Journalists from 17 European public service broadcasters, coordinated by the European Broadcasting Union’s (EBU) Eurovision News Spotlight network, published an interactive map on 23 October 2026. It documents hybrid incidents linked to Russia across 17 European countries between 1 April and 15 October. Journalists compiled a database of hundreds of reported incidents, categorizing each by type and the source and strength of its alleged links to Russia, then verifying them through open-source research.

The map comes as officials warn the campaign is growing. On 28 September, EU foreign policy chief Kaja Kallas said in Brussels that Russia was planning more acts of sabotage to divide societies and intimidate them into abandoning their support for Ukraine. The points on the map represent an incomplete list of publicly known cases attributed to Russia or suspected of being linked to it, the report states.

The map covers airspace violations, sabotage attempts, “disposable” agents with no formal intelligence training, migration used as a weapon, and Russian military activity near or across European borders. It excludes cyberattacks, influence operations, and espionage by trained intelligence officers.

The EBU calls the result a very conservative estimate, not an official tally. Russia has consistently denied responsibility for the incidents. Many single points represent several incidents of the same type in one area or in quick succession. In Moldova, for example, Defense Minister Anatolie Nosatîi said on 30 September that the government had recorded 84 drone incursions.

Four German incidents are on the map, out of many more

The map shows four incidents in Germany, according to BR.

• On 2 August, German authorities arrested a 33-year-old Ukrainian man in Thuringia on suspicion of photographing a Bavarian weapons manufacturer for a foreign intelligence service as part of an alleged sabotage plot.
• On 4 August, a drone carrying explosives and a detonator struck the wing of a Ukrainian An-124 cargo plane at Leipzig/Halle Airport but failed to explode.
• On 3 September, attackers threw firebombs from a car onto a construction site next to defense firms in Munich, and German security authorities suspect Russian intelligence.
• On 14 September, investigators learned of a crashed drone found near the Bundeswehr’s Wunstorf air base.

Internal papers from the new Joint Hybrid Defense Center, seen by Correctiv, record 163 suspected sabotage cases in 2026 up to 19 August. The targets included rail lines, military facilities, substations, and radio masts. The same papers record 1,034 drone overflights of critical infrastructure, military sites, and defense companies, and 25 espionage investigations. The papers cover possible attacks by Russia, China, and Iran, and media did not report a breakdown of the sabotage cases by country.

European leaders sound the alarm over Russian hybrid attacks

On 15 April, Swedish civil defense minister Carl-Oskar Bohlin said pro-Russian groups had moved from denial-of-service attacks to attempts at destructive cyberattacks, including one on a Swedish power plant in 2025. On 1 September, German Foreign Minister Johann Wadephul named Russia as the perpetrator of the Leipzig attack and accused Moscow of “blatant hostility” toward Germany.

On 18 September, French President Emmanuel Macron said Russia’s hybrid attacks would not go unanswered and ordered a plan to protect France’s critical infrastructure. On 1 October, German Chancellor Friedrich Merz said Germany was preparing for new hybrid attacks, “including serious ones.” NATO Secretary General Mark Rutte on 14 October called the attacks a sign of Russian weakness at a press conference in Tallinn and said NATO would react where needed without being “rattled.”

Russia attacked Ukraine with 140 drones, including Shahed and Gerbera attack drones and Parodiya decoys, and four missiles overnight on 26 October, the Ukrainian Air Force reported. The missiles were one Kh-31P anti-radiation missile and three Kh-59/69 air-launched guided missiles, launched from occupied parts of Zaporizhzhia and Kherson oblasts.

Jet-powered Shaheds are becoming a larger part of Russia’s aerial campaign, challenging Ukraine’s air defenses and prompting efforts to develop faster interceptors. Alongside guided bomb attacks and strikes on energy infrastructure, these attacks add to the pressure on Ukraine’s defenses as winter approaches, and Ukraine says Russia has a plan for it.

Air defenses downed or suppressed 112 drones, including 56 of the 70 jet-powered Shaheds, and three Kh-59/69 missiles, according to preliminary Air Force figures. Hits were recorded at 15 locations, and debris fell at four more.

Four wounded in Zaporizhzhia

Russian strikes on Zaporizhzhia overnight wounded two women aged 22 and 30, and two men aged 40 and 61, the State Emergency Service (DSNS) said. The strikes damaged the windows of a hotel and two buses, a private house, and four outbuildings, and three cars caught fire. The oblast administration had first reported one wounded.

Russian strikes injured 8 people in Ukraine overnight on 26 October

Russia injured 2 women, aged 22 and 30, and 2 men, aged 40 and 61, in Zaporizhzhia overnight, Ukraine's State Emergency Service said. Russia also shattered windows in a hotel and 2 buses and damaged a house, and… pic.twitter.com/42bvnHt0qk

— Euromaidan Press (@EuromaidanPress) October 26, 2026

Later in the morning, Russian forces hit a shopping center building that had already closed, the administration said. The building caught fire. According to preliminary information, no one was hurt.

