet said.

Russia’s industry makes about 3,000 jet-powered Geran-4 and Geran-5 drones a month, Ukraine’s military intelligence has said, and Russian strikes have destroyed 2.1 million m² of Ukraine’s modern warehouse space since the full-scale invasion began. A cheap drone that carries fire adds one more threat for air defenses that already let nearly half of Russia’s jet-powered Shaheds through.

A fire bag behind the warhead

Ukrainian Telegram channel Polkovnyk HSh posted photos of the payload on 17 October. Gerbera-2 strike and reconnaissance drones had begun to appear with a 10-kg high-explosive fragmentation-incendiary warhead and an extra package of incendiary mixture, the channel wrote. They navigate with Kometa-M12, a 12-element antenna array designed to resist jamming, it added.

Explore further

Russian drones set their own detonators at altitude: Why cutting wires won’t save from new Gerberas?

In the photos, the incendiary mixture sits in a separate soft plastic tank behind the main warhead, Militarnyi said. Gerbera-2s have been seen with warheads of 4 to 10 kg depending on range, while strike versions of the original Gerbera usually carried up to 5 kg, the outlet noted.

Half a Shahed engine

Russia has mainly fielded the Gerbera, a cheap drone shaped like a Shahed, as a decoy and reconnaissance platform flying alongside Shahed-type strike drones. It has also used bigger Gerberas to drop FPV drones.

Serhii Beskrestnov, now an adviser to Ukraine’s president, flagged a much bigger Gerbera in Ukraine’s skies on 7 August. The Gerbera-2 has a larger airframe, a reshaped wing, and a bigger tail fin, Militarnyi said. In August, the outlet reported it had a stronger piston engine: half of the one in the Shahed-type Geran-2, at about 275 cm³. Production of these engines was set up at the Izhevsk Motorcycle Plant, according to preliminary information the outlet cited.

Explore further

Russia equips Geran attack drones with image-based navigation using Google map imagery, reducing reliance on satellite navigation that Ukraine can jam, defense adviser warns

Earlier versions ran on a Chinese DLE60 model-aircraft engine of about 61 cm³. The switch was likely possible because Geran-2 engine output partly freed up as jet-powered Geran-4s took a growing share of Russia’s drones, Militarnyi said. The Gerbera-2’s fuel tank also holds up to 63 liters, against 10 liters on the original.

One reached Poland’s Baltic coast

In September, a drone preliminarily identified as a Gerbera-2 was recovered from the Baltic Sea near Rusinowo, on Poland’s coast. It carried a high-explosive fragmentation warhead of about 4 kg, a Polish military prosecutor said.

Russia has kept striking Ukraine’s energy sector throughout the week since US President Donald Trump announced an energy ceasefire, Ukrainian President Volodymyr Zelenskyy said on 18 October. From overnight into Sunday, Russian drones and a ballistic missile hit substations, homes, and industrial sites from Odesa to Volyn. They killed civilians and left tens of thousands of families without power.

Russia fights along the front line while hitting cities and the grid behind it with drones, missiles, and glide bombs. Ukraine says Moscow plans up to 1,000 such munitions against 60 key infrastructure sites this winter, and jet-powered drones partly free it to concentrate missiles on fewer targets, the Institute for the Study of War assessed. With Graham Act penalties on hold and US sanctions on Russian diesel suspended, Russia faces no new US cost for its strikes on Ukraine’s grid. Protecting and restoring the grid falls to Ukraine’s air defenses and repair crews.

Russia hit energy sites 76 times in a week

Zelenskyy counted 76 deliberate Russian strikes on energy and oil-and-gas facilities since Trump’s announcement. Overnight, Russia hit substations in Vinnytsia, Zhytomyr, Khmelnytskyi, and Odesa oblasts, he said. In the past week, Russia fired almost 2,700 attack drones, 1,700 aerial bombs, and 66 missiles, most of them ballistic, mainly to cause a blackout. His message was aimed at Washington.

“America must see that Russia is not taking steps in return for the lifting of sanctions or deals. On the contrary, they take every signal that they can make money as proof that their bet on war is working and they can keep fighting,” Zelenskyy wrote.

Explore further

22 House lawmakers press Trump to implement Russia sanctions law. Diesel deal draws bipartisan backlash

Overnight, Russia launched one Iskander-M ballistic missile and 180 Shahed-type drones, 26 of them jet-powered, the Air Force reported. Air defenses downed or suppressed 152 drones, but strikes hit 20 locations.

Power cuts from Odesa to Ternopil

Strikes left about 24,000 consumers in Odesa Oblast without power, oblast head Oleh Kiper said. In Vinnytsia Oblast, the attack damaged critical infrastructure and forced emergency outages, oblast head Natalia Zabolotna wrote. Drones hit three energy facilities in Ternopil Oblast, one of them for the second time, and cut power to some consumers, oblast head Taras Pastukh said.

