Every tool lives here: full-text search and the filters the map does not carry. Filters apply to both views, so they are still there when you go back to the map. Click a row to open its card.
All words must match. Case, Polish diacritics and hyphens are ignored (Przewodów = przewodow, Ch-55 = Kh-55). Order: exact ID, place/model, aliases, description.
Active filters
Country
Period
Type of event
Link to Russia
How firmly the event is tied to an actor. Grades A to D are explained on the about page.
Target
Object
Applies only to events where something flew.
Only
Register summary
Figures for the whole register. They do not respond to the filters above.
About the project
Drones, sabotage and airspace incidents
Borderline is a register of security incidents in NATO countries and Moldova linked to Russia's war against Ukraine: 11 types of event, from airspace violations to sabotage, arson and cyberattacks with physical effects. This is not a list of Russian attacks. We record separately what happened, and who named a perpetrator on what basis.
The register holds 312 events from 24 February 2022 to 28 October 2026. Below: what it covers, what counts as one event, where the information comes from, how we assess responsibility and how precise the locations are.
Latest entries in the register
/ Bulgaria
Black Sea, Bulgarian EEZ, about 17 nautical miles east of Cape Kaliakra
On 28 October 2026, the Liberian-flagged container ship CONTSHIP JET, bound for Constanța, was attacked by maritime drones in Bulgaria’s exclusive economic zone. The defence ministry placed the first strike at about 12:00, some 17 nautical miles east of Cape Kaliakra. Naval surveillance and a French patrol aircraft observed the strikes; the ministry reported three hits. All 18 crew members had been rescued by 13:45. The devices’ origin and operator remain undetermined. The EEZ is not territorial waters. One entry covers the attack, rescue and the vessel’s subsequent fate. Exact coordinates are undetermined; the entry has no map point. On 29 October, BNR, citing the Varna regional administration and maritime authorities, confirmed that the ship had sunk. None of the 18 seafarers was injured. Navy commander Kiril Mihaylov said the drones’ origin was unknown. The attack is not attributed to Russia or Ukraine.
infrastructure disruption
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
2026-10-29: On 29 October, BNR, citing the Varna regional administration and maritime authorities, confirmed that the ship had sunk. None of the 18 seafarers was injured. Navy commander Kiril Mihaylov said the drones’ origin was unknown. The attack is not attributed to Russia or Ukraine.
No coordinates - this record has no point on the map.
/ Latvia
forest in Liepna parish, Alūksne municipality
On the morning of 24 October 2026, police confirmed the discovery of debris from a foreign UAV in a hard-to-reach forest in Liepna parish, Alūksne municipality. According to the National Armed Forces (NBS), it may have entered Latvia on 18 October. An explosion-like sound was reported then, and surveillance analysis indicated possible movement of an unidentified object. Searches on 18-19 October ended without sufficient information to confirm the incident. Following the debris discovery, criminal proceedings and an internal review of the military response were opened. NBS reported no civilian casualties or damage to civilian infrastructure. The model, origin, operator and payload remain undetermined. Defence Minister Raivis Melnis conditionally considers a Ukrainian drone damaged over Russia and gliding into Latvia. This hypothesis does not confirm Ukrainian origin, a shoot-down or Russian jamming. The entry date denotes discovery on 24 October; 18 October remains a possible flight or crash date. Identity with the drone that crashed near Pasvalys in Lithuania is not established. Exact coordinates are undetermined; the entry has no map point.
date found, not date of flight
object found
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Raivis Melnis, minister obrony Łotwy, cytowany przez Latvijas Radio / LSM / 2026-10-24: The minister conditionally considers a Ukrainian drone damaged over Russia and gliding into Latvia. Origin is not established; the statement does not confirm a shoot-down or the cause of loss of control.
No coordinates - this record has no point on the map.
/ Moldova
Chiștelnița, Telenești district; preceding flight over Moldova
On 23 October 2026, a UAV violated Moldovan airspace and crashed at Chiștelnița in Telenești district. The defence ministry reported detecting entry at 13:59 from the direction of Verhnia Slobidka in Ukraine towards Frunzeuca on the Transnistrian sector. Tracking was lost at 14:10 near Pepeni; after brief reacquisition, the aircraft disappeared at 14:12 near Meșeni. A resident subsequently reported finding a drone within 100 metres of a house. Police initially reported no casualties. The defence ministry links this flight to the discovery. Tracking times do not establish the precise crash time. One entry covers the flight, crash and subsequent disposal. The operator and intended destination remain undetermined; the device model alone does not establish Russian tasking or a deliberate attack on Moldova. Exact coordinates are undetermined; the entry has no map point. On 24 October, a joint defence/interior ministry team confirmed a jet-powered Geran-4. Police said a thermobaric warhead with fragmentation effect and a total mass of 52.4 kg was found about five metres from the aircraft. It was transported to a safe location and destroyed in a controlled operation. The disposal report does not establish an explosion when the drone crashed.
airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
2026-10-24: On 24 October, a joint defence/interior ministry team confirmed a jet-powered Geran-4. Police said a thermobaric warhead with fragmentation effect and a total mass of 52.4 kg was found about five metres from the aircraft. It was transported to a safe location and destroyed in a controlled operation. The disposal report does not establish an explosion when the drone crashed.
No coordinates - this record has no point on the map.
/ Poland
Lublin and Rzeszów-Jasionka airports
During the daytime on 20 October 2026, operations at Lublin and Rzeszów-Jasionka airports were suspended again during a Russian attack on Ukraine and military activity. Lublin24’s 10:49 report describes new restrictions after the morning resumption of operations. At 18:29, Polish Radio Rzeszów/IAR described suspension of operations at both airports, aircraft being directed west, and the end of military activity and return to normal conditions. The military observed no violation of Polish airspace. One entry covers both airports; precise start and end times, restriction durations and diverted flight counts are unknown. Publication, siren and RCB alert times do not establish closure times. The evening alert alone does not establish a further separate airport disruption. Exact coordinates are undetermined; the entry has no map point.
airport disruption
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
No coordinates - this record has no point on the map.
/ Poland
Lublin and Rzeszów-Jasionka airports
On the evening of 19 October 2026, PAŻP, quoted by RMF24, reported closure of the airspace over Rzeszów-Jasionka Airport for military aviation activity during a Russian attack on Ukraine. On the morning of 20 October, Lublin112 confirmed resumption of Lublin operations and reopening of the airspace over Rzeszów. The quoted DORSZ said no violation of Polish airspace had been observed. One entry covers the evening and overnight sequence of 19-20 October; continuous closure from evening to morning is not established. Rzeszów is recorded as an airspace closure, separately from suspension of Lublin operations. RCB alert cancellation, renewal and subsequent cancellation times are not airport operating times and do not establish two additional closures. Precise restriction periods and affected flight counts are unknown. A connection with the unidentified object sought near Lublin is not established. Exact coordinates are undetermined; the entry has no map point.
airport disruption
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
No coordinates - this record has no point on the map.
24 Feb 2022 - 28 October 2026
The beginning
From the first day of Russia's full-scale invasion of Ukraine to 28 October 2026 this register holds 312 events across 22 of the 33 countries under observation, that is the current NATO members and Moldova, in 11 types. It began with airspace: 206 entries are airspace incidents. Then came arson, sabotage of infrastructure and transport, provocations, cyberattacks and open actions by state forces. Types can overlap: one event may be both an airspace violation and an airport disruption, and still counts once. A court or a state body has attributed responsibility in 26 cases; 171 entries carry no assessment of responsibility in this register at all. Those are two different things and the register does not merge them.
February - March 2022
THE FIRST DAYS
On 24 February 2022, the day the invasion began, a Ukrainian Su-27 lost communications and strayed into Romanian airspace; Romanian F-16s escorted it down at Bacău. Two weeks later, on 10 March, a Soviet-era Tu-141 reconnaissance drone crossed Romania and Hungary and crashed in central Zagreb, damaging parked cars. Neither Kyiv nor Moscow claimed it. Croatia's defence minister said the governments knew who had launched it, but the information was classified. This chapter shows the 4 entries from February and March 2022. For the whole of 2022 the register holds 9.
On 15 November 2022 a missile struck a grain-drying facility at Przewodów, near the Ukrainian border, killing two Polish civilians. It is one of the fatal incidents in the register (2 of 312). The investigation concluded the missile was a Ukrainian 5V55 fired by an S-300 battery defending against a Russian barrage. A month later Polish radar lost an object that neither American F-15s nor Polish MiG-29s could identify; the wreck of a Russian Kh-55 was found in a forest near Bydgoszcz only on 27 April 2023.
Romania appears in 82 of the 312 records - more often than any other country. 79 of them fall after the start of 2023, when Russia began systematically striking Ukraine's Danube ports. Most happened in Tulcea County and the Danube delta, where the border is a river a few hundred metres wide. In September 2023 Bucharest first denied a violation, then conceded it: drone fragments lay near Plauru, directly opposite the port of Izmail under attack. 48 of Romania's incidents involved drones; 8 involved a shoot-down.
Moldova is not a NATO member. The register holds 62 Moldovan entries, 52 of them in 2026 alone; its airspace lies on the short route between the Black Sea and the Ukrainian and Romanian borders. The earliest Moldovan entry dates from 31 October 2022: a missile shot down by Ukrainian air defence fell on the edge of the village of Naslavcea on the Dniester and blew out windows in several houses. That is the earliest entry in this register, not a finding that nothing happened before it. In August 2026 an object initially described as an S8000 Banderol cruise missile exploded near the village of Crocmaz, blowing out windows within 800 metres; Chișinău recalled its ambassador from Moscow for consultations. 7 Moldovan entries are classed as missiles.
In the north - Lithuania, Latvia, Estonia and Finland - the register records 49 airspace entries, 30 of them in 2026. This chapter shows only those. Ground events in the same countries have chapters of their own: the January 2025 arson attacks in Estonia under "Arson", the cable damage in the Gulf of Finland under sabotage, the Russian border guards crossing over under actions by state forces. The pattern differs from the south: alongside drones from Belarus and Russia come smuggling balloons, and three entries concern Vilnius Airport, from October, November and December 2025. Add to that Russian military aircraft over the Gulf of Finland and along the Kaliningrad border. In May 2026 Lithuania declared its highest-level air alert: air and rail traffic stopped, and NATO fighters failed to intercept the drone.
After Przewodów, Poland returns to the register as the country with 48 entries and the widest range of methods. In August 2025 a drone, probably a Geran-2, flew more than 200 kilometres inland and exploded in a field at Osiny; for two and a half hours of flight air defence did not detect it. On the night of 9-10 September 2025 at least 21 drones were recorded, the airports at Warsaw, Modlin, Rzeszów and Lublin closed, and Poland invoked Article 4 of the Washington Treaty. November brought sabotage on the railway, December the compromise of control equipment in the power system, July 2026 a Kh-101 missile in a field near Tarnawa-Kolonia, August 2026 a fire at an arms plant. A court or a state body has attributed responsibility here in 7 cases; 21 entries carry no assessment of responsibility at all. A dense cluster of events is not evidence of a single campaign.
Since September 2025 the register records 17 events in Germany, the Netherlands, Belgium, Denmark, Norway, France and the United Kingdom. The pattern differs from the east: not debris in a field, but unidentified drones hovering over an air base or a runway. Copenhagen and Oslo in September, Karup and Ørland days later, Munich in October, Kleine Brogel and Volkel in November, Annaburg and the submarine base at l’Île Longue in December, Leipzig, Mechernich and Hanover through the summer of 2026. One entry is a find: in September 2026 police recovered parts of a crashed drone about 800 metres from Wunstorf air base, outside its perimeter. 5 of those entries ended in the closure of a civilian airport. No court or state body has attributed responsibility for any of them: a drone that can be neither tracked nor jammed leaves no evidence behind.
Six countries hold a handful of entries each and fit into none of the regional chapters: 28 events between them. The earliest and the furthest is one and the same: on 10 March 2022 an unmanned Tu-141 carrying explosives flew across Romania and Hungary and crashed in the centre of Zagreb. In Turkey the register holds 7 entries: a shoot-down over the Black Sea in December 2025 and three machines that came down in towns, at Samsun, Örhenli and Arsin. Sweden has 4 entries, two of them violations by Russian military aircraft over Gotland, before it joined NATO. In August 2026 a drone exploded in a field by the Bulgarian border crossing at Kardam, a hundred metres from the border and two hundred from a compressor station. In May 2026 an armed unmanned surface vessel was found in a sea cave on Lefkada; the Greek defence minister called it Ukrainian, and the services' report speaks of a navigation failure and drift. None of these entries has an attributed actor.
The register holds 30 arson entries. It began with two months in the spring of 2024: a warehouse in Leyton in east London, an OBI store on Warsaw's Radzymińska street, an IKEA in Vilnius and the Marywilska 44 hall in Warsaw all burned. Four places, four separate entries. The London case produced a verdict: the court found the attack was commissioned on behalf of the Wagner Group. The other three are covered by a Polish indictment alleging action on behalf of Russian intelligence. An allegation and a verdict are not the same thing, so the register keeps them in separate categories. The summer of 2024 added incendiary parcels at sorting hubs, January 2025 a Coop store at Osula and the Slava Ukraini restaurant in Tallinn, both of which ended in convictions, and August 2026 a fire at an arms plant in Skarżysko-Kamienna. A court or a state body has attributed 12 of them; 8 remain suspicions.
On the night of 16 November 2025, on the Warsaw-Lublin line, an explosive charge destroyed a section of rail near the village of Mika. Tens of kilometres away, near Gołąb, someone brought down the overhead line and bolted metal fittings to the track to derail a train. A service carrying 475 people passed through that second site. Nobody died. Two days later the prime minister told parliament that the direct perpetrators were two Ukrainian citizens cooperating with the Russian services. That is an official attribution, not a court verdict, and the statement set out no evidentiary basis.
Outside the airspace the register records 21 events whose target was an installation or a mood. In the summer of 2024 incendiary parcels caught fire at sorting hubs in Leipzig, outside Warsaw and in Birmingham. At Christmas 2024 a tanker dragged its anchor across the floor of the Gulf of Finland and damaged five cables, among them the EstLink 2 interconnector; a Finnish court held it had no jurisdiction in the case. In April 2025 somebody opened a valve at the Risavatnet dam in Norway remotely and held it open for just under four hours. In December 2025 control equipment between distributed generation and the control centres of the Polish power system was compromised. Two Paris provocations, red hands stencilled on the Wall of the Righteous and pig heads left at nine mosques, were meant to produce not a failure but a conflict; in the second case a Serbian court convicted three men and wrote into the verdicts who gave them their orders and their money. The chapter also includes reconnaissance and preparation. In October 2026, two men were arrested over alleged photography of the MyDefence facility in Denmark for Russian intelligence. This is a prosecution suspicion concerning reconnaissance, not established completed sabotage; the suspects deny guilt. On 23 October, police confirmed that both men had been released; charges remain and the investigation with PET continues.
A separate category covers events where there is no question who did it, because it was done by a uniformed officer under their own flag. There are 4 such entries, and a state body has officially attributed 4 of them. In May 2024 the Russian border guard removed the buoys with which Estonia had marked the border on the Narva river. In July 2025 a border guard vessel entered half a kilometre into Estonian territorial waters and stayed for more than half an hour. In December 2025 three border guards reached the breakwater at Vasknarva by hovercraft and crossed the border line on foot. In September 2026 a Russian frigate fired two flares towards a Danish helicopter over international waters. These are not operations built for deniability; they are gestures nobody hides.