Guided bombs hit two districts of Izium

At about 02:40 on 26 October, Russian forces struck two districts of Izium in Kharkiv Oblast with guided aerial bombs, and three people needed medical help, the city military administration said, as Suspilne Kharkiv reported. More than 10 private houses and a youth sports school were damaged, and several streets lost power and internet.

Russia struck a burning Odesa Oblast plant twice more as firefighters worked

Overnight, a Russian attack destroyed an industrial enterprise in Odesa Oblast and set it on fire, the DSNS reported. As firefighters put out the blaze, Russian forces struck the site twice more. The rescuers were in shelter and were not hurt, but fire equipment was damaged. At another address, four garages were damaged and a car was destroyed. The oblast administration said there were no casualties.

Energy facility hit in Khmelnytskyi Oblast

On the evening of 25 October, a Russian attack damaged an energy facility in Kamianets-Podilskyi district of Khmelnytskyi Oblast, causing emergency power outages, the oblast administration said. Windows were also damaged in two residential buildings. No casualties were reported.

Meanwhile, Russian drones attacked the Nikopol district of Dnipropetrovsk Oblast more than 10 times overnight, damaging a high-rise and an administrative building, the oblast administration reported. No one was hurt. Mykolaiv Oblast also came under Shahed attack overnight, with no casualties, according to its administration.

The attack continued into the day. On the morning of 26 October, a Russian strike hit a civilian infrastructure site in Vinnytsia, the oblast administration said. Preliminary reports showed no casualties.

Strikes on 26 October kill three in Donetsk and Dnipropetrovsk oblasts

On 26 October, Russian aircraft dropped four guided bombs on homes and shops in the center of Yasnohirka near Kramatorsk, killing one person and wounding 10, the DSNS said. Among the wounded is a 13-year-old girl, Donetsk oblast head Vadym Filashkin said. In Sloviansk, a Russian airstrike destroyed a private house, and rescuers recovered the body of its owner, the DSNS said.

A Russian drone strike on Pavlohrad in Dnipropetrovsk Oblast killed one person and injured seven, including two children, the DSNS said. The injured include two 10-year-old girls, the oblast administration said.

Six hurt in Kharkiv Oblast over the past day

Over the past 24 hours, Russian attacks hurt six people in Kharkiv Oblast, oblast head Oleh Syniehubov said. In Kharkiv, a 60-year-old man and a 14-year-old boy suffered acute stress reactions. Two women aged 51 and 71 were wounded in Krasnopavlivka. His count lists two wounded men in Izium, aged 72 and 52, while the city administration says three people there needed medical help. Russian attacks also set fire to a house in Kotliary, a production building in Vilshany, a building in Derhachi, a house in Mykolaivka, and a site in Kharkiv’s Kholodnohirskyi district, the DSNS reported.

In Sumy Oblast, Russian attacks over the past day injured five people, the National Police said, including two women aged 76 and 56 hit by a drone in Sumy community.

On 25 October: two killed in Kherson and Donetsk oblasts

In Chernihiv Oblast, Russian attacks on 25 October injured a man at a hangar in Pryluky district and a woman at a grain store in the Novhorod-Siverskyi area, the oblast administration said. Drones also damaged a school in a village of Koriukivka community, and a strike destroyed 700 metric tons of potatoes at an enterprise in Mena community, the administration said. A large warehouse fire broke out in Koriukivka district, the DSNS said.

In Kherson Oblast, Russian attacks killed one person and wounded eight in the 24 hours to 06:00 on 26 October, the oblast administration reported. On 25 October, a Russian drone strike on a minibus in Kherson’s Central district killed one person and wounded six, the administration said after one more man sought medical help. Police said the minibus was hit by an FPV drone.

In Donetsk Oblast, Russian forces killed one person in Kramatorsk and wounded 10 across the oblast on 25 October, Filashkin said. Russia hit Kramatorsk with drones and six KAB-250 guided bombs, and 18 hits on Sloviansk wounded four, police said.

On 25 October, a Russian attack on Synelnykove district of Dnipropetrovsk Oblast sent a 30-year-old man to hospital, the oblast administration said. In Vinnytsia, the number of people injured in the Russian attack on the morning of 25 October rose to seven, two of them hospitalized, the DSNS said. In Uman, an 86-year-old woman burned in the Russian attack on 21 October died in hospital, the Cherkasy oblast administration said.

An investigation involving 17 European public-service news organisations has documented hundreds of suspected hybrid attacks across Europe in just over six months, revealing the scale of a security challenge that increasingly extends beyond conventional espionage and cyberwarfare.

