The Russian threat to Europe explained to those who do not want to understand it

There are those who continue to maintain that Russia does not pose a threat to Europe. Those who regard every warning as an exaggeration, every incident as a coincidence, every allegation as a piece of Western propaganda. That is why we have tried to make this as straightforward as possible: to set aside the slogans and lay out the facts. Just those from 2026. Drones entering NATO countries’ airspace, military aircraft intercepted over the Baltic, GPS jamming, spy ships, submarines near critical infrastructure, men accused of working for Russian intelligence, disinformation campaigns, cyber-espionage operations, threats against European industries, oil tankers from the ‘shadow fleet’, and missiles landing beyond Ukraine’s borders. A map of Russian pressure on Europe, compiled for those who prefer to judge the threat not by words, but by reality.

The oil tanker Grinch. France intercepted and diverted the Grinch – which had set sail from Murmansk and was suspected of carrying Russian oil under an invalid Comoros flag – to Marseille. The captain was detained. The vessel was released only after a multi-million fine had been paid: a prime example of how corporate identities and shell companies protect Russian exports.

The spy amongst German drone manufacturers. Germany has arrested a German-Ukrainian national accused of working for Russian intelligence. She is alleged to have gathered information on defence companies, drone trials, military deliveries to Ukraine and political events. Berlin has expelled a Russian diplomat. This is not abstract espionage, then: Moscow was seeking data on equipment manufactured in Europe and its intended destination.

Sixteen thousand shipments to the Russian military. German authorities have arrested five people accused of organising at least sixteen thousand shipments, worth thirty million euros, destined for twenty-four Russian defence companies. Investigators suspect the involvement of Russian state bodies. Moscow’s arms industry does not rely solely on domestic production: it systematically attempts to purchase in Europe what sanctions deny it.

Drone launched from Russian spy ship. During the visit to Sweden by the French nuclear-powered aircraft carrier Charles de Gaulle, the Swedish armed forces observed a drone taking off from the Russian intelligence vessel Zhigulevsk and heading towards the aircraft carrier. A Swedish unit jammed it electronically. This is the clearest case yet of Russian drone reconnaissance against a Western military target.

Two Russian incursions into Romanian airspace in two days. Whilst Moscow was attacking Ukrainian infrastructure along the Danube, Romania detected unmanned aerial vehicles coming from the area of the Russian attacks on two consecutive days and scrambled fighter jets. This is the tactic of constant pressure: striking just a few metres from NATO territory, crossing the border, observing reactions and forcing an ally to mobilise its air defences.

The Ethera with forged documents. Belgium has detained the oil tanker Ethera, which had already been sanctioned by the European Union and is linked to the Russian shadow fleet, accusing it of false registration in Guinea and dozens of administrative and safety breaches. A guarantee of ten million euros has been demanded for its release. The Russian system also relies on this: a ship changes its name, owner or flag, but continues to transport energy for Moscow.

The Caffa, the false flag and Ukrainian wheat. Sweden has detained the Caffa, which was sailing under what is believed to be a false Guinean flag and with a largely Russian crew. The vessel was suspected of carrying wheat stolen from the occupied territories of Ukraine. The case reveals the other side of Russian logistics: not only selling its own oil whilst circumventing sanctions, but also trading in resources taken from the conquered areas.

The stateless vessel Sea Owl I. The Swedish authorities have detained the Sea Owl I, which is subject to EU sanctions and formally registered in the Comoros. The vessel’s documents were deemed invalid and it was treated as stateless; the Russian captain is now under investigation. A fleet that can change its identity with every voyage makes it more difficult to enforce sanctions, insurance requirements and maritime safety regulations.

Another possible Russian drone over Romania. Romanian radars have detected a possible incursion into their airspace during a new Russian attack on Ukrainian port infrastructure. Fighter jets were scrambled and a search for any debris has begun. The identity of the object has not yet been confirmed, but the incursion took place as part of a Russian strike directed towards the NATO border.

Debris found outside homes in Plauru. Following a Russian attack on the Ukrainian port of Izmail, the Romanian authorities searched for drone debris near Plauru, the NATO village situated on the other side of the Danube. The incident highlights just how artificial the distinction is between the war ‘within Ukraine’ and European security: it takes just a few hundred metres for a Russian weapon to land on Alliance territory.

The Deyna set sail from Murmansk. The French Navy boarded the oil tanker Deyna, which had departed from Murmansk carrying Russian crude oil and was suspected of operating under a false Mozambican registration. The operation received British support. The politically significant point is that Russian trade does not only pass through distant ports: it regularly traverses European routes under administrative cover that is difficult to verify.