Civilians killed and injured

A Russian strike on Zaporizhzhia killed a 27-year-old woman and injured two others, including a 16-year-old, the State Emergency Service reported. In Poltava, an evening attack killed one person, injured four, and damaged 10 detached houses, city council secretary Kateryna Yamshchykova said.

Explore further

Five Russian bombs kill 17 in Ukraine’s Zaporizhzhia next day after Trump lets Russia ship first 300,000 tonnes of its diesel

A drone hit a high-rise in Odesa and set its roof on fire. A 13-year-old girl was hurt, city military administration head Serhii Lysak said, and Kiper put the number of injured at two.

In Dnipropetrovsk Oblast, Russian drones and artillery injured three people, oblast head Oleksandr Hanzha said. In Donetsk Oblast, Russian attacks killed seven civilians on Saturday, six of them in Sloviansk, oblast head Vadym Filashkin reported.

Fires in the west, alerts across the border

A morning drone strike set warehouse and production buildings ablaze at an enterprise in Manevychi, Volyn Oblast, oblast head Roman Romaniuk said. With heavy smoke blowing toward the town, Romaniuk urged residents to stay indoors, shut windows and doors, and switch off ventilation. A repeat strike set an enterprise in the district on fire again, the State Emergency Service said, adding that air tests found no dangerous concentrations outside the site. In Lviv Oblast, drone debris damaged a logistics warehouse and two houses, oblast head Maksym Kozytskyi said.

Polish military aircraft operated in Poland’s airspace twice during the attack, as the Government Security Centre warned residents of Lublin Voivodeship and later alerted Subcarpathian Voivodeship. In Lithuania, NATO jets failed to identify an object that apparently entered from Poland, Defense Minister Robertas Kaunas said.

A ceasefire Moscow never confirmed

Trump announced the energy ceasefire on 11 October, news that surprised Zelenskyy. A White House official said Russia was still weighing it. Hours later, Russia hit a Kharkiv power plant, and on 14 October it fired 39 ballistic missiles at the grid. Then Trump waived Graham Act penalties on buyers of Russian oil, and Secretary of State Marco Rubio said the administration wants 60 days to weigh the economic effects.

Ukraine was prepared to suspend attacks on Russian oil refineries if Washington supplied anti-ballistic missile systems to protect its energy infrastructure, President Volodymyr Zelenskyy has revealed. The proposed compromise was not accepted, despite American pressure on Kyiv to halt its strikes.

Ukrainian President Volodymyr Zelenskyy has disclosed that Kyiv offered to suspend attacks on Russian oil refineries in exchange for temporary American anti-ballistic missile protection for Ukraine’s energy infrastructure. Washington did not provide the requested systems, leaving Ukraine exposed to continued Russian missile strikes while the United States sought to restrict Ukrainian operations against Russia’s oil industry.

Speaking at a press conference in Brussels on Friday, 16 October, Zelenskyy said the proposal had been presented to Washington as a compromise following President Donald Trump’s agreement with Vladimir Putin on Russian diesel supplies and restrictions on attacks against energy facilities.

The Ukrainian president confirmed that Kyiv had not been consulted before Washington reached its understanding with Moscow. He described the diesel agreement as a surprise and objected to arrangements determining Ukraine’s military actions without its participation. Any agreement concerning Ukrainian strikes on Russian territory, he argued, required consultation with the Ukrainian government.

Nevertheless, Zelenskyy said Ukraine had been willing to accommodate American demands, even under an arrangement that did not require Russia to suspend its own attacks. Instead of insisting on reciprocal restrictions, Kyiv proposed receiving sufficient anti-ballistic missile systems to protect its electricity network for the duration of the requested suspension.

The proposal reflected Ukraine’s immediate security requirements. Russia has repeatedly targeted power stations, substations and other critical infrastructure, while Ukrainian forces have attacked Russian refineries to disrupt fuel production and reduce revenues available to Moscow. Halting the Ukrainian campaign without additional defensive capabilities would have left Kyiv surrendering one means of economic pressure while remaining vulnerable to Russian bombardment.

Zelenskyy said he had asked Washington for a limited number of systems, rather than a substantial new military commitment. The proposed deployment would have lasted only as long as the United States required Ukraine to refrain from attacking Russian refineries. However, according to the president, no such assistance was provided.

US diesel agreement deepens dispute

The disagreement follows the diesel arrangement announced by Trump on 9 October, under which Russia agreed to resume substantial petroleum product exports to American and international markets. Washington also authorised certain transactions involving Russian diesel, easing restrictions previously intended to reduce Moscow’s energy revenues.

The agreement created a direct conflict between American energy policy and Ukraine’s strategy of targeting Russian refining capacity. Washington wants additional diesel supplies to ease pressure on fuel markets, while Kyiv regards attacks on oil infrastructure as a means of weakening Russia’s ability to sustain its invasion.