On the night of 9/10 September 2025 at least 21 Russian drones entered Polish airspace; up to four were shot down, four airports closed, and Warsaw invoked Article 4 of the North Atlantic Treaty. Since that month the register records 240 of all 312 incidents. The year 2026 alone, up to the most recent entry of 28 October 2026, accounts for 193 entries across 17 countries. On 12 September 2026 a drone crossed Moldova and came down in a maize field near Botoșanița Mare, Romania. Two F-16s scrambled. Nobody was killed. The most recent entry in the register: 28 October 2026.
It is easy to look at this map and see a single campaign. The register does not allow that. Of 312 events, a court or a state body has attributed 26; 92 were examined and left unresolved; and 171 carry no assessment of responsibility in this register. Dates falling close together are not evidence of common tasking, and a drone sighting is not evidence of an attempted attack. Where there is no basis, the register says "not assessed". That means we have not assessed it here, not that nobody anywhere has looked.
Incident descriptions and sources
The register holds 312 events from 24 February 2022 to 28 October 2026. Below: what it covers, what counts as one event, where the information comes from, how we assess responsibility and how precise the locations are.
Borderline is a register of security incidents in NATO countries and Moldova linked to Russia's war against Ukraine: 11 types of event, from airspace violations to sabotage, arson and cyberattacks with physical effects. This is not a list of Russian attacks. We record separately what happened, and who named a perpetrator on what basis.
Read the full register with sources
/ Bulgaria
Black Sea, Bulgarian EEZ, about 17 nautical miles east of Cape Kaliakra
On 28 October 2026, the Liberian-flagged container ship CONTSHIP JET, bound for Constanța, was attacked by maritime drones in Bulgaria’s exclusive economic zone. The defence ministry placed the first strike at about 12:00, some 17 nautical miles east of Cape Kaliakra. Naval surveillance and a French patrol aircraft observed the strikes; the ministry reported three hits. All 18 crew members had been rescued by 13:45. The devices’ origin and operator remain undetermined. The EEZ is not territorial waters. One entry covers the attack, rescue and the vessel’s subsequent fate. Exact coordinates are undetermined; the entry has no map point. On 29 October, BNR, citing the Varna regional administration and maritime authorities, confirmed that the ship had sunk. None of the 18 seafarers was injured. Navy commander Kiril Mihaylov said the drones’ origin was unknown. The attack is not attributed to Russia or Ukraine.
infrastructure disruption
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
2026-10-29: On 29 October, BNR, citing the Varna regional administration and maritime authorities, confirmed that the ship had sunk. None of the 18 seafarers was injured. Navy commander Kiril Mihaylov said the drones’ origin was unknown. The attack is not attributed to Russia or Ukraine.
No coordinates - this record has no point on the map.
/ Latvia
forest in Liepna parish, Alūksne municipality
On the morning of 24 October 2026, police confirmed the discovery of debris from a foreign UAV in a hard-to-reach forest in Liepna parish, Alūksne municipality. According to the National Armed Forces (NBS), it may have entered Latvia on 18 October. An explosion-like sound was reported then, and surveillance analysis indicated possible movement of an unidentified object. Searches on 18-19 October ended without sufficient information to confirm the incident. Following the debris discovery, criminal proceedings and an internal review of the military response were opened. NBS reported no civilian casualties or damage to civilian infrastructure. The model, origin, operator and payload remain undetermined. Defence Minister Raivis Melnis conditionally considers a Ukrainian drone damaged over Russia and gliding into Latvia. This hypothesis does not confirm Ukrainian origin, a shoot-down or Russian jamming. The entry date denotes discovery on 24 October; 18 October remains a possible flight or crash date. Identity with the drone that crashed near Pasvalys in Lithuania is not established. Exact coordinates are undetermined; the entry has no map point.
date found, not date of flight
object found
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Raivis Melnis, minister obrony Łotwy, cytowany przez Latvijas Radio / LSM / 2026-10-24: The minister conditionally considers a Ukrainian drone damaged over Russia and gliding into Latvia. Origin is not established; the statement does not confirm a shoot-down or the cause of loss of control.
No coordinates - this record has no point on the map.
/ Moldova
Chiștelnița, Telenești district; preceding flight over Moldova
On 23 October 2026, a UAV violated Moldovan airspace and crashed at Chiștelnița in Telenești district. The defence ministry reported detecting entry at 13:59 from the direction of Verhnia Slobidka in Ukraine towards Frunzeuca on the Transnistrian sector. Tracking was lost at 14:10 near Pepeni; after brief reacquisition, the aircraft disappeared at 14:12 near Meșeni. A resident subsequently reported finding a drone within 100 metres of a house. Police initially reported no casualties. The defence ministry links this flight to the discovery. Tracking times do not establish the precise crash time. One entry covers the flight, crash and subsequent disposal. The operator and intended destination remain undetermined; the device model alone does not establish Russian tasking or a deliberate attack on Moldova. Exact coordinates are undetermined; the entry has no map point. On 24 October, a joint defence/interior ministry team confirmed a jet-powered Geran-4. Police said a thermobaric warhead with fragmentation effect and a total mass of 52.4 kg was found about five metres from the aircraft. It was transported to a safe location and destroyed in a controlled operation. The disposal report does not establish an explosion when the drone crashed.
airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
2026-10-24: On 24 October, a joint defence/interior ministry team confirmed a jet-powered Geran-4. Police said a thermobaric warhead with fragmentation effect and a total mass of 52.4 kg was found about five metres from the aircraft. It was transported to a safe location and destroyed in a controlled operation. The disposal report does not establish an explosion when the drone crashed.
No coordinates - this record has no point on the map.
/ Poland
Lublin and Rzeszów-Jasionka airports
During the daytime on 20 October 2026, operations at Lublin and Rzeszów-Jasionka airports were suspended again during a Russian attack on Ukraine and military activity. Lublin24’s 10:49 report describes new restrictions after the morning resumption of operations. At 18:29, Polish Radio Rzeszów/IAR described suspension of operations at both airports, aircraft being directed west, and the end of military activity and return to normal conditions. The military observed no violation of Polish airspace. One entry covers both airports; precise start and end times, restriction durations and diverted flight counts are unknown. Publication, siren and RCB alert times do not establish closure times. The evening alert alone does not establish a further separate airport disruption. Exact coordinates are undetermined; the entry has no map point.
airport disruption
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
No coordinates - this record has no point on the map.
/ Poland
Lublin and Rzeszów-Jasionka airports
On the evening of 19 October 2026, PAŻP, quoted by RMF24, reported closure of the airspace over Rzeszów-Jasionka Airport for military aviation activity during a Russian attack on Ukraine. On the morning of 20 October, Lublin112 confirmed resumption of Lublin operations and reopening of the airspace over Rzeszów. The quoted DORSZ said no violation of Polish airspace had been observed. One entry covers the evening and overnight sequence of 19-20 October; continuous closure from evening to morning is not established. Rzeszów is recorded as an airspace closure, separately from suspension of Lublin operations. RCB alert cancellation, renewal and subsequent cancellation times are not airport operating times and do not establish two additional closures. Precise restriction periods and affected flight counts are unknown. A connection with the unidentified object sought near Lublin is not established. Exact coordinates are undetermined; the entry has no map point.
airport disruption
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
No coordinates - this record has no point on the map.
/ Poland
Lublin and Rzeszów-Jasionka airports
On the morning of 19 October 2026, operations at Lublin and Rzeszów-Jasionka airports were suspended as a precaution during a Russian attack on Ukraine and military aviation activity. PAŻP, quoted by RMF24, subsequently confirmed that normal operations had resumed. This is one entry for both airports, distinct from restrictions on 18 October and the later evening sequence. The report does not confirm an incursion into Poland. The RCB alert around 07:00 and its cancellation around 08:40 do not establish airport restriction times. The precise interruption period and affected flight counts are unknown. A second alert around 13:00 does not itself establish another closure. Exact coordinates are undetermined; the entry has no map point.
airport disruption
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
No coordinates - this record has no point on the map.
/ Denmark
Nørresundby, MyDefence facility
On 19 October 2026, two men were arrested in a suspected espionage case. According to reports of the prosecution charges, they allegedly photographed the MyDefence facility in Nørresundby that day and sent the images to a Telegram user for Russian intelligence. The company makes counter-drone equipment also supplied to Ukraine. The initial police release confirmed the arrests, charges under section 108(1) and cooperation with PET; media reports at that stage named the company and alleged Russian recipient. The suspects deny guilt. In its accessible introduction to the report after the 20 October hearing, TV2 Nord said detention had been extended by three periods of 24 hours. This entry concerns alleged photographic reconnaissance, not completed sabotage, an established attack plan or a verdict. A Russian recipient remains a prosecution suspicion, grade C; neither a specific GRU unit nor the suspects’ nationality is established from the interpreter’s language. Exact coordinates are undetermined; the entry has no map point. At 17:35 on 23 October, Nordjyllands Politi confirmed that both men had been released. They remain charged, and the investigation with PET continues. Police assessed that there was insufficient basis to bring them before a judge again with a request for remand. The new release explicitly names MyDefence and the suspicion of assisting Russian intelligence by photographing the company and sending images to a Telegram user. Release does not mean acquittal, dismissal of charges or closure of the investigation. Russian tasking remains a grade C suspicion; completed sabotage is not established.
reconnaissance and preparation
suspected. Someone has named a perpetrator, but this is neither a court finding nor a formal attribution by a state.
Duńska prokuratura, zarzuty relacjonowane przez Ritzau/DK Nyt / 2026-10-20: Prosecutors suspect photography of MyDefence and transmission of the images for Russian intelligence. The suspects deny guilt; there is no verdict or identification of a specific unit.
Nordjyllands Politi, komunikat o utrzymaniu zarzutów / 2026-10-23: Police maintain the suspicion of assisting Russian intelligence through images of MyDefence sent to a Telegram user. Both men have been released; charges and the investigation remain.
2026-10-23: At 17:35 on 23 October, Nordjyllands Politi confirmed that both men had been released. They remain charged, and the investigation with PET continues. Police assessed that there was insufficient basis to bring them before a judge again with a request for remand. The new release explicitly names MyDefence and the suspicion of assisting Russian intelligence by photographing the company and sending images to a Telegram user. Release does not mean acquittal, dismissal of charges or closure of the investigation. Russian tasking remains a grade C suspicion; completed sabotage is not established.
No coordinates - this record has no point on the map.
/ Poland
Lublin and Rzeszów-Jasionka airports, morning restrictions
On the morning of 18 October 2026, operations at Lublin and Rzeszów-Jasionka airports were temporarily suspended in connection with military aviation activity. PANSA, quoted by Polish Radio/PAP/Reuters, confirmed that both airports subsequently resumed operations. One entry covers both airports. Precise times, duration and affected flight counts are undetermined. The restrictions do not prove a drone incursion into Poland, an airport strike or sabotage. The search for a possible object near Lublin remains a separate unresolved lead without a proven causal link to the restrictions. Exact coordinates are undetermined; the entry has no map point.
airport disruption
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
No coordinates - this record has no point on the map.
/ Lithuania
Vilnius, Aukštieji Paneriai, Delska Lithuania facility containing Starlink infrastructure, according to the prime minister
On 18 October 2026 around 02:00, an attempted arson at premises rented by SpaceX containing Starlink ground infrastructure in Vilnius was foiled. The prime minister described nine antennas and a control unit, and flammable liquids found at the site. According to the police chief, any damage was minimal and infrastructure operation was uninterrupted. Destruction of antennas and arrests of the perpetrators are not confirmed. The prime minister and NKVC head suspect Russian commissioning, but the investigation continues. This is not a final finding of Russian or a specific GRU unit’s involvement. The defence minister distinguished the case from the drone that crashed in Pasvalys district that day. Exact coordinates are undetermined; the entry has no map point. On 19 October, the prime minister named the Delska Lithuania facility in Aukštieji Paneriai, Vilnius, and described use of Molotov cocktails. He said a guard noticed the attempt, extinguished the fire and called the fire brigade. The antennas did not ignite and the control unit was lightly scorched. Actual minor property damage is therefore specified, while retaining the foiled-attempt status and the earlier account of uninterrupted infrastructure operation. Suspects had not yet been identified in this statement. Calling the act sabotage does not conclude the investigation into its commissioner; Russian commissioning remains grade C suspicion.
arson
suspected. Someone has named a perpetrator, but this is neither a court finding nor a formal attribution by a state.
Premier Litwy Mindaugas Sinkevičius i szef NKVC Vilmantas Vitkauskas, cytowani przez LRT/BNS / 2026-10-18: Authorities link the arson attempt to Russian hybrid activity and suspect Russian commissioning. Details and perpetrators remain under investigation; this is not a final court finding or identification of a specific intelligence unit.
2026-10-19: On 19 October, the prime minister named the Delska Lithuania facility in Aukštieji Paneriai, Vilnius, and described use of Molotov cocktails. He said a guard noticed the attempt, extinguished the fire and called the fire brigade. The antennas did not ignite and the control unit was lightly scorched. Actual minor property damage is therefore specified, while retaining the foiled-attempt status and the earlier account of uninterrupted infrastructure operation. Suspects had not yet been identified in this statement. Calling the act sabotage does not conclude the investigation into its commissioner; Russian commissioning remains grade C suspicion.
No coordinates - this record has no point on the map.
/ Lithuania
Juodžionys, Pasvalys district; temporary closure of Kaunas Airport
On the morning of 18 October 2026, a drone crashed and exploded near Juodžionys in Pasvalys district. According to NKVC, debris damaged a passing car and its driver was unhurt. Scrambled NATO aircraft did not shoot the drone down: clouds prevented visual identification. Kaunas Airport was temporarily closed; precise times and affected flight counts are not verified. That evening, Defence Minister Robertas Kaunas preliminarily identified a Ukrainian drone connected with an attack on Saint Petersburg, saying Russian electronic warfare had caused it to deviate. Computer components were still being sought. This is the minister’s preliminary assessment, not a final technical report or proof of a deliberate attack on Lithuania. The minister distinguished the case from the attempted Starlink arson in Vilnius. Identity with the object sought near Lublin and an incursion into Latvia are not established. Exact coordinates are undetermined; the entry has no map point. On 19 October, Lithuania’s prime minister said debris and information from Ukraine confirmed the drone’s Ukrainian origin and that it carried explosives. According to Lithuania’s chronology, it was tracked in Poland from 05:47 and crossed the Lithuanian border at 06:02. This is Lithuania’s position, not a final jointly established flight path. On 20 October, Nausėda announced a joint Polish-Lithuanian defence-ministry group; final conclusions had not been presented. DORSZ continued analysing data and requested explanations from Ukraine without a final confirmation of entry into Poland. Poland’s defence ministry denied an unofficial account of a launch from Lithuania; that denial alone does not confirm the entire route. No Polish incident or route has been added. Operator identification remains a grade C assessment, the detailed FPV-1/FP-1 model is unresolved, and Russian jamming is not a published final forensic finding.
airspace incident, airport disruption
suspected. Someone has named a perpetrator, but this is neither a court finding nor a formal attribution by a state.
