France has deployed a maritime patrol aircraft to Romania following a series of attacks on civilian vessels near NATO territory. The escalating threat has prompted closer cooperation between Romania, Bulgaria and Turkey, raising questions about maritime security and the protection of Europe’s eastern flank.

A series of drone attacks on commercial shipping in the western Black Sea has brought the consequences of Russia’s war against Ukraine increasingly close to NATO territory, prompting additional military surveillance and renewed regional defence cooperation.

France has temporarily deployed an Atlantique 2 maritime patrol aircraft to Romania, while NATO members bordering the Black Sea are strengthening arrangements to monitor shipping routes, identify airborne threats and protect critical infrastructure.

The French aircraft began operating from Romania’s Mihail Kogălniceanu airbase on 18 October and is scheduled to continue reconnaissance missions until 6 November.

Its deployment follows repeated attacks on merchant vessels near Romania and Bulgaria, both members of NATO and the European Union.

At least eight cargo ships have been struck in the region during October, with approximately 34 sailors reported dead or missing, according to figures reported by Reuters on 27 October.

The incidents have transformed commercial maritime security into an increasingly urgent issue for European defence planners.

Commercial vessels enter the conflict zone

The latest escalation has centred on shipping routes serving Ukraine’s Danube ports and commercial traffic passing through the western Black Sea.

Russia’s attacks on Ukrainian maritime infrastructure have increased the importance of alternative export routes, including those connecting the Danube to international shipping lanes.

However, recent incidents demonstrate that geographical proximity to NATO territory does not necessarily provide commercial vessels with protection from the effects of the conflict.

On 23 October, a drone struck a Comoros-flagged cargo vessel near the Romanian port of Constanța.

According to maritime security company Ambrey, the vessel was hit approximately 16 nautical miles east of the port and subsequently capsized.

One crew member was reported dead, nine were rescued and three remained missing in the initial casualty figures.

Ambrey assessed it as highly likely that Russian forces carried out the attack, pointing to the vessel’s links with Ukrainian Danube ports.

That assessment represents an attribution by a commercial security organisation, rather than a final determination by an international investigative body.

Other incidents have similarly raised questions over responsibility.

Ukraine has accused Russia of attacking civilian shipping, while Bulgarian authorities have acknowledged difficulties in conclusively identifying the operators of drones involved in some strikes.

France strengthens maritime surveillance

Romania’s Defence Ministry announced on 27 October that the Atlantique 2 deployment followed a request from Bucharest in response to the deteriorating security situation.

The aircraft is conducting surveillance and reconnaissance over the western Black Sea, working with Romanian naval authorities and maritime rescue coordination services.

Its principal responsibilities include identifying hazards to navigation and improving awareness of threats to critical infrastructure within Romania’s exclusive economic zone.

That infrastructure includes offshore energy facilities and maritime installations whose protection is increasingly relevant to European energy security.

The deployment adds to Romanian naval patrols conducted by ships, helicopters and unmanned systems.

Romanian authorities are also providing navigational warnings and recommended routes to commercial vessels.

Nevertheless, additional surveillance does not automatically prevent attacks.

The practical challenge lies in detecting relatively small unmanned aircraft or maritime drones, determining their intentions and responding before they reach civilian targets.

Romania, Bulgaria and Turkey coordinate their response

The security crisis was also discussed at a trilateral meeting of defence ministers in Sofia on 28 October.

Romania’s Defence Minister, Ștefan-Radu Oprea, met his Bulgarian counterpart, Dimitar Stoyanov, and Turkey’s Defence Minister, Yaşar Güler, to examine the consequences of attacks on commercial shipping.

According to the Romanian Defence Ministry, the ministers discussed closer intelligence-sharing, improved maritime surveillance and better coordination between their naval forces.

They also reaffirmed the importance of the existing Black Sea mine-countermeasures initiative involving the three countries.

Maritime mines remain a persistent hazard because they can drift beyond their original deployment areas, endangering civilian vessels irrespective of their destination or ownership.

The trilateral format provides a practical mechanism for neighbouring countries to coordinate activities while retaining responsibility for their respective national waters.

It also gives Turkey a central role in regional discussions, reflecting its position on the Black Sea and its control of access through the Turkish Straits under the Montreux Convention.

The limits of NATO’s maritime protection

The attacks raise a complicated legal and operational question: what responsibilities do NATO members have when civilian ships are attacked near their coastlines?

The distinction between territorial waters and an exclusive economic zone is important.

A coastal state’s territorial sea generally extends up to 12 nautical miles from its baseline, while its exclusive economic zone can extend considerably further and confers particular economic and jurisdictional rights.

An attack within a NATO member’s exclusive economic zone does not automatically constitute an armed attack against that member’s territory.

Nor does every strike on a civilian ship near NATO territory automatically trigger the collective-defence provisions of Article 5.

The circumstances, attribution, location and consequences of an incident would all influence the response.

This creates a security problem in which threats can affect European economic interests without necessarily crossing a threshold requiring collective military action.