The investigation, coordinated by the European Broadcasting Union, examined incidents reported between 1st April and 15th October 2026, including sabotage attempts, arson, airspace violations, suspicious drone activity and the exploitation of migration routes along the European Union’s eastern borders.

Published on 23rd October, the resulting interactive map provides a geographical picture of incidents publicly linked to Russia by intelligence agencies, law-enforcement authorities, government officials or reporting. The degree of attribution varies considerably, however, and many incidents remain under investigation.

The findings point to a fundamental problem for European security: hostile activities can be conducted across national boundaries without necessarily triggering the legal, military or political mechanisms designed to respond to conventional aggression.

Sabotage Without Conventional Warfare

Among the cases examined is an incident in Munich in September, when two Bulgarian nationals allegedly threw incendiary devices from a moving vehicle onto a construction site near several defence companies.

Police arrested the suspects after a witness reported the incident. Bavarian Interior Minister Joachim Herrmann and regional criminal investigators subsequently indicated that political motives were being considered. Investigators reportedly suspected possible involvement by Russia’s military intelligence service, the GRU, although the allegations have not been established in court.

The case illustrates growing concern about so-called disposable agents: individuals recruited to undertake relatively limited operations without formal intelligence training or a longstanding relationship with an intelligence service.

Such arrangements can complicate investigations. Even where perpetrators are identified, establishing a legally demonstrable connection between their actions and a foreign intelligence organisation may prove considerably more difficult.

Germany’s Federal Criminal Police Office has registered a mid-three-digit number of suspected sabotage and reconnaissance cases since the beginning of 2026, according to information provided to investigators involved in the European mapping project.

Only a small proportion have been publicly attributed to Russia. Four German incidents were included in the map, demonstrating the distinction between a broad national caseload and cases meeting the investigation’s publication criteria.

Europe’s Eastern Borders Under Pressure

The geographical distribution reveals substantial activity along NATO’s eastern flank, particularly around the Baltic states, Belarus and the Black Sea.

Incidents include repeated airspace violations, suspected reconnaissance operations and attempts to facilitate unauthorised border crossings. Lithuanian authorities have accused Belarus of deliberately exploiting migration as an instrument of political pressure.

Commercial shipping has also become increasingly exposed. Drone attacks involving vessels near Romania and Bulgaria have raised concerns about the extension of the war’s consequences into maritime areas adjoining EU and NATO territory.

These developments reinforce earlier warnings about Russia’s expanding sabotage campaign, particularly the difficulty of distinguishing isolated security incidents from coordinated operations intended to test national responses.

Teija Tiilikainen, director of the European Centre of Excellence for Countering Hybrid Threats, identified Russia’s invasion of Ukraine as an important factor behind the increasing pressure. According to her assessment, Moscow’s objectives include weakening Western unity and undermining continued support for Ukraine.

The Legal and Institutional Challenge

The central difficulty is not simply the absence of criminal legislation. Arson, espionage, sabotage and unlawful interference with critical infrastructure are already punishable under national laws.

Rather, the challenge involves establishing foreign direction, coordinating investigations across jurisdictions and identifying when a series of apparently separate offences constitutes a wider hostile campaign.

Germany’s domestic intelligence chief, Sinan Selen, has described the environment as a grey area between war and peace. German foreign intelligence chief Martin Jäger has similarly identified Russia as the country’s most dangerous adversary.

European governments are beginning to address these difficulties collectively. At their 15th–16th October summit, EU leaders condemned intensifying hybrid attacks and called for stronger resilience, greater use of existing countermeasures and accelerated work on drone security.

On 8th October, the Council also extended sanctions targeting Russian destabilisation activities until October 2027. The restrictions cover 80 individuals and 20 entities.

Meanwhile, a European Commission research initiative, published on 23rd October, proposes combining anticipation, active defence and retaliatory measures into a more coherent deterrence strategy.

From Individual Incidents to Collective Security

The investigation’s significance extends beyond the number of incidents recorded. By bringing together information previously dispersed among national authorities and separate investigations, it makes possible a wider assessment of the methods, geographical concentration and recurring characteristics of suspected hostile operations.

Nevertheless, the map does not establish Russian responsibility for every incident it records, nor does it constitute a complete European database. Russia has repeatedly denied conducting the hybrid attacks attributed to it.

For European governments, the unresolved question is how to move from recognising a pattern of hostile activity to demonstrating responsibility and responding effectively.

As EU foreign policy chief Kaja Kallas has warned, the consequences already extend beyond infrastructure disruption to risks affecting civilian lives.

The emerging security challenge therefore concerns not only the detection of individual perpetrators, but also Europe’s ability to connect incidents across borders, establish responsibility and prevent successive operations from becoming an accepted feature of the continent’s security environment.