Brief · Russia-Ukraine war and European security architecture · as of 2026-09-28 · researched
Russia-Ukraine War and European Security Architecture — Hybrid Campaign, Deterrence and Energy/Sanctions Pressures
Escalation
▲ risinggradual paceDirection is rising compared with 2022-2023 baseline; pace is gradual but broadening in target classes. Basis: IISS/AP data shows attacks nearly tripled 2023-2024 (12 to 34) after quadrupling prior year, and 2025-2026 adds rail explosives (Nov 2025), airport drones with explosives (Aug 2026) and coordinated defence-industry fires (Aug 2026). NATO response (Article 4, Eastern Sentry 12 Sep 2025, Baltic Sentry 14 Jan 2025) and German attribution/consulate closure indicate deterrence is hardening, but no lethal sabotage has occurred, suggesting Russia is likely to continue deniable, moderate-damage operations rather than mass-casualty escalation in the near term.
Where things stand
Hybrid campaign is active and attributed: Russia denies involvement, but German, Polish, Lithuanian prosecutors and NATO attribute multiple 2024-2026 incidents to GRU/FSB-directed proxies. No civilian deaths directly linked since 2022; damage is hundreds of millions euros, deliberately moderate. Calm indicator: despite 19-23 drone incursion into Poland 9-10 Sep 2025, NATO response remained Article 4 and defensive posture, not Article 5.
Timeline
Russia began coordinated sabotage/arson/espionage campaign against Europe after full-scale invasion of Ukraine, aimed at destabilizing support for Ukraine and NATO/EU response.
GRU-ordered arson by hired proxies: IKEA Vilnius 8 May 2024 and Marywilska 44 Warsaw shopping centre 11 May 2024 (1,000+ shops destroyed); Poland closed Russian consulate in Kraków May 2025 in response.
GRU-linked proxies planted magnesium incendiary devices in electric massagers that ignited at DHL hubs in Leipzig, near Warsaw (Jablonow) and Birmingham UK to test parcel transfer channels to US/Canada.
NATO launched Operation Baltic Sentry to protect critical undersea infrastructure in Baltic Sea after repeated cable cuts (11 cables cut since 2023, 6 suspected sabotage since 2022).
19-23 Russian Gerbera-type decoy drones violated Polish airspace for 7h15m from Belarus; Polish F-16s, Dutch F-35s, Italian AWACS, German Patriots shot down 3-4, last at 06:45 CEST 10 Sep.
Poland requested NATO Article 4 consultations; North Atlantic Council met, expressed solidarity and denounced Russia's reckless behaviour.
NATO launched Operation Eastern Sentry to bolster eastern flank with Denmark (2 F-16s + frigate), France (3 Rafales), Germany (4 Eurofighters), UK and others, with integrated air defence and counter-drone sensors.
Two sabotage acts on Warsaw-Lublin line (Warsaw-Dorohusk aid corridor): C4 explosive detonated near Mika as freight train passed (21:00 15 Nov) and steel clamp/destroyed overhead line near Puławy/Gołąb forced 475-passenger train to emergency brake. Polish prosecutors charged two Ukrainians acting for FSB/GRU, fled to Belarus.
Small quadcopter with explosives/detonator found on tarmac at Leipzig/Halle airport near Ukrainian Antonov cargo planes; DHL cargo plane reported collision, third drone with ~50g military explosives found nearby.
Concentrated wave hit defence industry: EMCO factory Bulgaria (10 Aug truck fire near 155mm ammo warehouse), KNDS Ammo Italy near Rome (13 Aug gunpowder explosion), Milrem Robotics Tallinn Estonia (15 Aug drone supplier to Ukraine, 2 arrested, 3 Latvians detained), Poland WB Group drone-maker incendiary and Lublin helicopter parts fire 30-31 Aug.
German government attributed Leipzig drone attack to Russia, citing drone configuration, components, explosives/detonator known from other Russian hybrid operations and intelligence pointing to persons acting for Russian state entities.