Maritime trade and energy infrastructure face increasing risks

The implications extend beyond individual vessels.

Repeated attacks can increase insurance costs, complicate shipping schedules and discourage operators from using particular routes.

They can also affect Ukrainian agricultural exports and the wider commercial networks linking Black Sea ports to European markets.

Offshore energy installations face related vulnerabilities, particularly where surveillance and response capabilities are insufficient.

For NATO, the challenge is therefore to strengthen deterrence and protection without unintentionally escalating the conflict.

France’s reconnaissance deployment and the trilateral cooperation between Romania, Bulgaria and Turkey indicate that regional governments are moving towards a more coordinated response.

However, the continuing attacks demonstrate the difficulties of protecting civilian maritime activity against comparatively inexpensive unmanned systems.

The longer-term question is whether increased surveillance, counter-drone capabilities and naval cooperation can make western Black Sea shipping sufficiently secure while the war in Ukraine continues.

Federal and state governments to address chronic shortages and contamination without taking on new debt.

On Wednesday, Mexican President Claudia Sheinbaum announced that the federal government and the state of Jalisco will jointly invest about US$1.3 billion to improve water supply and quality in the Guadalajara metropolitan area, the country’s second-most-populous metropolitan area.

RELATED:

Mexico Deploys Special Mission as Hurricane Vance Nears Pacific Coast

During her morning news conference, she explained that her administration will contribute US$777 million, while Jalisco will allocate US$547 million.

“The good news is that the joint investment will prevent the need to take on debt and will make it possible to carry out this very important project for the country’s second-most-populous metropolitan area,” Sheinbaum said.

Jalisco Governor Pablo Lemus said the agreement will address a longstanding problem of water service interruptions and poor water quality that has affected residents of Guadalajara and neighboring municipalities for generations. He stressed that the projects will not involve new debt, privatization, or water rate increases.

For decades, Guadalajara has faced water supply and contamination problems, exacerbated by the deterioration of hydraulic infrastructure that is more than 70 years old in some sections. Some of the water supplied from Lake Chapala flows through open channels exposed to domestic and industrial discharges, while various neighborhoods experience service interruptions and irregular water distribution.

Efrain Morales, director of the National Water Commission (CONAGUA), explained that federal investment will fund two new aqueducts, with construction set to begin in early 2027 and last approximately two years. The projects will increase water supply by 1,200 liters per second, equivalent to providing water to half a million people, and improve water quality over the next 30 years.

The text reads, “Chapala: the challenge of transporting more water without losing it along the way or overexploiting the lake. The Jalisco state government’s project to improve the water supply for the Guadalajara metropolitan area—which involves a new aqueduct—is raising concerns among civic organizations.”

Contamination and Water Supply Interruptions

The state of Jalisco will allocate about US$402 million to renovate the Miravalle water treatment plant, which is about 70 years old. Lemus explained that the first phase will begin operating in April 2027 and that all work will be completed in approximately two years.

Authorities are also working to clean up channels and dams affected by polluting discharges and to build collectors to protect water from Lake Chapala.

Sheinbaum said about 150 unauthorized discharges have been identified, 80 of which have already been shut down. The project also aims to make full use of the infrastructure at the El Zapotillo Dam, built during the administration of former President Andres Manuel Lopez Obrador (2018-2024).

teleSUR/ JF

Source : EFE

As temperatures are falling in Kyiv, so are rent prices, with residents leaving the capital to escape Russian bombardment and the prospect of a winter without heating and electricity.

Over the last two months, the number of long-term rentals listed on Kyiv&

Ukrainian postal company Nova Post has established its own private air defense capability and has already shot down Russian Shahed attack drones, company co-owner Viacheslav Klymov said on 27 October, according to Interfax-Ukraine.

As Russia increasingly targets Ukrainian factories, warehouses, transport hubs, and other civilian infrastructure, localized air defense is becoming more important. Ukraine’s expanding private air defense program allows businesses to help protect their facilities while operating within the country’s military air defense command system.

“We are one of the few companies that has implemented this project. I don’t want to disclose figures, but we have Shahed shootdowns,” Klymov said at the 12th Kyiv International Economic Forum, according to Interfax-Ukraine.

Klymov also argued that businesses can take on responsibilities that were previously considered exclusively the state’s domain. He pointed to firefighting as another area where companies can strengthen their own response capabilities.

Nova Post employees already extinguish many fires caused by Russian attacks on the company’s facilities without waiting for the State Emergency Service of Ukraine (DSNS) to arrive, he said. Large businesses are also looking for fire engines in Europe to establish their own firefighting units.

Private air defense expands across Ukraine

Ukraine began allowing private companies to establish air defense units under a government-approved framework in November 2025. These units operate under Air Force command, with the military coordinating their missions and integrating them into the national air defense network.

Nearly 100 companies have reportedly joined the experimental program. About 50 air defense groups had been formed, and crews from six companies were already carrying out combat missions. By 14 October, the groups had downed more than 60 aerial targets, mostly Russian drones, according to Ukraine’s Defense Ministry.