Minister obrony Litwy Robertas Kaunas, wypowiedź w LRT / 2026-10-18: The minister preliminarily identifies a Ukrainian drone linked to an attack on Saint Petersburg and attributes its deviation to Russian jamming. Examination continues; this does not establish a deliberate attack on Lithuania.
Premier Litwy Mindaugas Sinkevičius, cytowany przez Delfi/ELTA / 2026-10-19: The prime minister identifies Ukrainian origin from debris and information from Ukraine, and an explosive payload. This is not a final joint examination establishing operator or the full route.
2026-10-20: On 19 October, Lithuania’s prime minister said debris and information from Ukraine confirmed the drone’s Ukrainian origin and that it carried explosives. According to Lithuania’s chronology, it was tracked in Poland from 05:47 and crossed the Lithuanian border at 06:02. This is Lithuania’s position, not a final jointly established flight path. On 20 October, Nausėda announced a joint Polish-Lithuanian defence-ministry group; final conclusions had not been presented. DORSZ continued analysing data and requested explanations from Ukraine without a final confirmation of entry into Poland. Poland’s defence ministry denied an unofficial account of a launch from Lithuania; that denial alone does not confirm the entire route. No Polish incident or route has been added. Operator identification remains a grade C assessment, the detailed FPV-1/FP-1 model is unresolved, and Russian jamming is not a published final forensic finding.
No coordinates - this record has no point on the map.
/ Romania
southeast and east of Sulina, Romanian territorial sea
On 17 October 2026, two Romanian F-16s from Borcea took off at 17:43 and shot down two jet-powered Geran-family attack drones over Romania’s territorial sea, in national airspace. The first was shot down at 18:01 southeast of Sulina after two minutes in Romanian airspace, the second at 18:05 east of Sulina after five minutes. One entry covers this sequence and its two devices. The statement does not establish the specific Geran-4 variant or operator. These were actual Romanian shootdowns, not an earlier shootdown over Ukraine. The four earlier incursions mentioned in the statement are not additional events that day. Exact coordinates are undetermined; the entry has no map point.
airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
No coordinates - this record has no point on the map.
/ Poland
Lublin and Rzeszów-Jasionka airports, morning restrictions
On the morning of 16 October 2026, operations at Lublin were preventively suspended and traffic at Rzeszów-Jasionka restricted during a Russian attack on Ukraine and NATO aviation activity. Radio Lublin, quoting PANSA, reported in its 10:04 update that both airports had resumed operations. The update time is not the precise resumption time. The start, duration and number of affected flights are undetermined. One entry covers both airports. No Polish airspace violation, airport strike or sabotage is confirmed. RCB alerts alone do not create additional incidents. Exact coordinates are undetermined; the entry has no map point.
airport disruption
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
No coordinates - this record has no point on the map.
/ Moldova
Sobari; field outside Codrenii Noi towards Scăieni, Dondușeni district
On 16 October 2026, Moldova’s defence ministry reported a suspected unauthorised flight at 16:22 near Sobari in Soroca district. Its 17:04 update confirmed that a drone had fallen and exploded in a field outside Codrenii Noi towards Scăieni in Dondușeni district. Police quoted by ProTV on 17 October described a crater, combustion engine, tank and scattered fragments. This is one afternoon flight-and-crash sequence, distinct from the recorded morning incursions of 16 October. The model and operator are undetermined; identity with an earlier flight through Otaci is not established. Place names do not establish a confirmed route. Exact coordinates are undetermined; the entry has no map point.
airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Moldova’s defence ministry confirmed an airspace violation on 2026-10-16 at 06:09-06:10 local time. Re-entry through Purcari, exit through Dnestrovsc in the Transnistrian sector towards Gradenițî in Ukraine. According to the ministry, this is the same UAV as in the 05:59-06:00 incursion, not another unique device. The object’s model and operator are undetermined. Exact coordinates are undetermined; the entry has no map point.
airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Moldova’s defence ministry confirmed an airspace violation on 2026-10-16 at 05:59-06:00 local time. Entry from Starocazacie in Ukraine through Căplani, exit through Olănești. According to the ministry, the same UAV re-entered at 06:09; the two entries describe separate incursions, not two different devices. The object’s model and operator are undetermined. Exact coordinates are undetermined; the entry has no map point.
airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
No coordinates - this record has no point on the map.
/ Moldova
Otaci - Hădărăuți, Moldovan airspace, 03:46-03:48
Moldova’s defence ministry confirmed an airspace violation on 2026-10-16 at 03:46-03:48 local time. Entry from Mohyliv-Podilskyi in Ukraine through Otaci, exit through the Hădărăuți area in Ocnița. The object’s model and operator are undetermined. Exact coordinates are undetermined; the entry has no map point.
airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
No coordinates - this record has no point on the map.
/ Moldova
Tudora, Moldovan airspace, 03:37-03:38
Moldova’s defence ministry confirmed an airspace violation on 2026-10-16 at 03:37-03:38 local time. Entry from Starocazacie in Ukraine through Tudora, return along the same path. The object’s model and operator are undetermined. Exact coordinates are undetermined; the entry has no map point.
airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
No coordinates - this record has no point on the map.
/ Romania
southeast of Sulina, over Romanian territorial waters
On 15 October 2026 at 01:34, Romanian radar detected a drone for about one minute in national airspace over territorial waters southeast of Sulina. The drone then disappeared from radar. Spanish F-18s were scrambled. Later detections of other targets and an F-16 scramble do not establish further incursions. A crash or shootdown is not confirmed. The model and operator are undetermined. Exact coordinates are undetermined; the entry has no map point.
airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
No coordinates - this record has no point on the map.
/ Romania
Wine Trader, about 13 nautical miles southeast of Sulina, outside Romania’s territorial sea
On 15 October 2026 around 07:00, the San Marino-flagged tanker Wine Trader requested help following a superstructure fire. The vessel carried no cargo and had 12 people aboard. According to ANR, five people were rescued and taken to hospital while seven remained missing. The defence minister describes a drone attack, and a SHAPE spokesperson places the vessel just outside Romania’s territorial sea. The sources read do not formally establish an EEZ; the country assignment reflects the Romanian rescue context. On 16 October, IGSU resumed the search, including operations aboard. Sinking, a final death toll and an injury count are not confirmed; hospitalisation does not establish injuries in all five people. The exact strike time, drone model and operator are undetermined. Exact coordinates are undetermined; the entry has no map point. On 19 October, Adrian Mihălcioiu, leader of Sindicatul Liber al Navigatorilor, said seven crew members remained missing: a Croatian citizen and six citizens of Benin; five had been rescued. He described searches of accessible compartments aboard the damaged ship and contact with relatives. This is the position according to a named union source, without confirmation of seven deaths, sinking or an injury toll. Mihălcioiu attributes the attack to Russian Geran drones around 04:00, but this is not a state finding or independent forensic examination of debris. The model and operator remain undetermined. That time does not replace the previously reported alarm around 07:00; it may concern a different stage. The date of 15 October and undetermined EEZ jurisdiction are retained.
infrastructure disruption
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Adrian Mihălcioiu, przewodniczący SLN, cytowany przez CTnews / 2026-10-19: The union leader claims Russian Geran drones attacked the ship around 04:00. This is a non-state claim without independent forensic findings establishing model and operator.
2026-10-16: On 16 October, IGSU resumed the search for missing people using a Black Hawk helicopter and the vessel Fifi. No final toll is established.
2026-10-19: On 19 October, Adrian Mihălcioiu, leader of Sindicatul Liber al Navigatorilor, said seven crew members remained missing: a Croatian citizen and six citizens of Benin; five had been rescued. He described searches of accessible compartments aboard the damaged ship and contact with relatives. This is the position according to a named union source, without confirmation of seven deaths, sinking or an injury toll. Mihălcioiu attributes the attack to Russian Geran drones around 04:00, but this is not a state finding or independent forensic examination of debris. The model and operator remain undetermined. That time does not replace the previously reported alarm around 07:00; it may concern a different stage. The date of 15 October and undetermined EEZ jurisdiction are retained.
No coordinates - this record has no point on the map.
/ Moldova
Ivanovca, Moldovan airspace, 23:02-23:20
Moldova’s defence ministry confirmed an airspace violation on 2026-10-15 at 23:02-23:20 local time. Entry from Timcovo in Odesa region through Ivanovca, exit towards Ukraine in the Bronit/Mohyliv-Podilskyi area. This occurred on the evening of 15 October, although the statement was published on 16 October. The object’s model and operator are undetermined. Exact coordinates are undetermined; the entry has no map point.
airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
No coordinates - this record has no point on the map.
/ Moldova
Purcari, Moldovan airspace, 01:43-01:51
Moldova’s defence ministry confirmed an airspace violation on 2026-10-15 at 01:43-01:51 local time. Entry from Grădinița in Ukraine through Purcari, exit towards Starokazacie in Ukraine. The object’s model and operator are undetermined. Exact coordinates are undetermined; the entry has no map point.
airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
No coordinates - this record has no point on the map.
/ Romania
Romanian airspace over the Black Sea, evening sequence
On 14 October 2026 at 20:04, two aerial targets entered Romanian airspace. Contact with one was lost over the sea. The other left at 20:13 towards Vâlcove in Ukraine, then flew towards Reni, where Ukrainian air defences destroyed it. Spanish F-18s were scrambled. One entry covers the two targets in this sequence. Their type and operator are undetermined. A crash of the first target or a link to the Yara J fire is not confirmed. A shootdown over Ukraine is not a Romanian shootdown. Exact coordinates are undetermined; the entry has no map point.
airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
No coordinates - this record has no point on the map.
/ Romania
about 22 km northeast of Sulina, Romanian territorial waters
On 14 October 2026, an aerial target entered airspace over Romanian territorial waters at 17:38 and left at 17:46. Two F-16s from Borcea were scrambled. The defence ministry describes a separate afternoon sequence, distinct from the morning incursion recorded that day. The target’s type, model and operator are undetermined. Coordinates were not calculated from the reported distance. Exact coordinates are undetermined; the entry has no map point.
airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
No coordinates - this record has no point on the map.
/ Romania
Yara J, about 8 nautical miles east of Sulina, Romanian territorial sea
On the evening of 14 October 2026, an explosion and fire affected the superstructure of the Comoros-flagged tanker Yara J. According to ProTV, the captain requested help around 20:20. The crew extinguished the fire and the vessel headed towards Constanța. There were 17 people aboard; ProTV reports no injuries. The defence minister confirms an explosion aboard the vessel in Romania’s territorial sea. A SHAPE spokesperson includes it among vessels targeted in attacks. The device type, operator and precise attack sequence are undetermined. The event has not been identified with any of the targets tracked by Romanian radar that evening. Exact coordinates are undetermined; the entry has no map point.
infrastructure disruption
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
No coordinates - this record has no point on the map.
/ Romania
Romanian airspace over the Black Sea, east of Sulina
On 14 October 2026, Romania’s defence ministry confirmed in statement no. 329 that an aerial target briefly entered Romanian airspace east of Sulina, over the Black Sea. The target then entered Ukrainian airspace, where Ukrainian air defences shot it down. Two Romanian F-16s from the 86th Borcea Air Base were scrambled. RO-Alert was sent at 10:19 and the alert ended at 11:22; these are not established flight start and end times. The statement does not identify the target’s type, model or operator. It does not confirm a shootdown or crash in Romania. One entry covers the confirmed incursion, without additional incidents inferred from earlier alerts that day. Exact coordinates are undetermined; the entry has no map point.
airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
No coordinates - this record has no point on the map.
/ Bulgaria
Black Sea, Bulgaria’s EEZ, about 17 nautical miles east of Shabla; HS Dignity
On 13 October 2026, HS Dignity, flying Guinea-Bissau’s flag, was struck and sank in Bulgaria’s exclusive economic zone. The transport ministry gave a time of about 01:20 local and a location 17 nautical miles east of Shabla. On 13 October, BTA quoted the ministry as saying Azov Concord and SCANDI ASSERTER helped five survivors. A sailors’ union account quoted by Anadolu reports 16 people aboard and 11 missing. Missing people are not confirmed fatalities. The prime minister’s aggregate statement on 14 October referred to four survivors from one of the sunken ships; the final toll remains unresolved. Azov Concord helped in the rescue, rather than being an alternative name for the sunken HS Dignity. The minister described a surface attack, while the sailors’ union described an aerial drone and two surface drones; the types, models and exact device count remain undetermined. On 13 October, Bulgarian Defence Minister Dimitar Stoyanov said the devices were not clearly identified but he suspected the Russian side. This is an officially expressed suspicion concerning the series, not an established investigation finding. The EEZ is not Bulgaria’s territorial sea. Exact coordinates are undetermined; the entry has no map point.
infrastructure disruption
suspected. Someone has named a perpetrator, but this is neither a court finding nor a formal attribution by a state.
Minister obrony Bułgarii Dimityr Stojanow, wypowiedź przytoczona przez BNT / 2026-10-13: On 13 October, Bulgarian Defence Minister Dimitar Stoyanov said the devices were not clearly identified but he suspected the Russian side. This is an officially expressed suspicion concerning the series, not an established investigation finding.
No coordinates - this record has no point on the map.
/ Bulgaria
Black Sea, Bulgaria’s EEZ, about 17 nautical miles east of Byala; Chelsea-3
Early on 13 October 2026, Chelsea-3, flying Malta’s flag, was attacked in Bulgaria’s exclusive economic zone. According to the transport ministry, the attack took place around 01:15 local time, about 17 nautical miles east of Byala. All 15 crew members were rescued; the damaged vessel anchored. Its sinking is not confirmed. Reports of crew injuries differ; a final injury toll is undetermined. The prime minister’s early account described three aerial drones, while other reports suggest surface devices; the type, model and exact count remain unresolved. On 13 October, Bulgarian Defence Minister Dimitar Stoyanov said the devices were not clearly identified but he suspected the Russian side. This is an officially expressed suspicion concerning the series, not an established investigation finding. Bulgaria’s EEZ lies outside its territorial sea. Exact coordinates are undetermined; the entry has no map point. According to Maritime.bg, quoting the transport ministry on 16 October, securing and towing operations were still in progress. The anchor stabilised Chelsea-3; bad weather suspended operations on 15 October and Chelsea 2 was due to join on 16 October. Completed towing or arrival in port is not confirmed. This is the vessel’s subsequent fate, not a new attack. Its later drift position is not the site of the 13 October attack. Chelsea-3 arrived at Burgas on 17 October after towing whose main phase began on 16 October at 20:25. Inspections began; divers’ work was also reported on 18 October. The military prosecutor initiated pre-trial proceedings on 16 October. Transport Minister Georgi Peev said on 17 October that the attack most likely came from Russia but that this must be proved. This remains official suspicion, not a completed finding. Three visible hull breaches do not establish three drones or their model. Arrival and inspections concern the vessel’s fate after the 13 October attack, not a new attack. On 20 October, Bulgaria’s prime minister reported drone debris found aboard Chelsea-3 and chemical analyses of explosive material. He announced that experts from allied countries were expected on 21 October; their arrival and results are not yet confirmed. The defence minister referred questions to the military prosecutor. The device type, model, exact count and operator remain undetermined. Grade C suspicion and the attack date of 13 October are retained; inspections do not create a new incident.
infrastructure disruption
suspected. Someone has named a perpetrator, but this is neither a court finding nor a formal attribution by a state.