Spies outside the company supplying Kyiv. Germany and Spain have arrested Sergey N. and Alla S., accused of spying on behalf of Russian intelligence on a firm producing drones and components destined for Ukraine. The target was not a state secret held within a ministry, but an ordinary European company: in Russia’s hybrid war, factories, employees, transport and supply chains become targets.

Ukrainian drone diverted by Russian interference. A Ukrainian military drone, presumably bound for a target in Russia, first entered Estonian airspace and then Latvian airspace. A second drone struck the chimney of the Auvere power station in Estonia. The authorities cited Russian electronic warfare as one possible explanation, noting that it is capable of diverting weapons and shifting the risk onto NATO countries.

Electronic warfare over Finland. Two military drones have entered Finnish airspace; at least one has been identified as a Ukrainian aircraft. The Finnish government has cited heavy Russian jamming of satellite signals as a possible cause of the deviation. This is not a direct Russian attack, but it is a tangible effect of its electronic warfare: weapons straying off course into a NATO country.

Russian fighter jet enters Estonian airspace. A Russian Su-30 violated Estonian airspace for approximately one minute near the island of Vaindloo, in the Gulf of Finland. Italian fighter jets involved in the NATO air policing mission intervened. It was the first Russian violation recorded by Estonia in 2026: brief enough to be downplayed, yet precise enough to gauge Western response times.

European routers turned into tools for the GRU. Germany has attributed to the APT28 group, linked to the GRU, the compromise of vulnerable routers used to spy on public institutions, military bodies and critical infrastructure. Around thirty devices had been identified in Germany, as part of a global network of thousands of devices. The advantage for Moscow is clear: to conceal the attack behind ordinary Western domestic internet connections.

Three Russian submarines near European cables. The UK and Norway have been tracking an Akula-class attack submarine and two specialist vessels from Gugi – the Russian agency responsible for underwater operations – for over a month in British and allied economic waters. The vessels did not necessarily enter territorial waters and no damage has been confirmed, but they operated close to cables and subsea infrastructure essential for communications and energy.

A frigate is protecting sanctioned oil tankers. The Russian frigate Admiral Grigorovich escorted the oil tankers Universal and Enigma – both subject to sanctions and carrying around forty thousand tonnes of diesel – across the English Channel. The Royal Navy and NATO monitored them. The ‘shadow fleet’ is not a single hostile act, but the infrastructure through which Moscow continues to sell oil, circumvent sanctions, finance the war and shift the risk of accidents caused by ageing vessels, unreliable insurance, opaque ownership and often false flags onto coastal nations. It is no longer merely an opaque commercial network: Moscow has begun to protect it openly with a warship.

Moscow intervenes in the Hungarian election campaign. On the eve of the Hungarian election, the Kremlin accused the European Union of seeking to topple Viktor Orbán. Russian and pro-Russian Telegram channels have, in a coordinated manner, amplified content favourable to the Prime Minister and hostile to Brussels and Ukraine. There is no need to tamper with the ballot papers: it is enough to use the authority of the Russian state and its media network to pre-emptively delegitimise a potentially unwelcome result.

Cyber reconnaissance targeting French nuclear deterrence. European authorities have detected a Russian reconnaissance campaign targeting French ultra-low-frequency communications systems, which are also used for nuclear deterrence. The attackers were seeking information on sites, redundancies, personnel and network architecture. There is no evidence of a breach capable of neutralising these systems, but mapping the system is the first necessary step towards attempting to disrupt it in a crisis.

Two Russian fighter jets came within a hair’s breadth of a British aircraft. Two Russian aircraft dangerously intercepted an unarmed British Rivet Joint in international airspace over the Black Sea. A Su-35 triggered the aircraft’s emergency systems; a Su-27 made six passes, coming within approximately six metres. There was no territorial violation, but a single misstep could have led to a collision and a military crisis between Russia and NATO.

Russian strategic bombers over the Baltic. Two Tu-22M3 nuclear bombers, accompanied by around ten Su-30 and Su-35 fighter jets, flew through international airspace over the Baltic. NATO aircraft from six countries took off to track them. Moscow has claimed the flight was lawful, stating that it took place in the airspace above the neutral waters of the Baltic Sea. However, concentrating strategic bombers and fighter jets off the European coast serves to simulate attacks, gather intelligence and wear down defences.

Russian drones cause damage to Romanian property. Romania has recovered the wreckage of two Russian drones in the provinces of Galați and Tulcea. One drone damaged an electricity pylon and a residential outbuilding. British Typhoons were scrambled. This was the first incident of 2026 in which incursions linked to Russian attacks caused material damage to private Romanian property.