The program allows participating businesses to help defend industrial sites and critical infrastructure using capabilities that include interceptor drones and remotely operated heavy machine guns. The approach adds another layer of protection without requiring the military to cover every facility with its own units.

The need for such protection has grown as Russia continues launching long-range attack drones against civilian and industrial targets across Ukraine. Localized air defense can help protect specific sites and reduce the burden on military units, although it remains part of a coordinated national system rather than an independent replacement for military air defense.

Explore further

Ukraine’s air defense goes private: businesses can now buy point coverage for their own sites

Not every company sees private air defense as the answer

The approach has its limits. On 26 October, Kateryna Zahorii, chair of the board of directors of major pharmaceutical company Darnytsia, said her company had studied private air defense but decided against deploying it, Interfax-Ukraine reported.

Zahorii said the changing nature of the threat could make the investment difficult to sustain, as companies might need to keep upgrading their defenses. Darnytsia is instead prioritizing attack monitoring, employee shelters, and safety procedures. The company has been hit by Russian forces three times in September, according to NV.

Russian authorities committed war crimes and crimes against humanity through attacks on Ukraine’s energy infrastructure, the UN Independent International Commission of Inquiry on Ukraine said in a report to the UN General Assembly on 26 October.

International Criminal Court (ICC) warrants for former Russian Defense Minister Sergei Shoigu and Chief of the General Staff Valery Gerasimov, issued in June 2024, already covered alleged crimes linked to Russia’s 2022–2023 strikes on Ukraine’s energy infrastructure. The UN commission’s new report reaches into last winter, 2025–2026, and the cumulative toll since 2022, documenting what the attacks did to civilians living through outages in freezing temperatures.

“As the cold season approaches, the attacks have intensified once again, raising serious concerns about the threats to civilians’ lives and health,” commission chair Erik Møse said.

Russian commanders knew heating facilities were vital

The commission said Russian commanders knew that heating facilities in large cities were indispensable to civilians, particularly during winter. Russian authorities also made official declarations about further attacks and referred to a plan to carry them out, it said. It found that Russian authorities intentionally directed attacks against civilian objects, constituting war crimes.

The commission also concluded that the attacks were carried out under a state policy aimed at depriving civilians of electricity and other essential energy-dependent services and causing suffering. It classified these acts as crimes against humanity in the form of “other inhumane acts.”

Minus 21°C, weeks without heat, and shelters out of reach for older people

Last winter, temperatures fell to minus 21°C as millions of Ukrainians endured prolonged disruptions to heating, electricity, water, and gas, the commission said.

The commission relied on the accounts of 255 people from Dnipropetrovsk, Kyiv, Kharkiv, Kherson, Mykolaiv, Odesa, Poltava, Zaporizhzhia, and Zhytomyr Oblasts, alongside officials, doctors, and nongovernmental organizations.

Older people and those with limited mobility were particularly affected. Fear of becoming trapped in elevators during blackouts prevented some residents from reaching shelters during air raid alerts. They remained in unheated homes, sometimes without access to life-support equipment.

A 53-year-old Kyiv resident told investigators he tried to stay awake at night because he feared he might not wake up if he fell asleep in the cold.

Meanwhile, school closures disrupted children’s education, and children fell ill in unheated homes, the report said.

Russia rejects the findings

Russia’s UN mission said Moscow did not recognize the commission’s mandate and dismissed its findings as “falsified data,” the Associated Press reported.

The commission also examined Ukrainian attacks on energy infrastructure in Russia and Russian-occupied Ukraine. It said it could not investigate their impact fully because Russia denied access and did not respond to its requests.

Foreign recruits trafficked to the front

The same report found “compelling evidence” that Russian authorities trafficked men from 29 countries into the Russian armed forces through deception and coercion.

Recruitment agents arranged visas and travel, presenting themselves as legitimate businesses. After arriving in Russia, the men were forced to sign military contracts in Russian and were sent to the front, where many were killed or went missing, the commission said.

• Infrastructure startup Hyperbolic raised a $30 million round led by Intel CEO Lip-Bu Tan's VC firm.
• The startup connects companies with neoclouds and makes their AI chips easier to use.
• Hyperbolic also wants to let customers resell unused computing power.

Intel CEO Lip-Bu Tan is backing an infrastructure startup that has raised $30 million to help companies rent compute across hundreds of different AI cloud providers.

Hyperbolic, an AI chip marketplace and software startup, has raised $50 million to date.

Walden Catalyst, the venture capital firm founded by Tan and former Samsung president Young Sohn, led the Series A-1 funding round. Dell Technologies Capital, General Catalyst, Vista Equity Partners, and Cambium Capital also participated.

As companies scramble for computing power, one challenge is that AI cloud providers, or neoclouds, use a mix of different chips, networking, and software. Hyperbolic helps customers find compute resources from different providers and creates software that makes it easier to use them all, rather than dealing with each one separately.

"It's been a really fragmented market that makes the customer experience really painful," said 31-year-old founder and CEO Jasper Zhang.