Minister obrony Bułgarii Dimityr Stojanow, wypowiedź przytoczona przez BNT / 2026-10-13: On 13 October, Bulgarian Defence Minister Dimitar Stoyanov said the devices were not clearly identified but he suspected the Russian side. This is an officially expressed suspicion concerning the series, not an established investigation finding.
Minister transportu Bułgarii Georgi Peev, cytowany przez BTA / 2026-10-17: The minister considers Russian responsibility most likely but stresses that it must be proved.
2026-10-14: On 14 October the prime minister said two of the four vessels attacked in the past week remained afloat and their crews had been rescued. The account does not confirm that Chelsea-3 sank.
2026-10-16: According to Maritime.bg, quoting the transport ministry on 16 October, securing and towing operations were still in progress. The anchor stabilised Chelsea-3; bad weather suspended operations on 15 October and Chelsea 2 was due to join on 16 October. Completed towing or arrival in port is not confirmed. This is the vessel’s subsequent fate, not a new attack. Its later drift position is not the site of the 13 October attack.
2026-10-18: Chelsea-3 arrived at Burgas on 17 October after towing whose main phase began on 16 October at 20:25. Inspections began; divers’ work was also reported on 18 October. The military prosecutor initiated pre-trial proceedings on 16 October. Transport Minister Georgi Peev said on 17 October that the attack most likely came from Russia but that this must be proved. This remains official suspicion, not a completed finding. Three visible hull breaches do not establish three drones or their model. Arrival and inspections concern the vessel’s fate after the 13 October attack, not a new attack.
2026-10-20: On 20 October, Bulgaria’s prime minister reported drone debris found aboard Chelsea-3 and chemical analyses of explosive material. He announced that experts from allied countries were expected on 21 October; their arrival and results are not yet confirmed. The defence minister referred questions to the military prosecutor. The device type, model, exact count and operator remain undetermined. Grade C suspicion and the attack date of 13 October are retained; inspections do not create a new incident.
No coordinates - this record has no point on the map.
/ Moldova
near Geamăna, Anenii Noi district; reports also outside Văratic
On 11 October 2026, Moldova’s defence ministry reported that IGSU had found an object near Geamăna. During the night of 10-11 October, a drone-like sound followed by an explosion was heard outside Geamăna and Văratic. Police technical and bomb-disposal personnel and the military were sent to the site. On the afternoon of 11 October, IGP, according to the complete MOLDPRES and IPN reports, confirmed a drone with a warhead that police made safe. The device struck a tree at a height of about 13 metres, about 100 metres from the road; fragments were found on the ground. Expert examinations continue. The model, origin and operator remain unknown. No casualties were reported, which is not an established final toll. The ministry stated that national and supporting surveillance systems had detected no unauthorised flight at that time. The drone discovery and disposal of its warhead are confirmed; the operator and flight path are not established. Lack of radar detection does not negate the discovery. One entry covers this sequence, without separate records for both villages and a presumed flight. The date denotes discovery, not an established time of the earlier flight or explosion. Exact coordinates have not been established; the entry has no map point. The ministry’s 16 October summary dates the discovery of debris near Geamăna to 10 October, whereas its detailed 11 October statement indicated discovery on 11 October. The sources conflict. The existing discovery date of 11 October is retained pending clarification. This is not a new discovery or evidence of another flight; the model and operator remain undetermined.
date found, not date of flight
object found
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
2026-10-11: On the afternoon of 11 October, IGP, according to the complete MOLDPRES and IPN reports, confirmed a drone with a warhead that police made safe. The device struck a tree at a height of about 13 metres, about 100 metres from the road; fragments were found on the ground. Expert examinations continue. The model, origin and operator remain unknown. No casualties were reported, which is not an established final toll.
2026-10-16: The ministry’s 16 October summary dates the discovery of debris near Geamăna to 10 October, whereas its detailed 11 October statement indicated discovery on 11 October. The sources conflict. The existing discovery date of 11 October is retained pending clarification. This is not a new discovery or evidence of another flight; the model and operator remain undetermined.
No coordinates - this record has no point on the map.
/ Netherlands
Rotterdam-Delfshaven, railway bridge infrastructure near Schuttevaerweg
On 10 October 2026, railway bridge infrastructure in Delfshaven was deliberately set on fire. ProRail recorded a failure at about 02:30; its contractor found smouldering cables and a cut-open technical-room door. Police report finding the fire shortly before 04:00. These are different stages, not an established time of arson. Thirty-five cables were damaged; according to NOS, 15 burned through completely. Police confirm no injuries. Trains between Rotterdam Centraal and Delft Campus were suspended. The earlier forecast put resumption no earlier than 23:00 on 11 October, possibly delayed until the morning of 12 October. On 11 October, ProRail announced completion of repairs and clearance for traffic from 21:00. Its 12 October update confirms resumption; Treinreiziger reports trains restarting on the evening of 11 October after approximately 21:00 and return to the timetable. The exact actual resumption time, suspension start and duration remain undetermined. The perpetrator and motive remain unknown; investigation of possible sabotage does not establish Russian or other state tasking. Exact coordinates have not been established; the entry has no map point.
arson, infrastructure disruption
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
2026-10-11: On 11 October, ProRail announced completion of repairs and clearance for traffic from 21:00. Its 12 October update confirms resumption; Treinreiziger reports trains restarting on the evening of 11 October after approximately 21:00 and return to the timetable. The exact actual resumption time, suspension start and duration remain undetermined.
No coordinates - this record has no point on the map.
/ Bulgaria
Plana teleport near Sofia, according to charges reported by BTA
According to charges presented in court and reported by BTA on 19 October 2026, the arson at Starlink ground infrastructure in the Plana teleport near Sofia occurred on 9 October around 22:25. The day-level date and refined location derive from those charges; the entry’s existing identifier is retained. Earlier sources disclosed the case on 12 October and gave conflicting dates and figures of 11 of 17 or 18 antennas. Those figures are not adopted as the current damage total. On 14 October the prime minister confirmed an investigation, and on 15 October an interior-ministry official confirmed suspects without details. Historical reports and updates are retained; the subsequent findings are described below. The perpetrator and any state commissioning party remain undetermined. Exact coordinates are undetermined; the entry has no map point. On 19 October, a Sofia court approved European Arrest Warrants for two German citizens charged in absentia on 14 October. According to the charges, three antennas burned completely, two partially, and three were affected by fire: eight to varying degrees, not 11 completely destroyed. The suspects were wanted and their current whereabouts unknown; two arrests on 15 October are not confirmed. The defence contests identification of the perpetrators. The court accepted reasonable suspicion at this stage, not guilt; the decision could be appealed within three days. The court-reported evidence of the arson itself supports confirmed status for the physical event, separately from the unidentified perpetrator. Neither the warrants nor German citizenship establish Russian commissioning; attribution remains unknown. On 26 October, BNR reported that two 19-year-old German citizens had been arrested in Duisburg on Friday, 23 October, and appeared before a court on 26 October. These are later arrests, not confirmation of earlier reports of arrests on 15 October. Completed surrender to Bulgaria and conviction are not confirmed. Arresting suspects does not establish guilt or Russian tasking; attribution remains unknown.
arson
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
2026-10-14: The prime minister confirmed an investigation and cooperation with partner services without disclosing details. The interior minister announced additional protection for similar sites. State responsibility was not publicly established.
2026-10-15: On 15 October, Interior Ministry official Lyubomir Nikolov confirmed, according to BTA, that there were suspects in the arson case. He gave no details. This updates the investigation without officially confirming two German detainees, the precise incident date or state responsibility. Occurrence status remains reported.
2026-10-19: On 19 October, a Sofia court approved European Arrest Warrants for two German citizens charged in absentia on 14 October. According to the charges, three antennas burned completely, two partially, and three were affected by fire: eight to varying degrees, not 11 completely destroyed. The suspects were wanted and their current whereabouts unknown; two arrests on 15 October are not confirmed. The defence contests identification of the perpetrators. The court accepted reasonable suspicion at this stage, not guilt; the decision could be appealed within three days. The court-reported evidence of the arson itself supports confirmed status for the physical event, separately from the unidentified perpetrator. Neither the warrants nor German citizenship establish Russian commissioning; attribution remains unknown.
2026-10-26: On 26 October, BNR reported that two 19-year-old German citizens had been arrested in Duisburg on Friday, 23 October, and appeared before a court on 26 October. These are later arrests, not confirmation of earlier reports of arrests on 15 October. Completed surrender to Bulgaria and conviction are not confirmed. Arresting suspects does not establish guilt or Russian tasking; attribution remains unknown.
No coordinates - this record has no point on the map.
/ Germany
Frankfurt-Dornbusch, aid warehouse on the Viktor-Frankl-Schule site on Fritz-Tarnow-Straße
Early on 9 October 2026, a fire destroyed Frankfurt for Ukraine donations stored in a warehouse on the Viktor-Frankl-Schule site. On 10 October police said traces indicated deliberate ignition by unknown perpetrators. State-security investigators joined because of the aid for Ukraine. The fire is confirmed; arson is a preliminary police finding, not a completed investigation or proof of Russian involvement. HR reported no injuries. The exact time, loss value, perpetrators and commissioning party remain unknown. Conflicting times in secondary reports do not establish a precise time. Exact coordinates have not been established; the entry has no map point.
arson
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
No coordinates - this record has no point on the map.
/ Bulgaria
Black Sea, about 15 miles east of Sinemorets; jurisdiction undetermined
Around noon on 9 October 2026, floating aerial-UAV fragments were observed about 15 miles east of Sinemorets. Minehunter Struma was dispatched; after examination, divers from Dimitar Dobrev recommended destruction in place because of concerns about explosives. The navy confirmed a controlled detonation. The model, number of original devices, origin, earlier flight date and operator remain unknown. Concern about explosives is not a final identification of a payload. This is discovery and disposal of fragments, not interception of a flying drone or a new attack. The statement does not establish jurisdiction; direction and distance do not provide a verified point. This is not combined with the separately reported recovery of a Kh-31P rocket motor at an undetermined location. Exact coordinates have not been established; the entry has no map point.
date found, not date of flight
object found
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
No coordinates - this record has no point on the map.
/ Poland
Lublin and Rzeszów-Jasionka airports, morning restrictions
On the morning of 7 October 2026, civilian operations were restricted over Lublin and Rzeszów-Jasionka airports during a Russian attack on Ukraine and preventive military aviation activity. Spotted Lublin reports a NOTAM with restrictions scheduled to end at 07:00. The archived NOTAM was not read and the actual start, resumption, duration and number of affected flights remain undetermined. This is one entry for two airports, without a confirmed Polish airspace violation, airport strike or sabotage. It does not include that day’s afternoon suspension: an Operational Command spokesperson told Polish Radio that it resulted from exercises unrelated to the Russian attack. Exact coordinates have not been established; the entry has no map point.
airport disruption
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
No coordinates - this record has no point on the map.
/ Moldova
Pervomaisc area; exit towards Limanske
On 7 October 2026, Moldova’s defence ministry confirmed an unauthorised aerial-object flight. It entered national airspace in the Pervomaisc area at 20:04 and left at 20:05 local time towards Limanske in Ukraine. Type, model and operator are undetermined; no crash or damage information was given. This is the evening flight, separate from that day’s morning event. The places describe directions, not a fully verified trajectory. The two entries do not resolve the devices’ identity. Exact coordinates have not been established; the entry has no map point.
airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
No coordinates - this record has no point on the map.
/ Moldova
Moldova, entry location undetermined; exit towards Limanske
On 7 October 2026, Moldova’s defence ministry confirmed an unauthorised aerial-object flight from 08:43 to 08:44 local time. The object left airspace towards Limanske in Ukraine. The statement gives no entry location, type, model or operator. Limanske describes the exit direction on the Ukrainian side, not a crash site. This is the morning flight, separate from that day’s evening event. No crash or damage information was given. Exact coordinates have not been established; the entry has no map point.
airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
No coordinates - this record has no point on the map.
/ United Kingdom
RAF Molesworth, Cambridgeshire
During the night of 7-8 October 2026, two men were found inside RAF Molesworth and a breach in its fence was identified. At about 22:00 on 7 October a patrol found an abandoned vehicle; arrests followed early on 8 October. The precise entry time is unknown. Two UK-resident Latvian nationals aged 32 and 36 were initially arrested in connection with trespass and criminal damage, then on suspicion of a Section 4 National Security Act offence. Two addresses near Peterborough were searched; on 9 October the suspects were released on bail with strict conditions. Investigators continue to examine the motive, including possible ordinary criminal activity. Espionage, Russian tasking and a connection to the war are not established; nationality is not attribution. Police found no link to the earlier RAF Fairford case. This conditionally included entry concerns the intrusion and fence damage, not an established attack plot. Exact coordinates have not been established; the entry has no map point.
period
provocation or vandalism
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
2026-10-09: Two suspects were released on bail with strict conditions; the motive remains under investigation.
No coordinates - this record has no point on the map.
/ Germany
Nuremberg area; exact intended target undisclosed
On 7 October 2026, two Belarusian suspects entered pretrial detention over an alleged arson plot in the Nuremberg area. This dates the confirmed judicial intervention, not the intended attack. The case was disclosed on 28 October. According to the prosecutor quoted by BR and Reuters, the suspects allegedly agreed before 30 September to burn a building or critical infrastructure for payment on behalf of a foreign government or organisation. The precise target has not been officially disclosed. This entry concerns disrupted preparations, not completed arson. German prosecutors did not identify the commissioning country; media attribution to Russia remains unconfirmed by that office. The suspects are also subject to the Romanian Carfil investigation, which does not by itself establish the sponsor of the German plot. Exact coordinates are undetermined; the entry has no map point.
arson, reconnaissance and preparation
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Generalstaatsanwaltschaft München, odpowiedzi BR i Reuters / 2026-10-28: Prosecutors suspect tasking by a foreign government or organisation, without naming a country. SRI attribution for Carfil is not transferred to this plot.
No coordinates - this record has no point on the map.
/ Bulgaria
Black Sea, Bulgaria’s EEZ, about 70 nautical miles east of Byala; Able
At about 03:00 local time on 6 October 2026, the Palau-flagged Able was attacked in Bulgaria’s exclusive economic zone. The ship was damaged and caught fire. All 18 crew members were rescued; two were hospitalised with burns and a head injury. On the morning of 7 October the vessel was still burning, its engine room was flooded and the Maritime Administration expected it to sink. The source does not confirm that it had sunk. Bulgaria’s prime minister confirmed a series of sea and aerial drone attacks on two ships without naming the operator. AP reports that Ukraine’s president attributed the series to Russia; Bulgarian authorities were still investigating the devices’ origin. The type, model and number of devices striking this vessel are undetermined. This is a separate entry for this ship, without an additional series aggregate. The EEZ is outside Bulgaria’s territorial sea. Exact coordinates have not been established; the entry has no map point. Inspection on 9 October confirmed that Able remained afloat, with severe fire damage and a partially flooded engine room; it carried wheat. The defence minister said the position of the damage suggested a surface drone. No drone remains were found; the model, device count and operator remain undetermined. The 9 October inspection did not resolve the vessel’s subsequent fate. On 12 October, the transport minister confirmed continued monitoring of Able in Bulgaria’s EEZ and a contingency plan should it enter the territorial sea. The vessel remained afloat; no new attack or entry into the territorial sea is confirmed. On 12 October, Bulgaria’s president Iliana Yotova said that the perpetrator and devices’ origin remained undetermined. EMSA was asked for an underwater device to inspect the Alfa Watan wreck; this is a request for assistance, not a completed expert examination. This is Bulgaria’s position, separate from Ukraine’s president attributing the series to Russia on 6 October. BNT reported on 14 October that Able left Bulgaria’s EEZ that night around 01:10, about 33 nautical miles east of Ahtopol. This is the subsequent fate of the vessel attacked on 6 October, not a new attack, sinking or confirmation of full repair. The EEZ exit location is not the location of the earlier attack.
infrastructure disruption
officially attributed. A court or a competent state body has attributed it. That is not the same as a proven attack: an indictment is an allegation, not a verdict.