Two attempted murders attributed to the GRU. The Lithuanian public prosecutor’s office has charged thirteen people with two attempted murders in Vilnius linked to the GRU, Russia’s military intelligence agency. The targets were an activist raising funds for Ukraine and a Russian dissident from Bashkortostan. The same network has been linked to a fire involving military equipment destined for Kyiv in Bulgaria and to military espionage activities in Greece. This is not propaganda: it is clandestine violence within Europe.

The catalogue of targets for sabotage. Germany has arrested Kazakh national Sergei K., accused of providing Russian intelligence services with information on defence companies, drone and robot manufacturers, and potential targets for sabotage. According to investigators, he also suggested individuals to be recruited. Moscow does not merely gather secrets: it compiles lists of infrastructure and individuals to be targeted or utilised. (continued on the back cover)

Russian drone crosses the Romanian border. During an air strike on Izmail, Romanian radars tracked a Russian drone that crossed the border and entered national airspace. Allied fighter jets were put on alert. This is no longer simply a matter of debris falling by mistake: it is a Russian attack aircraft detected within the territory of a NATO member state.

Jin Hui detained in Sweden.

Sweden has detained the Jin Hui, suspected of belonging to the ‘shadow fleet’ and of sailing with invalid documents and serious safety issues. The Chinese captain has been arrested. Not every seafarer needs to be Russian: Moscow purchases services, companies, registrations and international intermediaries to transport its oil outside the Western sanctions regime.

Latvian oil depot hit by a drone. A drone originating from Russia exploded at an oil facility in Rezekne, damaging four empty tanks. The Ukrainian authorities claimed that the drone, of Ukrainian origin, had been diverted by Russian electronic warfare. Once again, Moscow did not directly launch the drone against Latvia, but its interference caused an explosion on NATO territory.

Spy plane without a flight plan. Polish fighter jets intercepted a Russian Il-20 electronic reconnaissance aircraft over international waters in the Baltic Sea. The aircraft was flying without a flight plan and with its transponder switched off. It did not enter Polish airspace, but Warsaw described the incident – which took place with the transponder switched off and without a flight plan – as a provocative test of NATO’s air defence systems: flying undetected by civilian air traffic also serves to force NATO to reveal its radar coverage, procedures and reaction times.

NATO fighter jet shoots down a drone over Estonia. A Romanian fighter jet on a NATO mission shot down a military drone that had entered Estonian airspace from the direction of Russia. Kyiv stated that the Ukrainian aircraft had been diverted by Russian electronic countermeasures. A weapon intended to strike the aggressor thus became a threat to an ally: yet another consequence of the Russian war spilling over beyond Ukraine’s borders.

British minister’s flight disrupted by Russia. The military aircraft bringing Defence Minister John Healey back to the UK following a visit to Estonia experienced disruption to its GPS and internet communications for around three hours. British defence sources have attributed the interference to Russia. The aircraft continued its journey using alternative navigation systems: this was not merely an inconvenience, but a deliberate risk to an official flight.

Moscow is expanding the scope of its GPS jamming. Lithuania has reported that Russian equipment installed in the Kaliningrad enclave has extended the range of interference and signal tampering to hundreds of kilometres. The target is not just the military: GPS and navigation systems are used by civil aircraft, ships, ambulances and infrastructure. Russia’s electronic warfare is undermining the security of the common European airspace.

Russian military aircraft over Finland. Finland has detected a probable violation of its airspace, near Porkkala, by a Russian military aircraft. Helsinki has deployed the air force, launched an investigation and summoned the Russian ambassador. Moscow has cited a diversion due to bad weather: even if one takes this explanation at face value, the fact remains that a Russian military aircraft entered a NATO country without authorisation.

Russian drone strikes a block of flats in Romania. A drone used in the Russian attack on Ukraine struck the roof of a ten-storey block of flats in the Romanian city of Galati, causing a fire and slightly injuring a woman and a child. This was the first incident in which a Russian strike has hit a densely populated area within NATO territory and caused casualties. This is not a theoretical provocation: European families have been struck in their own homes.

The Tagor intercepted in the Atlantic. The French Navy intercepted the Tagor some 740 kilometres west of Brittany. The oil tanker was coming from Murmansk and was suspected of flying a false Madagascan flag. The vessel, part of Russia’s so-called ‘shadow fleet’, was detained due to international sanctions, flying a false Cameroonian flag and refusing to comply. The operation, supported by the United Kingdom, demonstrates the extent of the network: not only the Baltic and the English Channel, but the entire European maritime corridor is being used to export Russian crude oil.