Hyperbolic also wants to let customers resell compute that they're paying for but no longer need.

The four-year-old startup works closely with about 30 neoclouds, including WhiteFiber and Vector Core Compute. It says it has roughly $200 million worth of compute connected to its software annually.

Hyperbolic previously raised a $12 million Series A round in 2024, led by Variant and Polychain Capital, following a $7 million seed round earlier that year. The company expects to have 50 employees by the end of the year and will use its funding to expand software tools for managing AI chips across different neoclouds.

Zhang said the company is aiming for $150 million in annual recurring revenue by the end of the year and is already breaking even. More than 250,000 developers, including teams at Modal, Higgsfield, and Daytona, use Hyperbolic.

Before founding the company, Zhang worked as a quantitative researcher at Citadel Securities. As Wall Street explores ways to financialize AI chips, he said his startup's plans to let companies resell unused compute could help pave the way for a futures market.

Here's a look at the pitch deck Hyperbolic used to raise its $30 million Series A-1. Slides have been redacted so that the deck can be shared publicly.

Journalists from 17 European public service broadcasters, coordinated by the European Broadcasting Union’s (EBU) Eurovision News Spotlight network, published an interactive map on 23 October 2026. It documents hybrid incidents linked to Russia across 17 European countries between 1 April and 15 October. Journalists compiled a database of hundreds of reported incidents, categorizing each by type and the source and strength of its alleged links to Russia, then verifying them through open-source research.

The map comes as officials warn the campaign is growing. On 28 September, EU foreign policy chief Kaja Kallas said in Brussels that Russia was planning more acts of sabotage to divide societies and intimidate them into abandoning their support for Ukraine. The points on the map represent an incomplete list of publicly known cases attributed to Russia or suspected of being linked to it, the report states.

The map covers airspace violations, sabotage attempts, “disposable” agents with no formal intelligence training, migration used as a weapon, and Russian military activity near or across European borders. It excludes cyberattacks, influence operations, and espionage by trained intelligence officers.

The EBU calls the result a very conservative estimate, not an official tally. Russia has consistently denied responsibility for the incidents. Many single points represent several incidents of the same type in one area or in quick succession. In Moldova, for example, Defense Minister Anatolie Nosatîi said on 30 September that the government had recorded 84 drone incursions.

Four German incidents are on the map, out of many more

The map shows four incidents in Germany, according to BR.

• On 2 August, German authorities arrested a 33-year-old Ukrainian man in Thuringia on suspicion of photographing a Bavarian weapons manufacturer for a foreign intelligence service as part of an alleged sabotage plot.
• On 4 August, a drone carrying explosives and a detonator struck the wing of a Ukrainian An-124 cargo plane at Leipzig/Halle Airport but failed to explode.
• On 3 September, attackers threw firebombs from a car onto a construction site next to defense firms in Munich, and German security authorities suspect Russian intelligence.
• On 14 September, investigators learned of a crashed drone found near the Bundeswehr’s Wunstorf air base.

Internal papers from the new Joint Hybrid Defense Center, seen by Correctiv, record 163 suspected sabotage cases in 2026 up to 19 August. The targets included rail lines, military facilities, substations, and radio masts. The same papers record 1,034 drone overflights of critical infrastructure, military sites, and defense companies, and 25 espionage investigations. The papers cover possible attacks by Russia, China, and Iran, and media did not report a breakdown of the sabotage cases by country.

European leaders sound the alarm over Russian hybrid attacks

On 15 April, Swedish civil defense minister Carl-Oskar Bohlin said pro-Russian groups had moved from denial-of-service attacks to attempts at destructive cyberattacks, including one on a Swedish power plant in 2025. On 1 September, German Foreign Minister Johann Wadephul named Russia as the perpetrator of the Leipzig attack and accused Moscow of “blatant hostility” toward Germany.

On 18 September, French President Emmanuel Macron said Russia’s hybrid attacks would not go unanswered and ordered a plan to protect France’s critical infrastructure. On 1 October, German Chancellor Friedrich Merz said Germany was preparing for new hybrid attacks, “including serious ones.” NATO Secretary General Mark Rutte on 14 October called the attacks a sign of Russian weakness at a press conference in Tallinn and said NATO would react where needed without being “rattled.”

Russia attacked Ukraine with 140 drones, including Shahed and Gerbera attack drones and Parodiya decoys, and four missiles overnight on 26 October, the Ukrainian Air Force reported. The missiles were one Kh-31P anti-radiation missile and three Kh-59/69 air-launched guided missiles, launched from occupied parts of Zaporizhzhia and Kherson oblasts.

Jet-powered Shaheds are becoming a larger part of Russia’s aerial campaign, challenging Ukraine’s air defenses and prompting efforts to develop faster interceptors. Alongside guided bomb attacks and strikes on energy infrastructure, these attacks add to the pressure on Ukraine’s defenses as winter approaches, and Ukraine says Russia has a plan for it.