Prezydent Ukrainy Wołodymyr Zełenski / 2026-10-06: According to AP, Ukraine’s president attributed the series of attacks on two ships to Russia. Bulgaria’s prime minister did not name the operator; drone origins were under investigation. Grade B describes attribution by a Ukrainian state authority, not a finding by Bulgarian investigators.
Prezydent Bułgarii Iliana Jotowa, wywiad bTV przytoczony przez Flagman / 2026-10-12: On 12 October, Bulgaria’s president Iliana Yotova said that the perpetrator and devices’ origin remained undetermined. EMSA was asked for an underwater device to inspect the Alfa Watan wreck; this is a request for assistance, not a completed expert examination. This is Bulgaria’s position, separate from Ukraine’s president attributing the series to Russia on 6 October.
2026-10-07: On the morning of 7 October the ship was still burning and its engine room flooded; sinking was expected but not confirmed in the source.
2026-10-09: Inspection on 9 October confirmed that Able remained afloat, with severe fire damage and a partially flooded engine room; it carried wheat. The defence minister said the position of the damage suggested a surface drone. No drone remains were found; the model, device count and operator remain undetermined. The sources do not resolve the vessel’s subsequent fate.
2026-10-12: On 12 October, the transport minister confirmed continued monitoring of Able in Bulgaria’s EEZ and a contingency plan should it enter the territorial sea. The vessel remained afloat; no new attack or entry into the territorial sea is confirmed. On 12 October, Bulgaria’s president Iliana Yotova said that the perpetrator and devices’ origin remained undetermined. EMSA was asked for an underwater device to inspect the Alfa Watan wreck; this is a request for assistance, not a completed expert examination. This is Bulgaria’s position, separate from Ukraine’s president attributing the series to Russia on 6 October.
2026-10-14: BNT reported on 14 October that Able left Bulgaria’s EEZ that night around 01:10, about 33 nautical miles east of Ahtopol. This is the subsequent fate of the vessel attacked on 6 October, not a new attack, sinking or confirmation of full repair. The EEZ exit location is not the location of the earlier attack.
No coordinates - this record has no point on the map.
/ Bulgaria
Black Sea, Bulgaria’s EEZ, about 70 nautical miles east of Byala; Alfa Watan
At about 03:00 local time on 6 October 2026, the Togo-flagged Alfa Watan was attacked in Bulgaria’s exclusive economic zone. The ship sank and 10 crew members went missing. The search ended at 17:00 local time on 6 October without finding anyone, as the Maritime Administration reported the next day. Rafts and an overturned lifeboat were found. Ending the search does not confirm 10 deaths. Bulgaria’s prime minister confirmed a series of sea and aerial drone attacks on two ships without naming the operator. AP reports that Ukraine’s president attributed the series to Russia; Bulgarian authorities were still investigating the devices’ origin. The type, model and number of devices striking this vessel are undetermined. This is a separate entry for this ship, without an additional series aggregate. The EEZ is outside Bulgaria’s territorial sea. Exact coordinates have not been established; the entry has no map point. A navy briefing on 9 October confirmed the wreck at a depth of approximately 2,000 metres. Ten people remain missing; ten deaths are not confirmed. On 12 October, Bulgaria’s president Iliana Yotova said that the perpetrator and devices’ origin remained undetermined. EMSA was asked for an underwater device to inspect the Alfa Watan wreck; this is a request for assistance, not a completed expert examination. This is Bulgaria’s position, separate from Ukraine’s president attributing the series to Russia on 6 October.
infrastructure disruption
officially attributed. A court or a competent state body has attributed it. That is not the same as a proven attack: an indictment is an allegation, not a verdict.
Prezydent Ukrainy Wołodymyr Zełenski / 2026-10-06: According to AP, Ukraine’s president attributed the series of attacks on two ships to Russia. Bulgaria’s prime minister did not name the operator; drone origins were under investigation. Grade B describes attribution by a Ukrainian state authority, not a finding by Bulgarian investigators.
Prezydent Bułgarii Iliana Jotowa, wywiad bTV przytoczony przez Flagman / 2026-10-12: On 12 October, Bulgaria’s president Iliana Yotova said that the perpetrator and devices’ origin remained undetermined. EMSA was asked for an underwater device to inspect the Alfa Watan wreck; this is a request for assistance, not a completed expert examination. This is Bulgaria’s position, separate from Ukraine’s president attributing the series to Russia on 6 October.
2026-10-07: The Maritime Administration confirmed that the search ended on 6 October at 17:00 without finding the crew.
2026-10-09: The navy confirmed the wreck at a depth of approximately 2,000 metres. The toll remains 10 missing, without an established death count.
2026-10-12: On 12 October, Bulgaria’s president Iliana Yotova said that the perpetrator and devices’ origin remained undetermined. EMSA was asked for an underwater device to inspect the Alfa Watan wreck; this is a request for assistance, not a completed expert examination. This is Bulgaria’s position, separate from Ukraine’s president attributing the series to Russia on 6 October.
No coordinates - this record has no point on the map.
/ Romania
Black Sea, Romania’s exclusive economic zone; Royad Mammadov
On 5 October 2026, the Saint Kitts and Nevis-flagged Royad Mammadov caught fire and sank in Romania’s exclusive economic zone. Romanian authorities reported two deaths and 11 people rescued. On 6 October, Azerbaijan’s foreign ministry confirmed the captain’s death, one missing sailor and three Azerbaijani citizens hospitalised. The toll remains inconsistent; the register counts at least one death without adding the two versions or treating the missing sailor as dead. Ukraine’s president attributed a drone attack to Russia; Romania’s authorities did not establish the cause or operator in the cited statement. Turkish ownership does not mean a Turkish flag. The incident was in the EEZ, outside Romania’s territorial sea. Exact coordinates have not been established; the entry has no map point.
infrastructure disruption
officially attributed. A court or a competent state body has attributed it. That is not the same as a proven attack: an indictment is an allegation, not a verdict.
Prezydent Ukrainy Wołodymyr Zełenski / 2026-10-05: Ukraine’s president attributed the attack on the civilian ship to two Russian drones. This is Ukraine’s official position, not a finding by Romanian investigators or confirmed identification of the individual devices.
2026-10-06: Azerbaijan’s MFA reported the captain’s death, one missing sailor and three Azerbaijani citizens hospitalised. The earlier Romanian toll of two dead is retained separately.
No coordinates - this record has no point on the map.
/ Moldova
Palanca-Maiaki-Udobnoe border crossing, near the barrier
At about 09:38 on 5 October 2026, a projectile fell near the Palanca crossing, ricocheted off the ground and struck a bus parked near the barrier. According to preliminary information from Moldova’s Border Police, it damaged the bus and control booth; one officer was lightly injured and no other casualties were reported. Crossing operations were suspended and Border Police confirmed their resumption on 5 October. The exact reopening time and suspension duration remain undetermined. Border Police said the injured officer was stable and out of danger; on 7 October the interior minister said he remained in hospital in a stable condition. Border Police describe the incident as a consequence of Russian attacks on Ukrainian infrastructure without establishing the projectile’s specific type, model or operator. The bus has not been established as a target. This is a new event, separate from the flight over Palanca on 3 October. No verified coordinates are available; the entry has no map point.
airspace incident, infrastructure disruption
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
2026-10-05: Border Police confirmed resumption of crossing operations and that the injured officer was stable and out of danger. The exact reopening time is undetermined; statement publication time is not the resumption time.
2026-10-07: The interior minister said the officer remained in hospital in a stable condition. No additional casualty or change in the injury count.
No coordinates - this record has no point on the map.
/ Latvia
Latvia’s border with Belarus, exact section undetermined
On the evening of 5 October 2026, armed masked people threatened Latvian troops while trying to push about 20 migrants across the border from Belarus. Hours later, intruders entered Latvia, damaged an electrical cabinet for surveillance infrastructure and took two cameras before returning to Belarus. LETA’s report quotes Border Guard leaders. The exact date and time of the later intrusion within 5-6 October and its location are undetermined. Border Guard chief Guntis Pujāts allows for a criminal group; he did not confirm that these were Belarusian state personnel. The perpetrator and commissioning party remain undetermined, without a confirmed connection to a Russian operation. The case is included as an incident on the Belarusian border with that qualification. This is one reported sequence, without adding the two further cabinets reported on 7 October. Exact coordinates have not been established; the entry has no map point. IStories reported on 13 October, and t-online again on 16 October, that the group Chernyye Rusy claimed the action in a 12 October video. Expert Jānis Sārts considers a connection to Russian or Belarusian services probable. This is an unverified self-claim and expert opinion, not a Latvian state finding, official NATO attribution or proof of GRU involvement. They do not establish the exact location or resolve the intruders’ identity. Attribution remains unknown. The original publication predates the 14 October review, but the information is new to this entry. In an LTV De facto report of 25 October, prosecutor Andris Aleksejevs disclosed findings from a broader investigation opened in July: there are reasonable suspicions of Belarusian border officials’ involvement in organising migration and damaging Latvian infrastructure. According to the findings presented, migrants who had not paid for crossing the border were directed to damage equipment under threat of violence or torture. The report also discusses the known early-October incident, but does not establish the perpetrators of the specific act on 5-6 October or their connection to individuals in the broader investigation. This is added as investigative context; attribution for this entry remains unknown.
period
infrastructure sabotage
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Guntis Pujāts, szef łotewskiej straży granicznej, wypowiedź przytoczona przez LETA / 2026-10-07: He did not confirm that the intruders were Belarusian personnel and allowed for an organised criminal group. The crossing direction establishes neither nationality nor state tasking.
Chernyye Rusy, samoprzyznanie relacjonowane przez IStories / 2026-10-12: The group claims the border action. Its self-claim is not an independently verified finding of perpetrator identity.
Jānis Sārts, ekspert cytowany przez IStories i t-online / 2026-10-13: The assessment of a probable connection to Russian or Belarusian services is expert opinion, not an official finding by a state body or NATO.
Andris Aleksejevs, prokurator, wypowiedź dla LTV De facto / 2026-10-25: The broader investigation opened in July includes suspicions of Belarusian officials’ involvement and coercion of migrants into damaging infrastructure. The statement does not establish the perpetrators of the specific 5-6 October incident or Russian tasking.
2026-10-13: IStories reported on 13 October, and t-online again on 16 October, that the group Chernyye Rusy claimed the action in a 12 October video. Expert Jānis Sārts considers a connection to Russian or Belarusian services probable. This is an unverified self-claim and expert opinion, not a Latvian state finding, official NATO attribution or proof of GRU involvement. They do not establish the exact location or resolve the intruders’ identity. Attribution remains unknown. The original publication predates the 14 October review, but the information is new to this entry.
2026-10-25: In an LTV De facto report of 25 October, prosecutor Andris Aleksejevs disclosed findings from a broader investigation opened in July: there are reasonable suspicions of Belarusian border officials’ involvement in organising migration and damaging Latvian infrastructure. According to the findings presented, migrants who had not paid for crossing the border were directed to damage equipment under threat of violence or torture. The report also discusses the known early-October incident, but does not establish the perpetrators of the specific act on 5-6 October or their connection to individuals in the broader investigation. This is added as investigative context; attribution for this entry remains unknown.
No coordinates - this record has no point on the map.
/ Moldova
Palanca, Ștefan Vodă District
On 3 October 2026, Moldova’s defence ministry confirmed a separate, sixth unauthorised flight. The object entered national airspace at 08:04 from the direction of Udobnoe in Ukraine’s Odesa region towards Palanca and left at 08:05 towards Bileaivka in Ukraine. Type and model are undetermined; no crash was confirmed. This flight is separate from the five explosion sites in the same morning series. The statement links the events to Russian attacks on Ukraine but does not establish the individual operator. The places describe directions, not a fully verified route. No verified coordinates are available; the entry has no map point.
airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
No coordinates - this record has no point on the map.
/ Moldova
outside Constantinovca, Căușeni District
On 3 October 2026, an aerial object exploded outside Constantinovca. The police chronology gives 08:24 for the explosion and 09:15 for locating the device or debris. A vegetation fire broke out after the explosion. Police reported no casualties. This is one of five distinct explosion sites in the morning series. The defence ministry corrected the aggregate identification to three missiles and two drones without assigning them to locations. Preliminary examination found components similar to S8000 Banderol; this object's model remains undetermined. The defence minister links the series to Russian attacks on Ukraine; the individual operator has not been established. No verified coordinates are available; the entry has no map point.
airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Minister obrony Mołdawii Anatolie Nosatîi, wypowiedź dla Moldova 1 / 2026-10-03: The minister links the entire series to Russian attacks on Ukraine. This is a statement about the series, without a separate finding on the device’s operator at this location.
2026-10-03: Police described similarities between examined components and S8000 Banderol. This is preliminary identification, not a final model assessment for this device.
No coordinates - this record has no point on the map.
/ Moldova
outside Dubovca, Hîncești District
On 3 October 2026, an aerial object exploded outside Dubovca. The police chronology gives 08:03 for the explosion and 08:40 for locating the device or debris. Police reported no casualties. This is one of five distinct explosion sites in the morning series. The defence ministry corrected the aggregate identification to three missiles and two drones without assigning them to locations. Preliminary examination found components similar to S8000 Banderol; this object's model remains undetermined. The defence minister links the series to Russian attacks on Ukraine; the individual operator has not been established. No verified coordinates are available; the entry has no map point.
airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Minister obrony Mołdawii Anatolie Nosatîi, wypowiedź dla Moldova 1 / 2026-10-03: The minister links the entire series to Russian attacks on Ukraine. This is a statement about the series, without a separate finding on the device’s operator at this location.
2026-10-03: Police described similarities between examined components and S8000 Banderol. This is preliminary identification, not a final model assessment for this device.
No coordinates - this record has no point on the map.
/ Moldova
outside Puhăceni, Anenii Noi District
On 3 October 2026, an aerial object exploded outside Puhăceni. The police chronology gives 08:00 for the explosion and 08:30 for locating the device or debris. Police reported no casualties. This is one of five distinct explosion sites in the morning series. The defence ministry corrected the aggregate identification to three missiles and two drones without assigning them to locations. Preliminary examination found components similar to S8000 Banderol; this object's model remains undetermined. The defence minister links the series to Russian attacks on Ukraine; the individual operator has not been established. No verified coordinates are available; the entry has no map point.
airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Minister obrony Mołdawii Anatolie Nosatîi, wypowiedź dla Moldova 1 / 2026-10-03: The minister links the entire series to Russian attacks on Ukraine. This is a statement about the series, without a separate finding on the device’s operator at this location.