Molotov cocktails thrown at French drone factory. Incendiary bottles were hurled at the Delair plant, near Toulouse, which manufactures drones also used by Ukraine. The damage was limited. Russian involvement has not been formally proven, but the incident has been included in the investigation into reconnaissance activities and possible pro-Russian recruitment around the company. It is a typical example of low-cost sabotage that is easy to deny.

Video prototype for a Russian contact. A Belarusian national was arrested whilst filming a prototype of the Delair and is alleged to have sent the footage via Telegram to a Russian contact. Investigators have also examined a possible link to the previous arson attack, though they do not yet consider this to have been proven. The method is a recurring one: recruiting ordinary people online, assigning them small tasks and keeping the instigator at a distance.

Drone off the coast of Constanța. A Ukrainian naval drone, which Kyiv claims was disrupted by Russian electronic systems, self-destructed approximately five hundred metres from the Constanța oil terminal. More than a thousand people were evacuated and three other drones exploded offshore. No serious damage was caused, but a strategic European port was put at risk by a predictable side effect of Moscow’s electronic warfare.

The Royal Marines boarded the Smyrtos. British forces boarded the Smyrtos, which was carrying around 100,000 tonnes of Russian crude oil and flying the Cameroonian flag. It was the first operation of its kind led directly by the United Kingdom. The crew offered no resistance. London has thus transformed the fight against the shadow fleet from an administrative control measure into a maritime operation carried out by military units.

Warning shots fired near a British yacht. The frigate Admiral Grigorovich fired small-arms shots in the vicinity of a British yacht some twenty miles from the Isle of Wight. No one was injured and Moscow described it as an anti-collision manoeuvre, but the British government called the incident reckless. A Russian warship fired weapons just a few kilometres from a civilian vessel in European waters.

The Deliver, the ninth vessel detained in Europe. France intercepted the Deliver off the coast of Sicily; the vessel had set sail from the Russian port of Primorsk and was suspected of operating under an invalid Cameroonian registration. According to Reuters, it was the ninth vessel in the ‘shadow fleet’ to be detained in Europe since the start of 2026. Nine cases in six months do not simply point to a few dishonest shipowners: they point to an organised network designed to finance the Russian state.

Russian bear against British aircraft carrier. A Russian Tu-142 anti-submarine patrol aircraft made repeated approaches to the British aircraft carrier Prince of Wales in the Norwegian Sea, flying at low altitude and deploying acoustic buoys (sonobuoys), before being intercepted and escorted by British F-35B fighter jets. London has described the behaviour as unsafe and unprofessional. Moscow was studying the acoustic signature, the escort and the reactions of a NATO naval group.

The South Star under European scrutiny. The European Irini mission boarded the South Star in the Mediterranean to verify its identity, cargo and registration, as it was suspected of being linked to the false-flag schemes used by the shadow fleet. The operation did not result in a seizure, but confirms the gradual shift of Russian shipping routes towards the Mediterranean, where controls and legal jurisdiction are more fragmented.

Three drones shot down by Romania in three days. Romanian forces have shot down three drones in three days, one of which was twelve kilometres from Sulina and therefore over Romanian territorial waters. One of the drones was identified as a Shahed model, used by Russia. Since the start of the invasion, Bucharest had recorded thirty-three Russian incursions: these were not isolated incidents, but systematic pressure on the NATO border.

Russian cruise missile falls in Poland. A Russian Kh-101 flew through Polish airspace and fell near the agricultural area of Tarnawa-Kolonia, in the Lublin region, about one hundred kilometres from the Ukrainian border, leaving a ten-metre crater. Warsaw has summoned the Russian ambassador. A missile designed to carry hundreds of kilos of explosives travelled a significant distance across a NATO country: it was luck, not deterrence, that prevented any casualties.

The Toa Payoh was stopped off the coast of Pantelleria. The IRINI mission and the Italian authorities boarded the Toa Payoh west of Pantelleria. The captain was initially uncooperative, and a helicopter had to be deployed. The vessel, which had recently been registered in Cameroon, was not seized due to the limitations of the European mandate: an example of the regulatory loopholes exploited by opaque networks.

Polish aircraft intercept two Russian reconnaissance aircraft in two days. The Polish Ministry of Defence reported that Polish fighter jets intercepted a Russian Il-20 reconnaissance aircraft 56 kilometres from the city of Koszalin, in the West Pomerania region. The previous day, the Polish army had reported another interception of a Russian reconnaissance aircraft over the Baltic Sea, noting that the aircraft was flying with its transponder switched off.