Air defenses downed or suppressed 112 drones, including 56 of the 70 jet-powered Shaheds, and three Kh-59/69 missiles, according to preliminary Air Force figures. Hits were recorded at 15 locations, and debris fell at four more.

Four wounded in Zaporizhzhia

Russian strikes on Zaporizhzhia overnight wounded two women aged 22 and 30, and two men aged 40 and 61, the State Emergency Service (DSNS) said. The strikes damaged the windows of a hotel and two buses, a private house, and four outbuildings, and three cars caught fire. The oblast administration had first reported one wounded.

Later in the morning, Russian forces hit a shopping center building that had already closed, the administration said. The building caught fire. According to preliminary information, no one was hurt.

Guided bombs hit two districts of Izium

At about 02:40 on 26 October, Russian forces struck two districts of Izium in Kharkiv Oblast with guided aerial bombs, and three people needed medical help, the city military administration said, as Suspilne Kharkiv reported. More than 10 private houses and a youth sports school were damaged, and several streets lost power and internet.

Russia struck a burning Odesa Oblast plant twice more as firefighters worked

Overnight, a Russian attack destroyed an industrial enterprise in Odesa Oblast and set it on fire, the DSNS reported. As firefighters put out the blaze, Russian forces struck the site twice more. The rescuers were in shelter and were not hurt, but fire equipment was damaged. At another address, four garages were damaged and a car was destroyed. The oblast administration said there were no casualties.

Energy facility hit in Khmelnytskyi Oblast

On the evening of 25 October, a Russian attack damaged an energy facility in Kamianets-Podilskyi district of Khmelnytskyi Oblast, causing emergency power outages, the oblast administration said. Windows were also damaged in two residential buildings. No casualties were reported.

Meanwhile, Russian drones attacked the Nikopol district of Dnipropetrovsk Oblast more than 10 times overnight, damaging a high-rise and an administrative building, the oblast administration reported. No one was hurt. Mykolaiv Oblast also came under Shahed attack overnight, with no casualties, according to its administration.

The attack continued into the day. On the morning of 26 October, a Russian strike hit a civilian infrastructure site in Vinnytsia, the oblast administration said. Preliminary reports showed no casualties.

Strikes on 26 October kill three in Donetsk and Dnipropetrovsk oblasts

On 26 October, Russian aircraft dropped four guided bombs on homes and shops in the center of Yasnohirka near Kramatorsk, killing one person and wounding 10, the DSNS said. Among the wounded is a 13-year-old girl, Donetsk oblast head Vadym Filashkin said. In Sloviansk, a Russian airstrike destroyed a private house, and rescuers recovered the body of its owner, the DSNS said.

A Russian drone strike on Pavlohrad in Dnipropetrovsk Oblast killed one person and injured seven, including two children, the DSNS said. The injured include two 10-year-old girls, the oblast administration said.

Six hurt in Kharkiv Oblast over the past day

Over the past 24 hours, Russian attacks hurt six people in Kharkiv Oblast, oblast head Oleh Syniehubov said. In Kharkiv, a 60-year-old man and a 14-year-old boy suffered acute stress reactions. Two women aged 51 and 71 were wounded in Krasnopavlivka. His count lists two wounded men in Izium, aged 72 and 52, while the city administration says three people there needed medical help. Russian attacks also set fire to a house in Kotliary, a production building in Vilshany, a building in Derhachi, a house in Mykolaivka, and a site in Kharkiv’s Kholodnohirskyi district, the DSNS reported.

In Sumy Oblast, Russian attacks over the past day injured five people, the National Police said, including two women aged 76 and 56 hit by a drone in Sumy community.

On 25 October: two killed in Kherson and Donetsk oblasts

In Chernihiv Oblast, Russian attacks on 25 October injured a man at a hangar in Pryluky district and a woman at a grain store in the Novhorod-Siverskyi area, the oblast administration said. Drones also damaged a school in a village of Koriukivka community, and a strike destroyed 700 metric tons of potatoes at an enterprise in Mena community, the administration said. A large warehouse fire broke out in Koriukivka district, the DSNS said.

In Kherson Oblast, Russian attacks killed one person and wounded eight in the 24 hours to 06:00 on 26 October, the oblast administration reported. On 25 October, a Russian drone strike on a minibus in Kherson’s Central district killed one person and wounded six, the administration said after one more man sought medical help. Police said the minibus was hit by an FPV drone.

In Donetsk Oblast, Russian forces killed one person in Kramatorsk and wounded 10 across the oblast on 25 October, Filashkin said. Russia hit Kramatorsk with drones and six KAB-250 guided bombs, and 18 hits on Sloviansk wounded four, police said.

On 25 October, a Russian attack on Synelnykove district of Dnipropetrovsk Oblast sent a 30-year-old man to hospital, the oblast administration said. In Vinnytsia, the number of people injured in the Russian attack on the morning of 25 October rose to seven, two of them hospitalized, the DSNS said. In Uman, an 86-year-old woman burned in the Russian attack on 21 October died in hospital, the Cherkasy oblast administration said.