Germany closed Russian consulate in Bonn effective 18 Sep 2026, terminated Russia House lease in Berlin, summoned ambassador, tightened entry controls and proposed additional EU hybrid-sanctions and shadow-fleet pressure.
Russian foreign intelligence claims EU plotting to move ~$300bn frozen Russian assets out of Euroclear Belgium; Belgium's De Wever government pivotal veto point.
Trump backs idea of diesel export ban as Ukraine hits Russian refineries; Chinese press links strikes to global refining crisis.
Zelensky tells Trump Ukraine ready for energy truce with Russia as reports say Trump will press Zelensky to sign ceasefire at UNGA; energy infrastructure pause as possible off-ramp.
Reports detail Russian gold routed via Hong Kong to evade sanctions as Swiss billionaire lobbies to overturn Putin sanctions and EU ambassadors debate extension.
Chinese coverage frames Ukrainian refinery strikes as deepening global refining crunch, not just battlefield damage.
Taiwan press reports Trump plans to pressure Zelensky into ceasefire deal on UNGA sidelines.
Croatian court approved extradition in Nord Stream bombing case while Macron says CIA did not inform France of possible Russian drone attacks.
Trump pressed Zelensky to settle with Putin as strikes killed 10.
Polish official says US decided to establish base in Poland.
Reports say Russia expected to intensify hybrid war on Europe.
Russian drones struck market outside Kyiv killing two and killed three others in different regions, Ukrainian officials said.
Russian drone strikes hit apartments and cultural landmark in Ukraine killing seven, prompting Poland to scramble jets and warn eastern residents to shelter.
Putin signed decree adding 15,500 troops to Russian army's authorized strength during Ukraine war.
Actor map
Who is acting on whom- Sabotage
- Deters
- Sanctions
- Supports
- Strikes
- Other
| From | Action | To | Note | Date |
|---|---|---|---|---|
| Russia | Sabotage | NATO/EU | Confirmed GRU Unit 29155-led campaign using SVR/FSB/GUGI and proxy recruits via Telegram/crypto after expulsion of ~400 officers in 2022; ~200 incidents tracked since 2022, >50 likely-linked 2022-mid2025. | 2022-02-24 |
| Russia | Sabotage | EU logistics hubs | Magnesium incendiary devices in parcels ignited at DHL hubs Leipzig/Warsaw/Birmingham to test transfer channels for US/Canada. | 2024-07-01 |
| NATO | Deters | Russia | NATO launched Baltic Sentry to protect undersea infrastructure after 11 cable cuts since 2023; Eastern Sentry launched 12 Sep 2025 after Polish airspace violation with F-16s, Rafales, Eurofighters, AWACS, Patriots. | 2025-01-14 |
| EU | Sanctions | Russia | EU immobilized ~€210bn Russian central bank assets; G7 Oct 2024 uses revenues for $50bn loan; Sep 2025 reparation loan proposal €140-172bn contested by Belgium/France/ECB. | 2025-09-01 |
| US | Supports | Poland | US supports Poland with 8,200-10,000 rotational troops, V Corps Forward, Aegis Ashore; Trump pledged to stay and add forces; Poland seeks permanent base. | 2025-09-03 |
| Ukraine | Strikes | Russia | Ukraine dramatically increased drone strikes on Russian refineries (21 of 38 hit since Jan 2025, 14 in Aug, 8 in Sep), causing refinery suspensions and fuel shortages. | 2025-01-01 |
| Russia | Other | Baltic states/Poland | GPS jamming/spoofing surged: Sweden 733 incidents in 2025 vs 55 in 2023, Lithuania 1,185 Jan 2025, Poland 2,732 Jan 2025, traced to Kaliningrad/Leningrad/Pskov. | 2025-09-09 |
Indicators & warnings
| Signal | Status | What it would mean |
|---|---|---|
| Civilian deaths directly linked to sabotage or armed Russian personnel caught conducting attacks in NATO territory | not seen | Would indicate shift from deniable proxy sabotage to direct state-on-state confrontation and likely trigger Article 5 debate. |
| Successful destruction of major ammunition plant, logistics hub, or sustained rail interdiction on Warsaw-Dorohusk aid corridor | emerging | Would show campaign moving from disruption to degradation of Ukraine's supply chain and NATO defence production. |
| Simultaneous multiple undersea cable/pipeline cuts or power cable sabotage causing prolonged outage | observed | Would signal escalation to strategic infrastructure warfare with alliance-wide economic impact. |
| Manned aircraft or armed drone incursion with kinetic strike, or repeated large drone swarms (>20) over Poland/Baltics | observed | Would indicate Russia testing NATO air defence and political cohesion beyond drones. |
| Coordinated drone incursions at multiple NATO airports with explosives (Leipzig pattern repeated) | observed | Would show hybrid pressure expanding to air mobility and civilian aviation. |
Second-order effects
- likely
Defence firms, logistics operators and rail/undersea cable owners face higher insurance, security costs and need for counter-drone, surveillance and redundancy; governments likely to expand hybrid-sanctions listings and shadow-fleet pressure.
