Ukraine’s Defense Intelligence (HUR) warned that Russia may stage sabotage in Central and Eastern Europe, including the Baltic states, and blame Ukraine for the attacks, in a Telegram post on 23 October.
The warning comes three days after The Wall Street Journal reported that US intelligence traces Europe’s sabotage wave to Putin’s personal order. If Russia stages new attacks and pins them on Ukraine, as HUR warns, European anger could turn on Kyiv rather than the Kremlin. This goes further than HUR’s statement on 2 October, which named potential Russian targets in Europe but did not mention a plan to blame Ukraine for attacks.
Russia is stepping up its hybrid strategy to destabilize the European Union, according to HUR. The agency identified two aims: reducing foreign support for Ukraine by discrediting its Defense Forces, and intimidating European governments and societies.
The accusations would be spread through Russian propaganda channels and international platforms accessible to the Kremlin.
HUR listed several potential targets for Russian provocations:
The list reflects HUR’s assessment of potential targets, not confirmation that attacks at these locations are planned.
On 2 October, HUR said Russian intelligence services had been ordered to increase activity in EU and NATO countries. It named military facilities, critical infrastructure, communications systems, and Starlink ground stations as potential targets and said it had alerted partners.
Warnings of Russian false flags on NATO’s eastern flank predate HUR’s. In August, Bloomberg reported, citing an unnamed European intelligence official, that Russia might expand hybrid attacks against Poland and the Baltic states, including false-flag attacks. A European government official separately told the agency that the CIA had warned countries in the region of a possible Russian attack. Lithuania’s military intelligence had warned earlier in August that Moscow might reassemble captured Ukrainian drones for false-flag strikes on critical infrastructure in the Baltic region.
Meanwhile, The Wall Street Journal reported on 20 October that US intelligence agencies believe the attempted drone attack on Leipzig-Halle Airport in Germany in early August was among the opening shots of a sabotage campaign ordered by Russian President Vladimir Putin. The Journal cited European officials briefed on the intelligence findings.
According to the newspaper, at least three drones carrying military-grade Semtex explosives were involved. One struck an Antonov cargo plane used to transport military aid to Ukraine but failed to explode. Another collided with a different aircraft, while a third detonated near the airport perimeter. German newspaper Welt am Sonntag has since named two suspects, citing German investigation files. Earlier German media reports described the sequence differently.
The Journal also reported sabotage attacks on Starlink stations in Poland, Lithuania, and Bulgaria in recent weeks. In August, Slovak authorities said they had foiled a planned arson attack on a Ukrainian drone factory, the Journal reported.
Russia denies involvement in sabotage in Europe. Responding to Berlin’s accusations over the Leipzig incident in early September, Putin asked where the evidence was.
A Sofia court has cleared European arrest warrants for two 19-year-old Germans charged with setting fire to Starlink antennas south of the Bulgarian capital, a court spokeswoman told dpa. Prosecutors named the pair in court, but both had already left Bulgaria. The case adds Bulgaria to a run of attacks on Starlink sites in Europe, which Poland and Lithuania have linked to Russia.
While Russia presses its assault along the front and strikes Ukraine’s cities, Starlink keeps Ukraine’s drone units and front-line troops connected, and Poland pays about $50 million a year for its terminals. The network’s ground links in Europe are now a target in their own right, and ISW has linked the Polish fire to a wider Russian pattern of sabotage. Each attack on a ground station hits a network whose speed caps already disrupted Ukraine’s drone missions this month.
Prosecutors identified the suspects as Zeka Islam and Tirpan Beytullah, Bulgaria’s state news agency BTA reported, noting the names may be misspelled. Their whereabouts are unknown, according to German authorities cited by the agency. They were charged in absentia on 14 October and face three to 12 years in prison if convicted.
According to the indictment, the two crossed from Serbia at the Kalotina checkpoint at 17:37 on 9 October and told border officers they were tourists. At about 22:25, wearing gloves and masks, they allegedly set fire to antennas at the Plana teleport, a satellite ground station near the village of Plana. They drove back into Serbia through the same checkpoint at 23:55.
Three antennas burned completely, two were partly damaged, and three more were affected, prosecutors say. The pair traveled in a Volkswagen with German plates, and a national warrant followed two days after the charges, ZDF reported.
The court-appointed lawyers argued that investigators had pinned down the vehicle, not the men in it. The court rejected those objections, finding reasonable grounds to suspect the pair. The lawyers said they would appeal. The ruling can be challenged within three days.
The fire became public only on 12 October, when opposition MP Ivaylo Mirchev of Democratic Bulgaria posted about it on Facebook. He said 11 antennas had been set on fire, more than prosecutors later counted.
In parliament two days later, Prime Minister Rumen Radev asked the head of the State Agency for National Security (DANS) not to reveal details, saying disclosure could harm the investigation. DANS head Plamen Tonchev told lawmakers he believes the fire was sabotage and that more such attacks cannot be ruled out, dpa reported.
After the ruling, Mirchev wrote that Radev personally owes the public an explanation of what has been achieved, BTA reported.
Bulgaria has not said who might be behind the fire. Authorities in Poland and Lithuania have linked similar recent arsons on Starlink equipment to Russia.
In September, fire hit a Starlink ground station south of Warsaw, and Germany later detained two suspects. On 18 October, Lithuania’s prime minister said intruders had tried to burn a company’s Starlink antennas used by Ukraine, calling it part of Russia’s hybrid war. Moscow claims such accusations are baseless, Reuters reported.
Ukraine’s Security Service (SBU) detained two men suspected of scouting targets for Russian strikes on Sloviansk and Dnipro, the agency reported on 14 October. Catching both early let it secure Ukrainian reserve command posts and the gas stations the alleged agents had been hunting, the agency added.
Sloviansk anchors the northern end of the Fortress Belt, the chain of fortified cities that has held Ukraine’s defense of Donetsk Oblast since 2014. Russia is pushing to seize them, and its aircraft bombed a residential area of Sloviansk on 11 October. Where Ukrainian convoys stop and troops gather is exactly what Russian handlers allegedly asked these suspects to supply.
The first suspect worked at a gas station complex in Sloviansk, Donetsk Oblast. Russian intelligence allegedly reached him through a former classmate who left for Russia after the full-scale invasion and now works for its special services, the SBU said. He then allegedly used his phone to secretly film Ukrainian army convoys at or near gas stations. He was allegedly supposed to send the photos and videos to Russia to help it prepare a targeted strike. He also allegedly drove his own car around other gas stations and bridges that the Defense Forces use for logistics.
The second suspect, a former Pokrovsk resident, moved to Dnipro in 2024 and settled in a dormitory. Russian intelligence noticed him through pro-Kremlin comments he posted in Telegram chats, investigators say. A female handler in Russia allegedly tasked him with guiding missile and drone attacks on places in the city where Ukrainian troops and equipment were concentrated. He allegedly scouted on foot or took public transport to reach outlying districts.
Officers seized computers and smartphones containing evidence of the men’s alleged work for Russia. Both are suspected of treason under martial law and of unauthorized dissemination of information on Ukrainian troop movements or deployment, under Articles 111(2) and 114-2(2) of the Criminal Code. They remain in custody without bail and face up to life imprisonment with confiscation of property. The SBU’s office for Donetsk and Luhansk oblasts ran the operation under the Donetsk Oblast Prosecutor’s Office.
Login