Explosive-laden drone at Leipzig Airport. A drone carrying military-grade explosives and a detonator was found in the cargo area of Leipzig-Halle Airport, near the runway and a Ukrainian Antonov aircraft carrying military equipment. The detonator failed to go off. A cargo aircraft had also collided with a flying object. The Federal Public Prosecutor’s Office is investigating on suspicion of sabotage; attribution to Russia is not yet official, but the target coincides with Western logistics operations for Kyiv.

The oil tanker Grinch. France intercepted and diverted the Grinch – which had set sail from Murmansk and was suspected of carrying Russian oil under an invalid Comoros flag – to Marseille. The captain was detained. The vessel was released only after a multi-million fine had been paid: a prime example of how corporate identities and shell companies protect Russian exports.

The spy amongst German drone manufacturers. Germany has arrested a German-Ukrainian national accused of working for Russian intelligence. She is alleged to have gathered information on defence companies, drone trials, military deliveries to Ukraine and political events. Berlin has expelled a Russian diplomat. This is not abstract espionage, then: Moscow was seeking data on equipment manufactured in Europe and its intended destination.

Sixteen thousand shipments to the Russian military. German authorities have arrested five people accused of organising at least sixteen thousand shipments, worth thirty million euros, destined for twenty-four Russian defence companies. Investigators suspect the involvement of Russian state bodies. Moscow’s arms industry does not rely solely on domestic production: it systematically attempts to purchase in Europe what sanctions deny it.

Drone launched from Russian spy ship. During the visit to Sweden by the French nuclear-powered aircraft carrier Charles de Gaulle, the Swedish armed forces observed a drone taking off from the Russian intelligence vessel Zhigulevsk and heading towards the aircraft carrier. A Swedish unit jammed it electronically. This is the clearest case yet of Russian drone reconnaissance against a Western military target.

Two Russian incursions into Romanian airspace in two days. Whilst Moscow was attacking Ukrainian infrastructure along the Danube, Romania detected unmanned aerial vehicles coming from the area of the Russian attacks on two consecutive days and scrambled fighter jets. This is the tactic of constant pressure: striking just a few metres from NATO territory, crossing the border, observing reactions and forcing an ally to mobilise its air defences.

The Ethera with forged documents. Belgium has detained the oil tanker Ethera, which had already been sanctioned by the European Union and is linked to the Russian shadow fleet, accusing it of false registration in Guinea and dozens of administrative and safety breaches. A guarantee of ten million euros has been demanded for its release. The Russian system also relies on this: a ship changes its name, owner or flag, but continues to transport energy for Moscow.

The Caffa, the false flag and Ukrainian wheat. Sweden has detained the Caffa, which was sailing under an alleged false Guinean flag with a largely Russian crew. The vessel was suspected of carrying wheat stolen from the occupied territories of Ukraine. The case reveals the other side of Russian logistics: not only selling its own oil whilst circumventing sanctions, but also trading in resources seized from the conquered areas.

The stateless vessel Sea Owl I. The Swedish authorities have detained the Sea Owl I, which is subject to EU sanctions and formally registered in the Comoros. The documents were deemed invalid and the vessel was treated as stateless; the Russian captain is now under investigation. A fleet that can change its identity with every voyage makes it more difficult to enforce sanctions, insurance requirements and maritime safety regulations.

Another possible Russian drone over Romania. Romanian radars have detected a possible incursion into their airspace during a new Russian attack on Ukrainian port infrastructure. Fighter jets were scrambled and a search for any debris has begun. The identity of the object has not yet been confirmed, but the incursion took place as part of a Russian strike directed towards the NATO border.

Debris found outside homes in Plauru. Following a Russian attack on the Ukrainian port of Izmail, the Romanian authorities searched for drone debris near Plauru, the NATO village situated on the other side of the Danube. The incident highlights just how artificial the distinction is between the war ‘within Ukraine’ and European security: it takes just a few hundred metres for a Russian weapon to land on Alliance territory.

The Deyna set sail from Murmansk. The French Navy boarded the oil tanker Deyna, which had departed from Murmansk carrying Russian crude oil and was suspected of operating under a false Mozambican registration. The operation received British support. The politically significant point is that Russian trade does not only pass through distant ports: it regularly traverses European routes under administrative cover that is difficult to verify.

Spies outside the company supplying Kyiv. Germany and Spain have arrested Sergey N. and Alla S., accused of spying on behalf of Russian intelligence on a firm producing drones and components destined for Ukraine. The target was not a state secret held within a ministry, but an ordinary European company: in Russia’s hybrid war, factories, employees, transport and supply chains become targets.