An investigation involving 17 European public-service news organisations has documented hundreds of suspected hybrid attacks across Europe in just over six months, revealing the scale of a security challenge that increasingly extends beyond conventional espionage and cyberwarfare.

The investigation, coordinated by the European Broadcasting Union, examined incidents reported between 1st April and 15th October 2026, including sabotage attempts, arson, airspace violations, suspicious drone activity and the exploitation of migration routes along the European Union’s eastern borders.

Published on 23rd October, the resulting interactive map provides a geographical picture of incidents publicly linked to Russia by intelligence agencies, law-enforcement authorities, government officials or reporting. The degree of attribution varies considerably, however, and many incidents remain under investigation.

The findings point to a fundamental problem for European security: hostile activities can be conducted across national boundaries without necessarily triggering the legal, military or political mechanisms designed to respond to conventional aggression.

Sabotage Without Conventional Warfare

Among the cases examined is an incident in Munich in September, when two Bulgarian nationals allegedly threw incendiary devices from a moving vehicle onto a construction site near several defence companies.

Police arrested the suspects after a witness reported the incident. Bavarian Interior Minister Joachim Herrmann and regional criminal investigators subsequently indicated that political motives were being considered. Investigators reportedly suspected possible involvement by Russia’s military intelligence service, the GRU, although the allegations have not been established in court.

The case illustrates growing concern about so-called disposable agents: individuals recruited to undertake relatively limited operations without formal intelligence training or a longstanding relationship with an intelligence service.

Such arrangements can complicate investigations. Even where perpetrators are identified, establishing a legally demonstrable connection between their actions and a foreign intelligence organisation may prove considerably more difficult.

Germany’s Federal Criminal Police Office has registered a mid-three-digit number of suspected sabotage and reconnaissance cases since the beginning of 2026, according to information provided to investigators involved in the European mapping project.

Only a small proportion have been publicly attributed to Russia. Four German incidents were included in the map, demonstrating the distinction between a broad national caseload and cases meeting the investigation’s publication criteria.

Europe’s Eastern Borders Under Pressure

The geographical distribution reveals substantial activity along NATO’s eastern flank, particularly around the Baltic states, Belarus and the Black Sea.

Incidents include repeated airspace violations, suspected reconnaissance operations and attempts to facilitate unauthorised border crossings. Lithuanian authorities have accused Belarus of deliberately exploiting migration as an instrument of political pressure.

Commercial shipping has also become increasingly exposed. Drone attacks involving vessels near Romania and Bulgaria have raised concerns about the extension of the war’s consequences into maritime areas adjoining EU and NATO territory.

These developments reinforce earlier warnings about Russia’s expanding sabotage campaign, particularly the difficulty of distinguishing isolated security incidents from coordinated operations intended to test national responses.

Teija Tiilikainen, director of the European Centre of Excellence for Countering Hybrid Threats, identified Russia’s invasion of Ukraine as an important factor behind the increasing pressure. According to her assessment, Moscow’s objectives include weakening Western unity and undermining continued support for Ukraine.

The Legal and Institutional Challenge

The central difficulty is not simply the absence of criminal legislation. Arson, espionage, sabotage and unlawful interference with critical infrastructure are already punishable under national laws.

Rather, the challenge involves establishing foreign direction, coordinating investigations across jurisdictions and identifying when a series of apparently separate offences constitutes a wider hostile campaign.

Germany’s domestic intelligence chief, Sinan Selen, has described the environment as a grey area between war and peace. German foreign intelligence chief Martin Jäger has similarly identified Russia as the country’s most dangerous adversary.

European governments are beginning to address these difficulties collectively. At their 15th–16th October summit, EU leaders condemned intensifying hybrid attacks and called for stronger resilience, greater use of existing countermeasures and accelerated work on drone security.

On 8th October, the Council also extended sanctions targeting Russian destabilisation activities until October 2027. The restrictions cover 80 individuals and 20 entities.

Meanwhile, a European Commission research initiative, published on 23rd October, proposes combining anticipation, active defence and retaliatory measures into a more coherent deterrence strategy.

From Individual Incidents to Collective Security

The investigation’s significance extends beyond the number of incidents recorded. By bringing together information previously dispersed among national authorities and separate investigations, it makes possible a wider assessment of the methods, geographical concentration and recurring characteristics of suspected hostile operations.

Nevertheless, the map does not establish Russian responsibility for every incident it records, nor does it constitute a complete European database. Russia has repeatedly denied conducting the hybrid attacks attributed to it.

For European governments, the unresolved question is how to move from recognising a pattern of hostile activity to demonstrating responsibility and responding effectively.

As EU foreign policy chief Kaja Kallas has warned, the consequences already extend beyond infrastructure disruption to risks affecting civilian lives.

The emerging security challenge therefore concerns not only the detection of individual perpetrators, but also Europe’s ability to connect incidents across borders, establish responsibility and prevent successive operations from becoming an accepted feature of the continent’s security environment.