2026-10-03: Police described similarities between examined components and S8000 Banderol. This is preliminary identification, not a final model assessment for this device.
No coordinates - this record has no point on the map.
/ Moldova
outside Crocmaz, Ștefan Vodă District
On 3 October 2026, an aerial object exploded outside Crocmaz. The police chronology gives 07:53 for the explosion and 08:20 for locating the device or debris. The vineyard explosion caused a vegetation fire and damaged windows in an agricultural brigade building. Police reported no casualties. This is one of five distinct explosion sites in the morning series. The defence ministry corrected the aggregate identification to three missiles and two drones without assigning them to locations. Preliminary examination found components similar to S8000 Banderol; this object's model remains undetermined. The defence minister links the series to Russian attacks on Ukraine; the individual operator has not been established. No verified coordinates are available; the entry has no map point.
airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Minister obrony Mołdawii Anatolie Nosatîi, wypowiedź dla Moldova 1 / 2026-10-03: The minister links the entire series to Russian attacks on Ukraine. This is a statement about the series, without a separate finding on the device’s operator at this location.
2026-10-03: Police described similarities between examined components and S8000 Banderol. This is preliminary identification, not a final model assessment for this device.
No coordinates - this record has no point on the map.
/ Moldova
outside Căușeni, Căușeni District
On 3 October 2026, an aerial object exploded outside Căușeni. The police chronology gives 07:50 for the explosion and 08:15 for locating the device or debris. Police reported no casualties. This is one of five distinct explosion sites in the morning series. The defence ministry corrected the aggregate identification to three missiles and two drones without assigning them to locations. Preliminary examination found components similar to S8000 Banderol; this object's model remains undetermined. The defence minister links the series to Russian attacks on Ukraine; the individual operator has not been established. No verified coordinates are available; the entry has no map point.
airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Minister obrony Mołdawii Anatolie Nosatîi, wypowiedź dla Moldova 1 / 2026-10-03: The minister links the entire series to Russian attacks on Ukraine. This is a statement about the series, without a separate finding on the device’s operator at this location.
2026-10-03: Police described similarities between examined components and S8000 Banderol. This is preliminary identification, not a final model assessment for this device.
No coordinates - this record has no point on the map.
/ Poland
Lublin and Rzeszów-Jasionka airports
On the morning of 30 September 2026, Lublin and Rzeszów-Jasionka airports temporarily suspended civilian operations to give military aviation freedom to operate during a Russian attack on Ukraine. Radio Lublin/IAR, quoting PANSA, places the start at 06:00 and reports reopening in its 07:15 update. Update time may not be the exact reopening time, so no duration is entered into statistics. This is one entry for preventive disruption at two airports, without a confirmed airport strike or Polish airspace violation. A later alert and second military operation do not confirm another airport closure. Cancelled and diverted flight counts remain undetermined. No verified coordinates are available; the entry has no map point.
airport disruption
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
At 20:45 on 30 September 2026, the day’s third unauthorised flight was detected. The object crossed from the direction of Șerșenți in Ukraine toward Slobozia-Rașcov, then headed toward Țipova and disappeared from monitoring near Brănești. The Centre airspace zone was temporarily closed and reopened at 21:07; this does not establish that the object left the country. A later Realitatea report, carrying a 22:30 police update, confirms a drone explosion near the Ivancea-Brănești road and temporary suspension of traffic in both directions. No casualties were reported. Identity between this drone and the object tracked at 20:45 has not been conclusively confirmed. This possible identity is not used to create another entry or a device count. Preliminary police examination: wing fragments marked “Gheran-4”, a turbojet engine and three craters. The main explosion site was about 10 metres from the road, with debris within about 120 metres. Police indicate a collision with a tree before the explosion; expert examination continues. Geran-family identification is preliminary; a fragment marking does not establish the final model or operator. No verified coordinates are available; the entry has no map point.
airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
2026-09-30: Police update reported at 22:30: confirmed drone explosion near the Ivancea-Brănești road, without reported casualties; traffic temporarily suspended. A link to the 20:45 flight requires confirmation.
2026-10-01: Preliminary police examination: wing fragments marked “Gheran-4”, a turbojet engine and three craters. The main explosion site was about 10 metres from the road, with debris within about 120 metres. Police indicate a collision with a tree before the explosion; expert examination continues.
No coordinates - this record has no point on the map.
/ Moldova
Lunga, Dubăsari District / near Arionești, Dondușeni District
At 10:26 on 30 September 2026, an unauthorised drone flight was detected near Lunga. The defence ministry closed the North and Centre airspace zones. A later update said the drone was heading north; the Centre zone reopened earlier, and the North also reopened after the object disappeared from monitoring at 11:07 near Arionești. The statement does not give explicit reopening times or closure durations. Disappearance does not confirm departure from the country or a crash. This is a separate episode from the morning Hîrbovăț explosion. Model, operator and full route are undetermined. Detection time does not establish the start of restrictions. No verified coordinates are available; the entry has no map point.
airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
2026-09-30: Later ministry update: disappearance near Arionești at 11:07, reopening of the North zone and earlier reopening of the Centre. Exact reopening times were not given. The full text was read on 5 October.
No coordinates - this record has no point on the map.
/ Moldova
outside Hîrbovăț village, Anenii Noi District
On the morning of 30 September 2026, a drone flew over Moldova and exploded outside Hîrbovăț village. Police received a report of low flight over Bender around 05:40, while military monitoring detected the drone around 05:43; these times do not establish when it exploded. Subsequent preliminary police examination placed impact and explosion about 40 metres above ground near a civilian operator’s antenna. Metal deformation and thermal traces were found; communications services remained operational. Initial reports recorded no casualties. Debris examination continues; model and operator are undetermined. This is a separate episode from the flights at 10:26 and 20:45. No verified coordinates are available; the entry has no map point.
airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
2026-09-30: Preliminary police examination: antenna damage at about 40 metres above ground, without a communications outage.
No coordinates - this record has no point on the map.
/ Romania
Insula Mare a Brăilei, opposite Gropeni, Brăila County
On 29 September 2026, MApN was notified of debris on farmland on Insula Mare a Brăilei, opposite Gropeni. An overnight emergency call reported a falling object and fire. Examination confirmed a crater and drone fragments; the preliminary assessment was that its explosive payload detonated on ground impact. Fire affected a limited part of the field, and SRI recovered debris for examination. The initial release reported no casualties. Radar recorded no airspace violation that night. The entry date records debris discovery on 29 September; the fall was reported overnight on 28-29 September, without an exact time. Model, origin and operator remain undetermined. No link to the Isaccea alert has been established. No verified coordinates are available; the entry has no map point.
date found, not date of flight
object found, airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
2026-09-29: Examination confirmed a crater, drone debris and payload detonation on impact. Fire affected a limited part of the field; model and operator remain undetermined.
No coordinates - this record has no point on the map.
/ Poland
Lublin and Rzeszów-Jasionka airports
On 28 September 2026, Lublin and Rzeszów-Jasionka airports temporarily suspended civilian operations to give military aviation freedom to operate during a Russian attack on Ukraine. Traffic subsequently resumed. Radio Lublin/IAR confirms both stages but does not establish exact closure times or the number of cancelled flights. These were preventive restrictions within the same defensive operation as the evacuation of Dorohusk and Zosin crossings. No Polish airspace violation or strike on the airports was confirmed. One entry covers both airports; without verified coordinates it has no map point.
airport disruption
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
No coordinates - this record has no point on the map.
/ Poland
Dorohusk and Zosin road border crossings
On 28 September 2026, Dorohusk and Zosin crossings were evacuated and processing suspended after a drone struck on the Ukrainian side of the border. Border Guard spokesperson Dariusz Sienicki confirmed both evacuations. PAP reported that processing resumed at 17:20. Poland’s Defence Ministry said Polish airspace had not been violated. The entry covers a preventive disruption at two crossings, not a strike on Polish infrastructure. The exact start, duration and number evacuated are undetermined. No verified coordinates are available; the entry has no map point.
infrastructure disruption
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
No coordinates - this record has no point on the map.
/ Romania
Ceatalchioi-Somova area, Tulcea County
On the evening of 27 September 2026, Romanian radar detected an object over Ukraine north of Chilia Veche. It then entered Romanian airspace through the Ceatalchioi area and moved along the border. Its signal disappeared near Somova after about 10 minutes. Two Romanian F-16s took off from Borcea. The public alert in Tulcea County ran from 20:35 to 22:05; the ministry announced a ground search for the morning of 28 September. Statement no. 308 does not confirm recovery, a crash, a model or an operator. Somova is the area where the signal was lost, not an established crash site. This is a separate episode from the overnight entry near Chilia Veche on 26-27 September. Exact event coordinates have not been established; the entry has no map point.
airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
No coordinates - this record has no point on the map.
/ Romania
Chilia Veche-Pardina area, Tulcea County
On the night of 26-27 September 2026, Romania’s Defence Ministry confirmed by radar that an aerial object entered near Chilia Veche. It travelled almost parallel to the Chilia branch for several minutes; its signal was lost near Pardina. Two Spanish F-18s and a Romanian IAR-330 SOCAT helicopter took off. A RO-Alert for northern Tulcea County ran from 23:32 to 00:48. This is the alert period, not the duration of the incursion. Statement no. 307 does not confirm a crash, recovered debris, a model or an operator. Losing the signal does not establish a crash. This event is separate from the entry through Ceatalchioi on the evening of 27 September. Exact event coordinates have not been established; the entry has no map point.
airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
No coordinates - this record has no point on the map.
/ Moldova
near Volintiri, Ștefan Vodă District
On the evening of 26 September 2026, at about 20:25, border police responding to residents’ reports found fragments of an unmanned aircraft in a field near Volintiri. The site was secured. News.ro reports the border police’s statement that the circumstances were under investigation. The entry date records discovery, not an established flight or crash date. The aircraft’s type, origin and operator remain undetermined. No connection to the flight through the Transnistrian segment that day has been confirmed. A separate discovery entry does not establish another unique drone; the device count remains unknown. Exact event coordinates have not been established; the entry has no map point.
date found, not date of flight
object found
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
No coordinates - this record has no point on the map.
/ Moldova
Transnistrian segment: Novocotovsc-Pervomaisc
On 26 September 2026, Moldova’s National Army confirmed an unauthorised flight from 11:16 to 11:18. The object entered from the direction of Stepanivka in Ukraine’s Odesa region towards Novocotovsc in the Transnistrian segment. It left Moldovan airspace from the direction of Pervomaisc towards Lîmanske in Ukraine. The statement places the event in the context of Russian attacks on Ukraine but does not identify the object’s model or operator. The named places describe observation directions, not a fully reconstructed trajectory. No connection has been established to debris discovered near Volintiri that evening or to the northern series on 24 September. Exact event coordinates have not been established; the entry has no map point.
airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
No coordinates - this record has no point on the map.
/ Romania
entry through northern Botoșani County; crash near Solca, Suceava County
On the morning of 24 September 2026, Romania’s Defence Ministry detected a target over Ukraine near northern Botoșani County; radar indicated that it then entered Romanian airspace. Two F-16s took off, and a RO-Alert was issued for Botoșani and Suceava at 06:26. In update no. 303, the ministry confirmed that the object remained in Romanian airspace for about four minutes and crashed near Solca. Responders found a small drone. There were no casualties, material damage or fire at the crash site. The model, operator and exact route remain undetermined. The alert time is not an established entry time. This updates the same morning incident, separate from the overnight Tulcea alert. The point approximately represents the Solca area, not the exact crash site.
airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
2026-09-24: Defence Ministry update no. 303: about four minutes in Romanian airspace, followed by a small drone crashing near Solca; no casualties, material damage or fire. Model and operator undetermined.
On 24 September 2026, processing at Dorohusk and Zosin was suspended because of Russian air strikes on Ukraine. The morning Border Guard account placed the start around 03:00; at 10:23 Radio Lublin reported that processing had resumed and no evacuation had been needed. Publication time is not reopening time. An AP report published on 28 September, however, describes three traffic interruptions and one staff evacuation at Dorohusk during a visit on 24 September. This adds a full-day perspective; whether the accounts cover the same periods remains unclear. AP’s findings are not extended to Zosin. One daily entry covers disruption at both crossings, without a confirmed Polish airspace violation or infrastructure sabotage. The record has no map point.
infrastructure disruption
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
2026-09-28: AP: three traffic interruptions and one staff evacuation at Dorohusk on 24 September. Update to the daily entry; these findings are not extended to Zosin.
No coordinates - this record has no point on the map.
/ Moldova
near Cotiujeni, Briceni District, about 1.7 km from the border
At about 16:50 on 24 September 2026, border police found drone debris near Cotiujeni, about 1.7 km from the border. Police findings published on 25 September indicate an explosion after impact with trees, about 10 m above ground, and tree damage within a radius of about 25 m. A jet engine and parts bearing “ГЕРАНЬ 4” markings were recovered; examination was ongoing. The entry date records discovery, not an established crash date. No connection to the morning flights of 24 September or earlier incidents has been confirmed. This is not evidence of a fifth drone or a new evening incursion. The device count remains unknown. The exact discovery site has not been established, so the record has no map point.
date found, not date of flight
object found
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
No coordinates - this record has no point on the map.
/ Moldova
northern Moldova: Vasilcău, Larga, Volovița, Socola; crash near Cernița
On 24 September 2026, during Russian attacks on Ukraine, Moldova’s Defence Ministry described four morning airspace-incursion episodes: at 05:21 towards Vasilcău, 06:14-06:16 through Larga, 06:35 through Volovița and 06:58 towards Socola. The northern airspace sector was temporarily closed and reopened at 07:46. Near Cernița, police found a camera-equipped drone with Gerbera characteristics; they reported that it hit a tree and exploded. Model identification was preliminary. A separate explosion report in the Camenca area remains less well documented. One entry covers the morning series without establishing a shared route, an operator or a unique device count. A connection to debris found later near Cotiujeni has not been established. The point approximately represents only the Cernița area.
airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Wola Krobowska, Starlink ground communications station
A fire broke out at the Starlink ground station in Wola Krobowska on the evening of 23 September 2026. On 25 September, Poland’s National Prosecutor’s Office opened an investigation into sabotage, a terrorism-related offence and acting for a foreign intelligence service. Spokesperson Przemysław Nowak cited reasonable suspicion that the perpetrators acted on orders from Russian services. This was the prosecutor’s official suspicion on 25 September. On 12 October, Poland’s interior ministry confirmed the arrest in Germany of two Turkish nationals suspected of the 23 September arson. Wanted notices and European Arrest Warrants had been issued the previous week. Minister Tomasz Siemoniak officially attributed the sabotage to Russian services. This is official state attribution, not a verdict against the detainees or identification of a particular Russian service. The entry does not establish destruction of the entire station or a service outage in Ukraine. The map point approximately represents the Wola Krobowska area, not the exact fire site. According to SWR, citing Stuttgart’s general public prosecutor, the court in Nürtingen opened the Polish European Arrest Warrants on 13 October and ordered that the two suspects remain in custody. This is not a sabotage conviction or confirmation of completed extradition. In its 14 October, 14:01 update, SWR cited the general public prosecutor as saying police measures involving a woman in Karlsruhe were not an arrest. Earlier reports of four arrests remain unconfirmed in that respect. The account of a possible driver arrested in Berlin originated with BILD; a final total arrest count is not established. On 16 October, ABW confirmed that two masked people deliberately set fire to control equipment. Firefighting lasted over six hours, which does not establish a service-outage duration. Charges against two suspects were formulated on 7 October and EAWs issued on 10 October; arrests in Germany took place on 12 October and German remand on 13 October. Transfer to Poland remains in progress. Evidence-gathering measures concerning two further people do not confirm their arrest. ABW also disclosed a separately detained person independently reconnoitring the station, remanded for three months from 30 September. This does not establish a third arsonist. The statement describes investigation of possible commissioning parties; it neither replaces the minister’s earlier attribution nor constitutes a verdict. Der Spiegel on 17 October, according to the complete reports in The Insider and Euronews, raised possible involvement of the Turkish Daltons/Daltonlar group: the two detainees reportedly belonged to the group or acted on its instructions. This is a journalistic lead about intermediaries, not new arrests or a court finding. Both reports rely on the same material and are not independent confirmations. The earlier official attribution to Russian services remains a separate basis; the newly described commissioning chain is not officially confirmed. Conflicting secondary reports of three or four arrests in the arson case were not adopted.
arson, infrastructure sabotage
officially attributed. A court or a competent state body has attributed it. That is not the same as a proven attack: an indictment is an allegation, not a verdict.