Ukrainian drone diverted by Russian interference. A Ukrainian military drone, presumably bound for a target in Russia, first entered Estonian airspace and then Latvian airspace. A second drone struck the chimney of the Auvere power station in Estonia. The authorities cited Russian electronic warfare as one possible explanation, noting that it is capable of diverting weapons and shifting the risk onto NATO countries.

Electronic warfare over Finland. Two military drones have entered Finnish airspace; at least one has been identified as a Ukrainian aircraft. The Finnish government has cited heavy Russian jamming of satellite signals as a possible cause of the deviation. This is not a direct Russian attack, but it is a tangible effect of its electronic warfare: weapons straying off course into a NATO country.

Russian fighter jet enters Estonian airspace. A Russian Su-30 violated Estonian airspace for approximately one minute near the island of Vaindloo, in the Gulf of Finland. Italian fighter jets involved in the NATO air policing mission intervened. It was the first Russian violation recorded by Estonia in 2026: brief enough to be downplayed, yet precise enough to gauge Western response times.

European routers turned into tools for the GRU. Germany has attributed to the APT28 group, linked to the GRU, the compromise of vulnerable routers used to spy on public institutions, military bodies and critical infrastructure. Around thirty devices had been identified in Germany, as part of a global network of thousands of devices. The advantage for Moscow is clear: to conceal the attack behind ordinary Western domestic connections.

Three Russian submarines near European cables. The UK and Norway have been tracking an Akula-class attack submarine and two specialised vessels belonging to Gugi – the Russian agency responsible for underwater operations – for over a month in British and allied economic waters. The vessels did not necessarily enter territorial waters and no damage has been confirmed, but they operated close to cables and subsea infrastructure essential for communications and energy.

A frigate is protecting sanctioned oil tankers. The Russian frigate Admiral Grigorovich escorted the oil tankers Universal and Enigma – both subject to sanctions and carrying around forty thousand tonnes of diesel – across the English Channel. The Royal Navy and NATO monitored them. The ‘shadow fleet’ is not a single hostile act, but the infrastructure through which Moscow continues to sell oil, circumvent sanctions, finance the war and shift the risk of accidents caused by ageing vessels, uncertain insurance cover, opaque ownership and often false flags onto coastal nations. It is no longer merely an opaque commercial network: Moscow has begun to protect it openly with a warship.

Moscow intervenes in the Hungarian election campaign. On the eve of the Hungarian election, the Kremlin accused the European Union of seeking to topple Viktor Orbán. Russian and pro-Russian Telegram channels have, in a coordinated manner, amplified content favourable to the Prime Minister and hostile to Brussels and Ukraine. There is no need to tamper with the ballot papers: it is enough to use the authority of the Russian state and its media network to pre-emptively delegitimise a potentially unwelcome result.

Cyber reconnaissance targeting French nuclear deterrence. European authorities have detected a Russian reconnaissance campaign targeting French ultra-low-frequency communications systems, which are also used for nuclear deterrence. The attackers were seeking information on sites, redundancies, personnel and network architecture. There is no evidence of a breach capable of neutralising these systems, but mapping the system is the first necessary step towards attempting to disrupt it in a crisis.

Two Russian fighter jets came within a hair’s breadth of a British aircraft. Two Russian aircraft dangerously intercepted an unarmed British Rivet Joint in international airspace over the Black Sea. A Su-35 triggered the aircraft’s emergency systems; a Su-27 made six passes, coming within approximately six metres. There was no territorial violation, but a single misstep could have led to a collision and a military crisis between Russia and NATO.

Russian strategic bombers over the Baltic. Two Tu-22M3 nuclear bombers, accompanied by around ten Su-30 and Su-35 fighter jets, flew through international airspace over the Baltic. NATO aircraft from six countries took off to track them. Moscow has claimed the flight was lawful, stating that it took place in the airspace above the neutral waters of the Baltic Sea. However, concentrating strategic bombers and fighter jets off the European coast serves to simulate attacks, gather intelligence and wear down defences.

Russian drones cause damage to Romanian property. Romania has recovered the wreckage of two Russian drones in the provinces of Galați and Tulcea. One drone damaged an electricity pylon and a residential outbuilding. British Typhoons were scrambled. This was the first incident of 2026 in which incursions linked to Russian attacks caused material damage to private Romanian property.

Two attempted murders attributed to the GRU. The Lithuanian public prosecutor’s office has charged thirteen people with two attempted murders in Vilnius linked to the GRU, Russia’s military intelligence agency. The targets were an activist raising funds for Ukraine and a Russian dissident from Bashkortostan. The same network has been linked to a fire involving military equipment destined for Kyiv in Bulgaria and to military espionage activities in Greece. This is not propaganda: it is clandestine violence within Europe.