• There are clear parallels between the AI boom and the dot-com bubble, tech investor Paul Wick says.
• But solid demand, strong earnings, and less mania make for a "healthier" backdrop, Wick said.
• Seligman's chief investor brushed off Michael Burry's worries but flagged some trends to watch.

The AI boom has shades of the dot-com bubble, but fears of an imminent crash and mass unemployment are overblown, a veteran tech investor says.

At the turn of this century, there was an explosion in dot-com startups being formed, and a huge infrastructure buildout with telecoms "aggressively" spending on wired and wireless networks, Paul Wick told Business Insider in an interview this week.

The chief investor of Seligman Investments — a group within Columbia Threadneedle Investments that manages over $40 billion of assets and comprises a hedge fund, a mutual fund, and a venture capital arm — said there were clear parallels between that period and the current boom in AI startups and data-center spending. He also noted that energy prices and interest rates jumped then as they've done this year.

But Wick noted there isn't the same IPO frenzy now, or the same "frenetic environment" where stocks soar fivefold or tenfold in a day. He also said that by late 2000, a slowdown in IT spending was being forecasted for 2001, whereas enterprise spending on AI remains strong and recent tech earnings have been robust.

Simply put, the situation seems "healthier" now than in 2000, he said.

Business Insider asked Wick about Michael Burry's warnings this year around AI. "The Big Short" investor has called out aggressive accounting, circular financing, hidden debt, and overinvestment in depreciating assets like microchips as reasons to be skeptical that the boom has legs.

Wick said that Burry, known for predicting and profiting from the collapse of the mid-2000s housing bubble, has been "early or downright wrong on many other things."

Burry has previously defended his track record, citing his correct predictions and sharing charts showing the timing of his market calls.

As for concerns about Nvidia's efforts to grow the AI ecosystem by investing in data center developers and software companies, Wick emphasized that the chipmaker is "extraordinarily profitable."

He cast doubt on whether Nvidia should spend its spare cash only on buybacks, rather than bolstering its customers, especially as several of the industry's biggest players are working to develop their own AI chips to reduce their reliance on Nvidia.

But he also flagged some industry trends to watch, including enterprise clients opting to use older models or build their own, and token pricing coming under pressure as users embrace open-source models, raising questions over the size of the market opportunity for the likes of OpenAI and Anthropic.

Navigating a new world

Wick weighed in on how a young person can get ahead in the AI era.

"It used to be that a degree in computer science was a ticket to success," he said.

A better option today might be to learn a trade, as there's "booming demand" for workers such as electricians and HVAC technicians, and they can make an "incredibly good living" without having to go to a four-year college, Wick said.

He also took aim at the "doom-and-gloom notion that AI is going to eviscerate demand" for human labor. He described that worry as a "little premature" as nobody knows for sure how AI will affect entry-level roles in the future, unemployment is yet to soar, and there's always inertia when it comes to businesses and consumers changing their behavior.

Ukrainian missiles reportedly struck a factory in the city of Oryol on 23 October, with OSINT projects reporting that the target was the Proton electronics plant, which produces components used in Russian weapons systems.

The strike comes amid Ukraine’s broader campaign to target Russian military production facilities and other infrastructure supporting Moscow’s war against Ukraine. Ukrainian strikes on such facilities aim to weaken Russia’s ability to manufacture and maintain the weapons it uses in its invasion.

The plant reportedly supplies electronic components for Iskander-M ballistic missiles, which Russia regularly uses to attack Ukrainian cities, as well as other weapons systems, including the Pantsir-S1 air defense system. 

The strike could disrupt production supporting Russia’s war effort. Photos show extensive damage to the building. Information about casualties remains unclear. 

Plant reportedly produces components for Russian weapons

Proton JSC manufactures semiconductor devices, LEDs, and electronic components for industrial and specialized equipment. According to Exilenova+, the plant’s products are used in the production of Iskander-M ballistic missiles, S-71 Kover missiles, and the Pantsir-S1 air defense system.

Exilenova+ reported that the plant was struck by Storm Shadow cruise missiles. The weapon type has not been independently confirmed, and the extent of damage to the facility remains unknown.

Russian authorities confirm strike on factory

Oryol Oblast Governor Andrey Klychkov announced a missile threat in the region before reporting that missiles had struck a factory in Oryol’s Sovetsky District, according to Liga.net.

Residents reported explosions, a fire in one part of the city, and columns of smoke rising over Oryol, according to local reports cited by OSINT projects Exilenova+, Supernova, and Astra.

Ukraine’s Defense Intelligence (HUR) warned that Russia may stage sabotage in Central and Eastern Europe, including the Baltic states, and blame Ukraine for the attacks, in a Telegram post on 23 October.

The warning comes three days after The Wall Street Journal reported that US intelligence traces Europe’s sabotage wave to Putin’s personal order. If Russia stages new attacks and pins them on Ukraine, as HUR warns, European anger could turn on Kyiv rather than the Kremlin. This goes further than HUR’s statement on 2 October, which named potential Russian targets in Europe but did not mention a plan to blame Ukraine for attacks.