Watch for EU hybrid sanctions designations, shadow-fleet seizures, defence industry security audits
- likely
Repeated airspace violations and airport drone incidents increase risk of miscalculation and civilian aviation disruption; NATO air policing and integrated air defence will be tested, raising escalation management burden.
Watch for Eastern Sentry interceptions, airport closures, Article 4 consultations
- roughly even
If reparation loan proceeds, Russia likely to retaliate economically/legal and intensify hybrid pressure to split EU consensus, particularly targeting Belgium as Euroclear host.
Watch for Russian legal action, countersanctions, increased sabotage in Belgium/France
Peripheral effects
- likely
Ukrainian strikes on 21 of 38 large Russian refineries since Jan 2025 have cut refining throughput 300-500k b/d, offline capacity ~1.6M b/d mid-Sep, gasoline output -20%, retail +7.2%, wholesale +40%, forcing export ban and import tariff removal; crude exports via western ports +25% to 2.5M b/d. Bears on European energy security and sanctions efficacy.
Watch for Further refinery hits, Russian fuel rationing spread, global diesel prices
- likely
EU holds ~€210bn of ~€260-300bn frozen Russian assets (Euroclear Belgium); Commission Sep 2025 proposed €140-172bn reparation loan via SPV backed by zero-coupon bonds, Germany backs, Belgium/France/ECB warn on sovereign immunity. Outcome affects Ukraine funding and Russian retaliation calculus.
Watch for EU Council decision, Belgian veto, Russian countersuit/asset seizure
- likely
US maintains 8,200-10,000 troops in Poland (V Corps Forward Poznań, Aegis Ashore Redzikowo); Trump 3-4 Sep 2025 said US will stay and add more if wanted; Poland seeks permanent base for 4-5k plus 10-11k rotational (15k by 2039). Reported 26-28 Sep US base decision would harden eastern flank deterrence.
Watch for Formal basing agreement, troop numbers, NATO force posture
- likely
Putin decree 28 Sep adding 15,500 troops signals sustained force generation despite refinery and sanctions pressure; interacts with frontline drone strikes killing civilians (market outside Kyiv 27 Sep, apartments 28 Sep).
Watch for Mobilization implementation, frontline tempo
What we do not know
- Which specific GRU/SVR/FSB handlers directed 2026 defence-industry and Leipzig attacks and whether third-country proxies were used as in 2024-2025 cases
- Whether Warsaw-Lublin rail sabotage and Leipzig airport drones represent coordinated campaign or opportunistic parallel operations
- Full scale of undersea cable sabotage attribution: how many of 11 cuts since 2023 are confirmed GUGI/GRU vs accidental anchor drag
- Effectiveness of NATO Eastern Sentry/Baltic Sentry in deterring further incursions and whether Russia will test with larger or armed drone swarms
- EU decision on reparation loan using frozen assets: will Belgium veto hold, and what legal/financial stability consequences follow
- Next target classes: will campaign shift to energy grids, water, or civilian aviation beyond current warehouses, rail, defence plants and airports
Related Pulses
0 = calm · 100 = extremecalm 0–25 · elevated 25–50 · severe 50–75 · critical 75–100