The catalogue of targets for sabotage. Germany has arrested Kazakh national Sergei K., accused of providing Russian intelligence services with information on defence companies, drone and robot manufacturers, and potential targets for sabotage. According to investigators, he also suggested individuals to be recruited. Moscow does not merely gather secrets: it compiles lists of infrastructure and individuals to be targeted or utilised. (continued on the back cover)

Russian drone crosses the Romanian border. During an air strike on Izmail, Romanian radar tracked a Russian drone that crossed the border and entered national airspace. Allied fighter jets were put on alert. This is no longer simply a matter of debris falling by mistake: it is a Russian attack aircraft detected within the territory of a NATO member state.

Jin Hui detained in Sweden.

Sweden has detained the Jin Hui, suspected of belonging to the ‘shadow fleet’ and of sailing with invalid documents and serious safety issues. The Chinese captain has been arrested. Not every seafarer needs to be Russian: Moscow buys services, companies, registrations and international intermediaries to get its oil around the Western sanctions regime.

Latvian oil depot hit by a drone. A drone originating from Russia exploded at an oil facility in Rezekne, damaging four empty tanks. The Ukrainian authorities claimed that the drone, of Ukrainian origin, had been diverted by Russian electronic warfare. In this case too, Moscow did not directly launch the drone against Latvia, but its interference caused an explosion on NATO territory.

Spy plane without a flight plan. Polish fighter jets intercepted a Russian Il-20 electronic reconnaissance aircraft over international waters in the Baltic Sea. The aircraft was flying without a flight plan and with its transponder switched off. It did not enter Polish airspace, but Warsaw described the incident – which took place with the transponder switched off and without a flight plan – as a provocative test of NATO’s air defence systems: flying undetected by civilian air traffic also serves to force NATO to reveal its radar coverage, procedures and reaction times.

NATO fighter jet shoots down a drone over Estonia. A Romanian fighter jet on a NATO mission shot down a military drone that had entered Estonian airspace from the direction of Russia. Kyiv stated that the Ukrainian aircraft had been diverted by Russian electronic countermeasures. A weapon intended to strike the aggressor thus became a threat to an ally: yet another consequence of the Russian war spilling over beyond Ukraine’s borders.

British minister’s flight disrupted by Russia. The military aircraft bringing Defence Minister John Healey back to the UK following a visit to Estonia experienced disruption to its GPS and internet communications for around three hours. British defence sources have attributed the interference to Russia. The aircraft continued its journey using alternative navigation systems: this was not merely an inconvenience, but a deliberate risk to an official flight.

Moscow is expanding the scope of its GPS jamming. Lithuania has reported that Russian equipment installed in the Kaliningrad enclave has extended the range of interference and signal tampering to hundreds of kilometres. The target is not just the military: GPS and navigation systems are used by civil aircraft, ships, ambulances and infrastructure. Russia’s electronic warfare is undermining the security of the common European airspace.

Russian military aircraft over Finland. Finland has detected a probable violation of its airspace, near Porkkala, by a Russian military aircraft. Helsinki has deployed the air force, launched an investigation and summoned the Russian ambassador. Moscow has cited a diversion due to bad weather: even if one takes this explanation at face value, the fact remains that a Russian military aircraft entered a NATO country without authorisation.

Russian drone strikes Romanian block of flats. A drone used in the Russian attack on Ukraine struck the roof of a ten-storey block of flats in the Romanian city of Galati, causing a fire and slightly injuring a woman and a child. This was the first incident in which a Russian strike has hit a densely populated area within NATO territory and caused casualties. This is not a theoretical provocation: European families have been struck in their own homes.

The Tagor intercepted in the Atlantic. The French Navy intercepted the Tagor some 740 kilometres west of Brittany. The oil tanker was travelling from Murmansk and was suspected of flying a false Madagascan flag. The vessel, part of Russia’s so-called ‘shadow fleet’, was detained due to international sanctions, flying a false Cameroonian flag and refusing to comply. The operation, supported by the United Kingdom, demonstrates the extent of the network: not only the Baltic and the English Channel, but the entire European maritime corridor is being used to export Russian crude oil.

Molotov cocktails thrown at French drone factory. Incendiary bottles were hurled at the Delair plant, near Toulouse, which manufactures drones also used by Ukraine. The damage was limited. Russian involvement has not been formally proven, but the incident has been included in the investigation into reconnaissance activities and possible pro-Russian recruitment around the company. It is a typical example of low-cost sabotage that is easy to deny.