HUR says Moscow wants to discredit Ukraine’s army

Russia is stepping up its hybrid strategy to destabilize the European Union, according to HUR. The agency identified two aims: reducing foreign support for Ukraine by discrediting its Defense Forces, and intimidating European governments and societies.

The accusations would be spread through Russian propaganda channels and international platforms accessible to the Kremlin.

Potential targets include infrastructure and Russian Orthodox Church sites

HUR listed several potential targets for Russian provocations:

• critical infrastructure and areas bordering Russia;
• the Kaliningrad exclave;
• areas of EU countries with Russian-speaking populations;
• Kremlin-controlled sites, including properties belonging to the Russian Orthodox Church network;
• historical sites associated with Russia.

The list reflects HUR’s assessment of potential targets, not confirmation that attacks at these locations are planned.

Earlier warnings and reported sabotage

On 2 October, HUR said Russian intelligence services had been ordered to increase activity in EU and NATO countries. It named military facilities, critical infrastructure, communications systems, and Starlink ground stations as potential targets and said it had alerted partners.

Warnings of Russian false flags on NATO’s eastern flank predate HUR’s. In August, Bloomberg reported, citing an unnamed European intelligence official, that Russia might expand hybrid attacks against Poland and the Baltic states, including false-flag attacks. A European government official separately told the agency that the CIA had warned countries in the region of a possible Russian attack. Lithuania’s military intelligence had warned earlier in August that Moscow might reassemble captured Ukrainian drones for false-flag strikes on critical infrastructure in the Baltic region.

Meanwhile, The Wall Street Journal reported on 20 October that US intelligence agencies believe the attempted drone attack on Leipzig-Halle Airport in Germany in early August was among the opening shots of a sabotage campaign ordered by Russian President Vladimir Putin. The Journal cited European officials briefed on the intelligence findings.

According to the newspaper, at least three drones carrying military-grade Semtex explosives were involved. One struck an Antonov cargo plane used to transport military aid to Ukraine but failed to explode. Another collided with a different aircraft, while a third detonated near the airport perimeter. German newspaper Welt am Sonntag has since named two suspects, citing German investigation files. Earlier German media reports described the sequence differently.

The Journal also reported sabotage attacks on Starlink stations in Poland, Lithuania, and Bulgaria in recent weeks. In August, Slovak authorities said they had foiled a planned arson attack on a Ukrainian drone factory, the Journal reported.

Russia denies involvement in sabotage in Europe. Responding to Berlin’s accusations over the Leipzig incident in early September, Putin asked where the evidence was.

As of October, Russia has up to 700 ballistic and several thousand cruise missiles in reserve, and its 2026 state order for Geran-type drones and decoys such as the Gerbera exceeded 100,000 units, Ukraine’s military intelligence (HUR) told NV in figures the outlet published on 20 October. The missile stocks are roughly the same as HUR reported to NV in July, the outlet found.

Ukraine enters the heating season facing what it says is a Russian plan to hit 60 infrastructure sites this winter. HUR’s figures suggest Russia has the weapons for it, even after its fall mass strikes. In June, HUR said Russia could fire up to 100 ballistic missiles a month while keeping its stocks steady. Its drone output, meanwhile, is shifting to jets that are harder to shoot down.

Russia produces 110 ballistic missiles a month

Russia can make more than 200 missiles a month, 110 of them ballistic, HUR said. About 115 of its ballistic missiles are Iskander-Ms, with production of up to 65 a month. A modernized Iskander with a projected range of 550 to 700 km is in development.

At the same time, Russia holds up to 400 S-300PM and S-400 air defense missiles adapted to strike ground targets, and makes about 40 a month. Meanwhile, Kinzhal production has been temporarily paused over poor accuracy, and the capacity has gone to conventional ballistic missiles.

Most new Kalibrs go into reserve

Russia plans to make more than 80 Kh-101 cruise missiles a month and is exceeding that, though defects in releasing them from aircraft have sent some batches back to the factories.

Russia has more than 450 Kalibrs and makes about 29 a month. Because Ukrainian air defense downs them effectively, Russia sends most new ones to its strategic reserve and to equip its fleets, HUR said. It also holds more than 600 Oniks anti-ship missiles, upgraded for ground strikes, and more than 120 Zircons.

Explore further

Ukraine recovers Russia’s undamaged Geran-3 jet kamikaze drone carrying camera and live-link equipment (VIDEO)

Russia now assembles 4,000 jet drones a month

Russia holds a reserve of about 6,200 Gerans and makes about 10,000 drones a month. Its main production hub is the Alabuga special economic zone in Tatarstan.

Since summer, Russia has shifted toward turbojet drones. “The reason is the saturation of Ukraine’s Air Force with mobile fire groups that shoot down low-speed targets en masse,” HUR said. Russia now assembles about 4,000 jet drones a month, mostly Geran-4s and Geran-5s, which fly at 400 to 500 km/h. It also makes about 2,000 cheaper propeller-driven Geran-2s, which HUR said are used to wear down air defense and locate air defense positions.