That disagreement intensified after Ukraine resumed attacks on Russian refineries, including a strike against a facility in the Ryazan region. Trump criticised the operations, accusing Kyiv of contributing to higher global oil prices. Zelenskyy, meanwhile, argued that increased Russian diesel revenues would provide Moscow with additional resources to finance its military campaign.

The Ukrainian president’s proposal also exposed the limitations of the temporary energy ceasefire promoted by Washington. Russia continued attacks against Ukrainian civilian infrastructure, including electricity facilities, despite the American initiative. Kyiv’s proposed compromise would have addressed the resulting imbalance by providing defensive protection rather than relying on Russian restraint.

Russian strikes underline Ukraine’s defensive requirements

The urgency of Ukraine’s request was illustrated by renewed Russian attacks during Zelenskyy’s visit to Brussels. According to the Ukrainian presidency, strikes on 15 October damaged energy infrastructure in several regions, leaving almost 15,000 people without electricity in Volyn and disrupting supplies in parts of Kyiv and the surrounding region.

Ukraine continues to face shortages of the interceptors required to defend against ballistic missiles. Zelenskyy has identified anti-ballistic capabilities as an immediate priority, particularly as Russia intensifies attacks ahead of winter. During talks with NATO Secretary General Mark Rutte, he stressed the need for additional missile interceptors and other air defence equipment.

The president also raised these requirements during Friday’s meeting with European Commission President Ursula von der Leyen and European Council President António Costa. Discussions covered air defence, protection of energy infrastructure and financial assistance needed to sustain Ukraine’s resistance to Russian aggression.

European leaders support Kyiv’s position

Zelenskyy said European leaders had supported Ukraine’s position in the dispute with Washington. His remarks came as the EU reaffirmed its intention to maintain economic pressure on Moscow despite the Trump administration’s decision to facilitate Russian diesel exports.

As EU Today reported earlier on Friday, von der Leyen and Costa rejected any relaxation of European sanctions while Russia continues its war. The Commission is preparing a further sanctions package, maintaining a policy intended to restrict Moscow’s ability to finance its military operations.

The contrasting American and European positions have become increasingly significant for Kyiv. Washington is seeking to stabilise fuel markets through arrangements with Moscow, while European governments remain committed to reducing Russian energy revenues and strengthening Ukraine’s military and economic resilience.

For Zelenskyy, the unresolved question is whether Ukraine can be expected to limit attacks on Russian oil infrastructure while receiving neither reciprocal guarantees from Moscow nor additional protection against Russian ballistic missiles. His account of the unsuccessful American negotiations indicates that Kyiv was prepared to compromise, but only if its immediate defensive needs were addressed.

US President Donald Trump called Ukraine’s renewed strikes on Russian oil refineries a disgrace in an interview with Newsmax and questioned President Volodymyr Zelenskyy’s will to settle the war on 15 October. His statements came after he made a deal with Russian President Vladimir Putin to allow Russian diesel back into the US ahead of the mid-term elections in the US.

Kyiv says its long-range strikes have knocked out more than half of Russia's refining capacity, one of the few levers it controls on Moscow's war income, according to Ukraine's Defense Ministry. This is part of efforts to reduce the aggressor's capabilities to launch assaults, including the latest, during which four Russian regions fired 39 Iskander-M, North Korean KN-23, hypersonic Zircon, and supersonic anti-ship cruise Oniks missiles, Zelenskyy said.

Trump criticizes Zelenskyy over oil prices while remaining silent on Russian strikes

Earlier, Zelenskyy said that Ukraine stopped refinery strikes for three days to meet US wishes after Trump announced an “energy ceasefire” on 11 October. At the same time, Russia struck a Kharkiv heat-and-power plant within hours of the announcement, he emphasized.

Meanwhile, in the interview with Newsmax, Trump said Zelenskyy is only pushing world oil prices higher.

“Well, I think that’s a disgrace,” he said.

He added that Ukraine has other options: “There are a lot of targets that you can hit.”

At the same time, Trump didn't say a word about Russian strikes on Ukraine's civilian buildings and power infrastructure ahead of the winter.

Trump compares Zelenskyy to a circus showman

The US leader said he is “not a big fan” of Zelenskyy. He claimed both sides “would like to see it end,” but that he finds Zelenskyy “more difficult to deal with than Putin.”

Explore further

US weighs relief for sanctioned shadow fleet tankers, days after freeing Russian diesel

He also said that he believes the depletion of US ammunition stockpiles is linked to the aid provided to Ukraine under the Biden administration, rather than the war with Iran.

Ukraine has repeatedly offered to help the US counter Iranian drones during the operation. The New York Times reported that a Ukrainian team departed the day after the US made such a request.