Video prototype for a Russian contact. A Belarusian national was arrested whilst filming a prototype of the Delair and is alleged to have sent the footage via Telegram to a Russian contact. Investigators have also examined a possible link to the previous arson attack, though they do not yet consider this to have been proven. The method is a recurring one: recruiting ordinary people online, assigning them small tasks and keeping the instigator at a distance.

Drone off the coast of Constanța. A Ukrainian naval drone, which Kyiv claims was disrupted by Russian electronic systems, self-destructed approximately five hundred metres from the Constanța oil terminal. More than a thousand people were evacuated and three other drones exploded offshore. No serious damage was caused, but a strategic European port was put at risk by a predictable side effect of Moscow’s electronic warfare.

The Royal Marines boarded the Smyrtos. British forces boarded the Smyrtos, which was carrying around 100,000 tonnes of Russian crude oil and flying the Cameroonian flag. It was the first operation of its kind to be led directly by the United Kingdom. The crew offered no resistance. London has thus transformed the fight against the shadow fleet from an administrative control measure into a maritime operation carried out by military units.

Warning shots fired near a British yacht. The frigate Admiral Grigorovich fired small-arms rounds in the vicinity of a British yacht some twenty miles from the Isle of Wight. No one was injured and Moscow described it as an anti-collision manoeuvre, but the British government called the incident reckless. A Russian warship fired weapons just a few kilometres from a civilian vessel in European waters.

The Deliver, the ninth vessel detained in Europe. France intercepted the Deliver off the coast of Sicily; the vessel had set sail from the Russian port of Primorsk and was suspected of operating under an invalid Cameroonian registration. According to Reuters, it was the ninth vessel in the ‘shadow fleet’ to be detained in Europe since the start of 2026. Nine cases in six months do not simply point to a few dishonest shipowners: they point to an organised network designed to finance the Russian state.

Russian bear against British aircraft carrier. A Russian Tu-142 anti-submarine patrol aircraft made repeated approaches to the British aircraft carrier Prince of Wales in the Norwegian Sea, flying at low altitude and deploying acoustic buoys (sonobuoys), before being intercepted and escorted by British F-35B fighter jets. London has described the behaviour as unsafe and unprofessional. Moscow was studying the acoustic signature, the escort and the reactions of a NATO naval group.

The South Star under European scrutiny. The European Irini mission boarded the South Star in the Mediterranean to verify its identity, cargo and registration, as it was suspected of being linked to the false-flag schemes used by the shadow fleet. The operation did not result in a seizure, but confirms the gradual shift of Russian shipping routes towards the Mediterranean, where controls and legal jurisdiction are more fragmented.

Three drones shot down by Romania in three days. Romanian forces have shot down three drones in three days, one of which was twelve kilometres from Sulina and therefore over Romanian territorial waters. One of the drones was identified as a Shahed model, used by Russia. Since the start of the invasion, Bucharest had recorded thirty-three Russian incursions: these were not isolated incidents, but systematic pressure on the NATO border.

Russian cruise missile falls in Poland. A Russian Kh-101 flew through Polish airspace and fell near the agricultural area of Tarnawa-Kolonia, in the Lublin region, about one hundred kilometres from the Ukrainian border, leaving a ten-metre crater. Warsaw has summoned the Russian ambassador. A missile designed to carry hundreds of kilos of explosives travelled a significant distance across a NATO country: it was luck, not deterrence, that prevented any casualties.

The Toa Payoh was stopped off the coast of Pantelleria. The IRINI mission and the Italian authorities boarded the Toa Payoh west of Pantelleria. The captain was initially uncooperative, and it was necessary to deploy a helicopter. The vessel, which had recently been registered in Cameroon, was not seized due to the limitations of the European mandate: an example of the regulatory loopholes exploited by opaque networks.

Polish aircraft intercept two Russian reconnaissance aircraft in two days. The Polish Ministry of Defence reported that Polish fighter jets intercepted a Russian Il-20 reconnaissance aircraft 56 kilometres from the city of Koszalin, in the West Pomerania region. The previous day, the Polish army had reported another interception of a Russian reconnaissance aircraft over the Baltic Sea, noting that the aircraft was flying with its transponder switched off.

Explosive-laden drone at Leipzig Airport. A drone carrying military-grade explosives and a detonator was found in the cargo area of Leipzig-Halle Airport, near the runway and a Ukrainian Antonov aircraft carrying military equipment. The detonator failed to go off. A cargo aircraft had also collided with a flying object. The Federal Public Prosecutor’s Office is investigating on suspicion of sabotage; attribution to Russia is not yet official, but the target coincides with Western logistics operations for Kyiv.