Prokuratura Krajowa, rzecznik Przemysław Nowak / 2026-09-25: The prosecutor’s spokesperson cited reasonable suspicion that the perpetrators acted on Russian services’ orders; the investigation concerns sabotage and acting for a foreign intelligence service.
Minister Tomasz Siemoniak, komunikat MSWiA / 2026-10-12: Minister Tomasz Siemoniak officially attributed the sabotage to Russian services. The statement does not identify the GRU and is not a verdict against the two detained suspects.
Der Spiegel, według relacji The Insider i Euronews / 2026-10-17: Suspicion that the two detainees belonged to the Turkish Daltons/Daltonlar group or acted on its instructions. This new detail concerning intermediaries is not an official court or intelligence-service finding.
2026-10-12: On 12 October, Poland’s interior ministry confirmed the arrest in Germany of two Turkish nationals suspected of the 23 September arson. Wanted notices and European Arrest Warrants had been issued the previous week. Minister Tomasz Siemoniak officially attributed the sabotage to Russian services. This is official state attribution, not a verdict against the detainees or identification of a particular Russian service.
2026-10-13: According to SWR, citing Stuttgart’s general public prosecutor, the court in Nürtingen opened the Polish European Arrest Warrants on 13 October and ordered that the two suspects remain in custody. This is not a sabotage conviction or confirmation of completed extradition.
2026-10-14: In its 14 October, 14:01 update, SWR cited the general public prosecutor as saying police measures involving a woman in Karlsruhe were not an arrest. Earlier reports of four arrests remain unconfirmed in that respect. The account of a possible driver arrested in Berlin originated with BILD; a final total arrest count is not established.
2026-10-16: On 16 October, ABW confirmed that two masked people deliberately set fire to control equipment. Firefighting lasted over six hours, which does not establish a service-outage duration. Charges against two suspects were formulated on 7 October and EAWs issued on 10 October; arrests in Germany took place on 12 October and German remand on 13 October. Transfer to Poland remains in progress. Evidence-gathering measures concerning two further people do not confirm their arrest. ABW also disclosed a separately detained person independently reconnoitring the station, remanded for three months from 30 September. This does not establish a third arsonist. The statement describes investigation of possible commissioning parties; it neither replaces the minister’s earlier attribution nor constitutes a verdict.
2026-10-17: Der Spiegel on 17 October, according to the complete reports in The Insider and Euronews, raised possible involvement of the Turkish Daltons/Daltonlar group: the two detainees reportedly belonged to the group or acted on its instructions. This is a journalistic lead about intermediaries, not new arrests or a court finding. Both reports rely on the same material and are not independent confirmations. The earlier official attribution to Russian services remains a separate basis; the newly described commissioning chain is not officially confirmed. Conflicting secondary reports of three or four arrests in the arson case were not adopted.
On 23 September 2026, Polish military aviation was activated during a Russian attack on Ukraine. Rzeszów-Jasionka and Lublin airports temporarily suspended operations to give military aircraft freedom to operate. The suspension alone does not establish a violation of Polish airspace. The source does not establish the precise duration of the restrictions. One entry covers both airports; the map point represents Rzeszów-Jasionka. This event is separate from the Mi-8 border incursion near Braniewo on the same day.
airport disruption
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
On 23 September 2026 at 11:08, according to Poland’s Operational Command, a Russian Armed Forces Mi-8 arrived from the Kaliningrad region and violated Polish airspace north of Braniewo. It penetrated up to about 300 m and remained for 42 seconds. Fighters were scrambled; the helicopter returned to Kaliningrad on its own. The command assessed the incident as a test of defence readiness; this is its assessment of intent. The map point represents the area, not an exact position or flight path.
airspace incident
officially attributed. A court or a competent state body has attributed it. That is not the same as a proven attack: an indictment is an allegation, not a verdict.
Dowództwo Operacyjne Rodzajów Sił Zbrojnych / 2026-09-23: Poland’s Operational Command identified a Russian Armed Forces Mi-8 as the aircraft that violated Polish airspace.
On 22 September 2026, Defence Minister Władysław Kosiniak-Kamysz reported that Polish fighters had intercepted a Russian Il-20 reconnaissance aircraft over the Baltic Sea, about 40 km off Poland’s coast. This entry records an interception, without confirmation of a violation of Polish airspace. The source does not provide an exact position or route; distance from the coast alone is insufficient to establish jurisdiction. Transponder and flight-plan details from earlier interceptions are not applied to this event. The record has no map point.
airspace incident
officially attributed. A court or a competent state body has attributed it. That is not the same as a proven attack: an indictment is an allegation, not a verdict.
Minister obrony narodowej Władysław Kosiniak-Kamysz / 2026-09-22: The minister identified a Russian Il-20 reconnaissance aircraft as the aircraft intercepted by Polish fighters over the Baltic. This does not attribute a violation of Polish airspace.
No coordinates - this record has no point on the map.
/ Moldova
northern Moldova: Dondușeni-Briceni-Tabani; a separate flight near Palanca
On 21 September 2026, two violations of Moldovan airspace were confirmed by the foreign ministry. Overnight, an unidentified object was tracked in the north, in the Dondușeni and Briceni areas; contact was lost around 00:44 near Tabani. The northern airspace sector was closed for 24 minutes. Losing contact does not confirm a crash. A second incursion was recorded around midday near Palanca. This entry covers two separate episodes on the same day, without establishing an operator or a common route. The map point represents only the northern episode, in the Tabani area.
airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
On the night of 21/22 September 2026, Vilnius Airport operations were restricted after signatures characteristic of balloons were detected. Restrictions began at 23:25 local time; according to BNS, normal operations resumed at 02:40. Airport operator Lietuvos oro uostai linked the event to hybrid activity by Belarus. On 23 September, Lithuania’s Foreign Ministry delivered a protest note to the Belarusian chargé d’affaires concerning the night of 21/22 September. According to the ministry, balloons carrying contraband arrived from Belarusian territory, violating the border and airspace and endangering civil aviation. The ministry assesses this and similar episodes as systematic hybrid activity. The statement does not identify the balloons’ specific operator. The sources do not confirm the recovery of balloons or the presence of Russian drones.
period
airspace incident, airport disruption
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Lietuvos oro uostai / 2026-09-21: The airport operator linked the disruption to hybrid activity by Belarus. The report does not present evidence establishing responsibility for this particular episode.
Ministerstwo Spraw Zagranicznych Litwy / 2026-09-23: On 23 September, Lithuania’s Foreign Ministry delivered a protest note to the Belarusian chargé d’affaires concerning the night of 21/22 September. According to the ministry, balloons carrying contraband arrived from Belarusian territory, violating the border and airspace and endangering civil aviation. The ministry assesses this and similar episodes as systematic hybrid activity. The statement does not identify the balloons’ specific operator.
2026-09-23: On 23 September, Lithuania’s Foreign Ministry delivered a protest note to the Belarusian chargé d’affaires concerning the night of 21/22 September. According to the ministry, balloons carrying contraband arrived from Belarusian territory, violating the border and airspace and endangering civil aviation. The ministry assesses this and similar episodes as systematic hybrid activity. The statement does not identify the balloons’ specific operator.
Black Sea, Romania's exclusive economic zone, about 33, 37 and 42 nautical miles from Constanța
On 20 September 2026, Romanian naval forces recovered three drone fragments in Romania's exclusive economic zone. The first was retrieved about 37 nautical miles from Constanța, another at around 17:30 at a distance of 42 miles, and a third around 19:00 at 33 miles. Specialists found no explosive hazard. This entry covers one operation at three locations; three fragments do not establish three separate drones. The defence ministry did not identify an origin or operator. With neither coordinates nor bearings from Constanța, no map point can be established. This was in the exclusive economic zone, not a confirmed event in territorial waters.
date found, not date of flight
object found
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
No coordinates - this record has no point on the map.
/ Romania
Black Sea, about 50 nautical miles east of Chituc; exact neutralisation site not established
On 19 September 2026, the Romanian Coast Guard reported a floating object, possibly an aerial drone fragment, about 50 nautical miles east of Chituc. On 20 September at around 09:30, naval EOD divers neutralised the debris. The defence ministry described the intervention site as the Grindul Chituc area without exact coordinates. This entry uses the discovery date; it does not establish when the object flew or fell. Its origin and operator remain unknown. The statement does not precisely establish the neutralisation site or its jurisdiction, so the entry has no map point.
date found, not date of flight
object found
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
2026-09-20: At around 09:30, naval EOD divers neutralised the debris; the defence ministry reported that the area was secured and there was no danger to the population or shipping.
No coordinates - this record has no point on the map.
/ Poland
Rzeszów-Jasionka and Lublin airports
On 18 September 2026, another Russian attack on Ukraine prompted Polish and allied aviation operations, while Lublin and Rzeszów-Jasionka airports temporarily suspended traffic. Traffic resumed after the operations ended. The restrictions were preventive; their introduction alone does not establish a violation of Polish airspace. The military operation times are not treated as airport closure times, which the source does not establish precisely. One entry covers both airports; the map point represents Rzeszów-Jasionka.
airport disruption
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Căplani, Olănești and Chistovodne, Ștefan Vodă District
On the night of 18/19 September 2026, Moldovan border police recorded drones in Ștefan Vodă District. Around midnight, two objects entered towards Olănești and Chistovodne; another flight over Căplani from the direction of Crocmaz was also described. This entry groups the overnight observations without establishing the number of distinct aircraft or their operators. A later report of an object crashing near Troița on the Ukrainian side of the border does not establish that it was one of those same drones. The point represents the Căplani area.
period
airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
On 18 September 2026, at around 04:20, residents heard an explosion southwest of Colonița, towards Tohatin. Emergency services found debris from an aerial object. After initial uncertainty, police chief Viorel Cernăuțeanu described it as a jet-powered drone. The source does not establish its operator or origin. It does not support identifying the object as a confirmed Russian cruise missile. The map point is approximate.
date found, not date of flight
airspace incident, object found
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
On 17 September 2026, traffic at Lublin and Rzeszów-Jasionka airports was temporarily suspended and then resumed because of the threat during Russian attacks on Ukraine. Sirens sounded in Rzeszów and some public offices were evacuated. Reporting placed the drone crash about 4 km from the Polish border, on the Ukrainian side; entry into Poland was not confirmed. The precise duration of the airport interruption was not established. One entry covers both airports and the associated alert; the map point represents Rzeszów-Jasionka.
airport disruption
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
On 17 September 2026, an unidentified drone violated Moldovan airspace for about two minutes. The defence ministry said the object entered around 08:56 in the Tudora area and left around 08:58 near Palanca, returning towards Ukraine. The ministry did not identify the drone type or its operator. The map point is representative of the flight area, not the exact position of the object.
airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
On 16 September 2026, during Russian attacks on Ukraine and Polish military aviation operations, traffic was temporarily suspended at Lublin and Rzeszów-Jasionka airports. According to reporting citing the Polish Air Navigation Services Agency, restrictions began around 07:00 and traffic resumed about 40 minutes later. The measures were preventive. The source does not establish a violation of Polish airspace. One entry covers both airports; the map point represents Rzeszów-Jasionka.
airport disruption
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Carfil industrial platform, Brașov, adjacent to CARFIL SA
On 14 September 2026, a fire occurred on the Carfil industrial platform in Brașov, immediately adjacent to CARFIL SA, a ROMARM subsidiary. On 26 October, SRI attributed the arson to a sabotage network coordinated from Russia. This is state attribution, not a final court judgment. The sources do not establish that the arms factory itself burned or that production stopped. AGERPRES reporting on the DIICOT investigation identifies two Belarusian and one Ukrainian suspects; the case involves European Arrest Warrants and cooperation with Germany and Poland. No specific Russian agency was publicly established. Exact coordinates are undetermined; the entry has no map point. PAP reports Artem S.’s arrest in Warsaw and a court decision on 28 October imposing seven days of detention in connection with the Romanian European Arrest Warrant. The suspect did not consent to surrender to Romania. Completed surrender is not confirmed; this is a development in the same case, not another sabotage incident in Poland.
arson
officially attributed. A court or a competent state body has attributed it. That is not the same as a proven attack: an indictment is an allegation, not a verdict.
Serviciul Român de Informații / 2026-10-26: SRI attributes the arson to a sabotage network coordinated from the Russian Federation. This is neither a judgment nor identification of a specific Russian agency.
2026-10-28: PAP reports Artem S.’s arrest in Warsaw and a court decision on 28 October imposing seven days of detention in connection with the Romanian European Arrest Warrant. The suspect did not consent to surrender to Romania. Completed surrender is not confirmed; this is a development in the same case, not another sabotage incident in Poland.
No coordinates - this record has no point on the map.
/ Poland
Rusinowo near Jarosławiec, Baltic Sea (West Pomerania)
On 14 September 2026, a drone was located floating off Rusinowo near Jarosławiec; according to the prosecutor, the sea washed it onto the beach at around 11:00. On 16 September, prosecutors reported that it carried a fragmentation/high-explosive warhead with a fuze and about 4 kg of explosive. The warhead was separated and neutralised on the beach on the evening of 15 September, and the drone was taken away for further examination. Preliminary identification indicates a Gerbera 2 manufactured and used by Russia. Its launch site, intended destination and operator have not been established. The defence minister raised a possible link to a flight over Lithuania on 13 September; that connection remains unconfirmed. The entry is dated by discovery, not an established flight date.
date found, not date of flight
object found
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Prokuratura Okręgowa w Poznaniu, płk Bartosz Okoniewski / 2026-09-16: The drone was preliminarily identified as a Gerbera 2 manufactured and used by the Russian Federation. This identifies equipment, not its operator or launch site.