Nevertheless, despite Kyiv’s offers and actions, Trump once again compared Zelenskyy to P. T. Barnum, the 19th-century American circus showman, saying that he received a tremendous number of Patriots and Tomahawks.

However, there is no public confirmation that Tomahawk missiles were transferred to Ukraine during the Biden administration.

Russia has found a way to cut Ukraine’s power lines that no repair crew can undo. A unique power transmission tower that a Russian drone cut down at the Dnipro River crossing in Kyiv cannot be restored,  Ukrenergo board chairman Vitaliy Zaichenko says, as the grid operator rushes to build alternative ways to keep electricity flowing, Interfax reports.

Russia has spent the war trying to switch off Ukraine’s lights. Now, it is widening the campaign before winter with a new tactic: drones that slice through the steel towers carrying high-voltage lines.

“Everyone has seen the video showing the destruction of one of the unique power transmission towers at the crossing over the Dnipro in Kyiv. It was severed, and it is impossible to restore it,” Zaichenko continues.

He adds that now the company is developing new technical solutions "on the fly, and very fast." It will start the procedures for those solutions from 15 October, he notes. Russia’s use of drones able to sever metal towers is a new and serious challenge for Ukraine’s power engineers.

Zaichenko did not say when the tower was hit. On 30 September, Russia first used a jet-powered drone carrying a 40-kilogram charge built to cut steel towers, and that evening an eyewitness filmed one striking a power line tower in Kyiv, which cut electricity in parts of three districts, Informator reported.

When the spare parts are as scarce as the targets are plentiful

Rebuilding is colliding with a global shortage. Ukrenergo faces serious difficulties getting backup equipment, Zaichenko explains, because the whole world’s energy system is expanding at once and everyone needs the same hardware.

“There is a real problem with equipment. The global power system is expanding, and everyone needs energy equipment. There is a tough queue,” Zaichenko says.

Ukraine has faced such challenges since August 2026, when Russia began launching its jet-powered drones. Kyiv still has no effective solution against them and relies more on a mix of air defenses, such as automated turrets and interceptor drones.

Kyiv has also engaged over 100 private air defense system brigades to protect its enterprises in the ranks of the Ukrainian Air Forces.

Ukrainian and Japanese officials discussed establishing backup bridge crossings in the event of Russian strikes, preparing municipal infrastructure for winter, and Japan's continued assistance with Ukraine's recovery, Ukraine's Minister for Restoration, Infrastructure and Transport, Mykola Kalashnyk, reported on 14 October.

Russia is targeting Kyiv's bridges to paralyze the city and break civilian morale, defense analyst Hamish de Bretton-Gordon wrote in The Telegraph. On 1 and 2 October, Russia attacked Kyiv's Southern Bridge, then struck the Northern Bridge on 3 and 4 October. Ukraine is now working with international partners to establish backup bridge crossings that could maintain connectivity even if major routes are damaged.

The discussions took place during a meeting between Minister Kalashnyk, Japan's Ambassador to Ukraine Yo Osumi, and Osamu Hattori, head of the Japan International Cooperation Agency (JICA) office in Ukraine, according to the statement.

Backup crossings could prevent logistical disruptions if major bridges are damaged

Kyiv's Southern Bridge, for example, plays a critical role in logistics because freight traffic uses it, transport planning expert Dmytro Bespalov noted in an article for Ukrainska Pravda. At the same time, installing additional metal structures to reinforce bridges could be dangerous given their technical condition and existing load levels, he said.

One potential solution is to establish backup bridge crossings.

Ukraine and JICA have agreed to continue working together on engineering solutions for setting up these crossings. Japan has already delivered 720 meters of prefabricated bridge structures to Ukraine, which are expected to be used to create alternative routes if Russia's attacks damage major bridges, Kalashnyk said.

The initiative is intended to help maintain transportation links, ensure the delivery of critical supplies, and preserve evacuation routes for civilians.

Ukraine prepares water utilities and boiler plants for winter amid the threat of Russian infrastructure strikes

During the meeting, Ukraine and JICA discussed equipping water utilities with backup power supplies, addressing the need for modular boiler plants, and obtaining equipment to ensure uninterrupted heating and water services. Ukraine has already submitted lists of the necessary equipment to JICA for consideration as part of a new emergency assistance project, Kalashnyk said.

An intercepted document outlining an alleged Russian plan for strikes against Ukraine this winter reportedly describes attacks on 60 critical infrastructure facilities using up to 1,000 missiles, drones, and aerial bombs. Potential targets include electrical substations, hydroelectric power plants, thermal power plants, boiler facilities, and infrastructure related to water supply and wastewater management.

The document also describes potential strikes on facilities in Kyiv, Kharkiv, Odesa, and several other cities. Such attacks could disrupt electricity, heating, water supply, and wastewater services.