2026-09-16: Prosecutors confirmed a fragmentation/high-explosive warhead with about 4 kg of explosive, neutralised on the beach on the evening of 15 September. Preliminary identification: Russian-made Gerbera 2. The operator and route remain unknown.
near Palanca and Cioburciu, Ștefan Vodă District; Pervomaisc in the Transnistrian sector
On 14 September 2026, during Russian attacks on Odesa region, two drones violated Moldovan airspace. The first entered near Palanca at 10:33, arriving from Maiaky, penetrated about 500 m into the country and returned to Ukraine at 10:34. The second entered from the direction of Ukraine near Cioburciu at 11:09, flew towards Pervomaisc in the Transnistrian sector and left the country at 11:19 near Kuchurhan, heading for Stepove. The crossings were confirmed by Moldova's border police and Ukraine's State Border Guard Service; the defence ministry said it was monitoring the situation in coordination with foreign partners. The ministry gave neither the drones' type nor who operated them.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Pratkunai, Kaisiadorys district, near the Kruonis pumped-storage plant
On the night of 14 to 15 September, at about midnight, the military observed an object flying towards Lithuania; according to the NKVC the drone entered from Belarus, passed Lentvaris in the Trakai district and flew west, and air-threat warnings were issued for Vilnius, Trakai, Elektrenai and then Kaunas. At 00:19 a yellow alert was declared and at 00:20 two Italian Eurofighters from Siauliai air base (NATO Baltic Air Policing) destroyed the drone with a missile over the village of Pratkunai in the Kaisiadorys district, near the Kruonis pumped-storage plant; the alert was lifted at 00:33. Plan Skydas was activated at the site and sappers neutralised an explosive charge; nobody was hurt. Vilnius Airport restricted operations for the duration of the alert and two arriving flights (from Antalya and Reykjavik) were delayed. On 16 September President Gitanas Nauseda said that according to available information it was a Gerbera-type drone, most likely Russian, intended to attack Ukraine and pushed off course by Ukrainian electronic warfare, so probably not a deliberate act against Lithuania; the same day the foreign ministry handed Belarus a protest note. The first drone shot down over Lithuania; who controlled the object remains under investigation.
airspace incident, airport disruption
suspected. Someone has named a perpetrator, but this is neither a court finding nor a formal attribution by a state.
Prezydent Litwy Gitanas Nausėda / 2026-09-16: The president said that according to available information it was a Russian Gerbera-type drone, most likely intended to attack Ukraine and pushed off course by Ukrainian electronic warfare; he assessed that it was probably not a deliberate act against Lithuania. This is a preliminary political assessment, not an investigative finding: examination of the wreckage continues and no operator has been formally named.
A Russian frigate fired two flares towards a Danish armed forces helicopter that was carrying out routine photographic documentation of the vessel. One flare passed close to the helicopter. The incident took place in international waters, not in Danish territorial waters. Flares are pyrotechnic devices normally used as an attention signal at sea, not live ammunition. The statement does not name the frigate, mentions no injuries or damage, and offers no further comment.
action by state forces
officially attributed. A court or a competent state body has attributed it. That is not the same as a proven attack: an indictment is an allegation, not a verdict.
Forsvaret (duńskie siły zbrojne) / 2026-09-14: The Danish armed forces stated that the flares were fired from a Russian frigate towards their helicopter. The actor here is a state vessel acting openly. The statement does not settle whether the act was intended as a threat.
open ground east of Lake Steinhude, near Wunstorf Air Base, Hanover region
On 14 September 2026 the Lower Saxony State Criminal Police Office (LKA) learned that parts of a presumably crashed drone had been found on uninhabited ground east of Lake Steinhude, near the Bundeswehr's Wunstorf Air Base; reportedly about 800 m from the site but not on its grounds. From 15 September a large police contingent searched the hard-to-access terrain for further parts and traces of the owner or pilot; the parts were to be examined by a forensic institute. The LKA is handling the case as a hazard-prevention matter and, according to a spokesperson, there are no indications of danger to the public; an assessment is to follow once the search ends. The drone's type, its origin and whether it served to reconnoitre the base or for a private flight have not been established; no source confirms that the drone was armed. According to a 22 September investigation by NDR/WDR/Süddeutsche Zeitung, a suspicious substance was found a few metres from the debris, and investigators were examining whether the drone could have carried explosives. Substance testing was not complete. Similarities to the Leipzig/Halle drone were also being examined. The outlets’ sources said the debris might have lain there much longer, possibly about two years. Armament, a link between the finds and the operator remain unconfirmed; 14 September is the discovery date, not an established flight date.
date found, not date of flight
object found
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
2026-09-22: According to a 22 September investigation by NDR/WDR/Süddeutsche Zeitung, a suspicious substance was found a few metres from the debris, and investigators were examining whether the drone could have carried explosives. Substance testing was not complete. Similarities to the Leipzig/Halle drone were also being examined. The outlets’ sources said the debris might have lain there much longer, possibly about two years. Armament, a link between the finds and the operator remain unconfirmed; 14 September is the discovery date, not an established flight date.
near Varėna, flight towards the Kaliningrad region
On Sunday 13 September at about 4:05 military radars detected an object near Varėna that flew 60-70 km over Lithuanian territory and crossed into the Kaliningrad region. Vilmantas Vitkauskas, head of the National Crisis Management Centre (NKVC), said that judging by the recorded parameters it was most likely an unmanned aircraft, presumably from Belarus; without recovering the object, identification remains difficult. The military found no threat to people or infrastructure. The incident is probably linked to the drone recovered a day later from the Baltic Sea near Jarosławiec, Poland (editorial hypothesis, not officially confirmed).
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
Vasilcău, Băxani and Cuconeștii Noi (Moldova); Botoșanița Mare, Suceava County (Romania)
The Romanian Ministry of Defence reported that a drone had crashed in a maize field near Botoșanița Mare in Suceava County. The aircraft had earlier violated Moldovan airspace - it was detected between Vasilcău and Băxani and then near Cuconeștii Noi - before flying into north-eastern Romania. Two Romanian F-16s were scrambled from the 86th Air Base at Borcea and an RO-Alert warning was issued for Botoșani County; no casualties were reported.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
Edighiol-Periboina area, Chituc spit, Constanța County
On 11 September 2026 the Coast Guard reported a suspicious object in the Edighiol-Periboina area on the Chituc spit. At about 17:55 an MApN EOD team spotted from a helicopter the remains of four drones, among them an interceptor drone with explosive material on board; all the items were secured and neutralised. The MApN statement does not say whose the interceptor drone was or where the other aircraft came from; the ministry announced that it remained on heightened alert.
date found, not date of flight
object found
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
Black Sea, about 46 nautical miles east of Midia, in Romania's exclusive economic zone
On 11 September 2026 at about 16:00 a merchant vessel reported two drone fragments floating in the Black Sea about 46 nautical miles east of Midia, outside territorial waters in Romania's exclusive economic zone. A Coast Guard patrol vessel recovered both; they posed no pyrotechnic hazard. The position is given only as a distance from the shore, so the point on the map is indicative. MApN gave neither the type nor the origin of the aircraft.
date found, not date of flight
object found
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
On 11 September 2026 at about 09:30 the Border Police found two drone fragments on Periteașca beach. One contained an explosive charge and was safely neutralised at about 15:18 by an SRI pyrotechnic team; the Coast Guard took the other away. Nobody was hurt. MApN, which described the find in its statement on four incidents that day, gave neither the type nor the origin of the aircraft.
date found, not date of flight
object found
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
Câșla Vădanei beach, between Sulina and Sfântu Gheorghe, Tulcea County
On 11 September 2026 at about 13:30 an MApN EOD team assessed two drone fragments washed up on Câșla Vădanei beach, between Sulina and Sfântu Gheorghe, and established that they carried no explosive charge. It was one of four finds the ministry described that day in a single statement on the coast and the Ukrainian border; it gave neither the type nor the origin of the aircraft.
date found, not date of flight
object found
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
On Wednesday 9 September 2026 at about 20:00 drone debris was reported on Corbu beach in the Capu Midia area; because of darkness the site was cordoned off and the intervention postponed until morning. On Thursday 10 September at about 09:30 a Navy EOD team checked the fragments, established that they carried no explosive charge and neutralised them on site. One piece was about a metre long with visible wiring, the other, apparently a wing, lay a hundred metres away; specialists are to examine the debris. MApN gave no origin.
date found, not date of flight
object found
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
Transnistria, Chișinău and Nisporeni (Moldova); Târgu Neamț, Iași and the counties of Botoșani, Iași, Neamț, Suceava and Vaslui (Romania); crash near Mihăilenii Vechi, Rîșcani District
A Russian jet-powered drone identified as a Geran-4 entered Transnistrian airspace after 16:00 and turned towards Chișinău exactly as an aircraft carrying President Volodymyr Zelensky was taking off from the city's airport for Norway - Moldovan authorities confirmed that the plane was at risk of being hit. The drone flew 120 km into Romania, turned back over Târgu Neamț and passed over Iași among other places (the airport there was closed and RO-Alert warnings were issued in five counties), before returning over Moldova and crashing in a sunflower field near Mihăilenii Vechi, starting a fire. Two Spanish F/A-18s on a NATO Air Policing mission failed to intercept it, and 11 other NATO aircraft did not detect the drone on its flight from Crimea.
airspace incident, airport disruption
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Munich, construction site near the Rohde & Schwarz and Helsing headquarters
On the night of 3 September 2026, incendiary devices were thrown from a car onto a construction site near the Rohde & Schwarz and Helsing headquarters in Munich. Police extinguished the fire; another device failed to ignite and was made safe. Two Bulgarian nationals were detained. Damage was minor and no casualties were reported. A Rohde & Schwarz spokesperson told BR that the company’s own premises were unaffected. This was not the destruction of a drone factory. On 25 September, FAZ, as reported by DW, cited German security sources linking the attack to the GRU. This is a journalistic account of suspicion, not a directly reviewed official finding of responsibility or a verdict. Fakti’s account of the same publication is not independent corroboration. Exact event coordinates have not been established; the entry has no map point.
arson
suspected. Someone has named a perpetrator, but this is neither a court finding nor a formal attribution by a state.
FAZ, relacja Deutsche Welle / 2026-09-25: DW reports a FAZ article of 25 September citing unnamed German security sources linking the arson to the GRU. The original FAZ text was unavailable for direct review.
2026-09-25: DW reports a FAZ article of 25 September citing unnamed German security sources linking the arson to the GRU. The original FAZ text was unavailable for direct review.
No coordinates - this record has no point on the map.
/ Finland
Porvoo, southern Finland
A Russian civilian-type Geoscan 701 surveillance drone was found in Porvoo, southern Finland, after Russia gave advance notification to Helsinki authorities.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Field at Viișoara, Vaslui County, 30 km from the border with Moldova
A damaged drone was found by a resident in a field outside the built-up area of Viișoara commune in Vaslui County, 30 km from the border with Moldova. The authorities established that the drone contained explosives, sealed off the area, and counter-terrorism specialists destroyed the machine. The prosecutor's office attached to the Iași Court of Appeal took over the case in order to establish the drone's origin.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
south-eastern Estonia on the Russian border; Ludza and Alūksne municipalities in Latvia; a drone heading for Narva did not enter Estonia
In the early hours of 1 September 2026, according to Estonian Air Force commander Brigadier General Riivo Valge, at about 2am roughly a dozen drones could be seen near Estonia's border while Ukraine was striking targets in western Russia; at about 3am one headed for Narva, ground-based air defence was activated and Turkish fighters were scrambled from Ämari air base, but the drone turned back to Russia without entering Estonia. About half an hour later another drone crossed the border in south-eastern Estonia and circled for a time in the border zone before leaving Estonian airspace; the fighters did not open fire and no drone came down. Public warnings covered eight counties and were lifted before 6am. The same night the Latvian National Armed Forces declared an airspace threat in Ludza municipality (2.00-2.25) and Alūksne municipality (3.37-4.17) and Baltic Air Policing fighters were scrambled; according to Latvian and Estonian media the drone over Alūksne flew on into Estonia, though whether it was the same object has not been officially confirmed. The event spans over a hundred kilometres of border in two countries, so there is no single point on the map; the drones' operator has not been officially established.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
No coordinates - this record has no point on the map.
/ Poland
WB Electronics plant, Skarżysko-Kamienna
Fire destroyed warehouse premises at the WB Electronics plant in Skarżysko-Kamienna. Prosecutors put the loss at at least 15 million zloty. An investigation was opened the same day under articles 130 §1 and §7 of the criminal code in connection with article 163 §1, that is participation in the activity of a foreign intelligence service and arson as a terrorist offence. As at the date of the statement nobody had been charged.
arson
suspected. Someone has named a perpetrator, but this is neither a court finding nor a formal attribution by a state.
Prokuratura Krajowa / 2026-08-31: The prosecutor qualified the act under the article on participation in the activity of a foreign intelligence service against Poland. The qualification speaks of a foreign service, does not name a state, and is not a finding of responsibility.
Prezes Rady Ministrów Donald Tusk / 2026-09-02: The prime minister said there was no doubt this was deliberate arson and an act of sabotage, and that it was likely ordered by Russia, without presenting evidence in his remarks. That is an official suspicion, not a court finding.
On 30 August 2026 a large fire destroyed the warehouse and production hall and part of the office section of the JFG Composites plant on Kasprowicza street in Lublin, a maker of composite parts for aviation and a sub-supplier to Leonardo, owner of PZL-Świdnik; the owner's preliminary estimate of the loss was about 5 million euros. The Lublin Regional Prosecutor's Office opened an investigation under article 163 §1(1) of the criminal code (causing a fire endangering many lives or property on a large scale); the site inspection with a fire expert begun on 31 August was suspended because the structure threatened to collapse. Prosecutors are examining deliberate arson as well as technical failure or spontaneous causes and, at this preliminary stage, neither confirm nor rule out any of them. Prime Minister Donald Tusk said on 2 September that for Lublin there was no such evidence as in Skarżysko-Kamienna, but given the nature of the production deliberate arson could not be ruled out; Interior Minister Marcin Kierwiński said there was no basis to call the fire sabotage or to link it to the Skarżysko fire. The cause remains unestablished and nobody has named a perpetrator.
arson
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
Dnestrovsc in the Transnistrian sector, on the border with Odesa region
On 30 August 2026 at 15:50 the National Army's air operations service detected an aerial object that crossed the state border at Dnestrovsc in the Transnistrian sector, arriving from Lymanske in Odesa region. At 15:59 the object returned to Ukraine by the same route; it was in Moldovan airspace for nine minutes. The defence ministry wrote that the overflight followed that day's Russian air attacks on Ukraine, but gave neither the object's type nor who operated it; media called it a drone. The statement does not mention Romanian airspace - the Malcontent layer's note that the object spent nine minutes over Romania has no support in the source.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Black Sea, about 15-20 nautical miles south-east of Sfântu Gheorghe, outside territorial waters, in Romania's exclusive economic zone
On 27 August 2026 at about 17:55 MRCC Constanța received a distress signal from the Dominican-flagged Progress IV, carrying sugar and clay to Turkey, about 15-20 nautical miles south-east of Sfântu Gheorghe, outside territorial waters in Romania's exclusive economic zone. A fire had broken out on board; in 2.5 m waves the coast guard vessel MAI 0201 and the merchant ship Mohamad B recovered all 12 crew by 20:47, one with a broken arm, with support from ARSVOM tugs. The ship sank the same evening, at 22:04 according to the navigational warning, and 199 containers were left adrift. President Nicușor Dan said in Chișinău that the ship "was struck" but it was not known by whom or with what; defence minister Radu Miruță related that the crew had reported being hit by "some drone". The prosecutor's office at the Constanța Court of Appeal opened an inquiry covering, among other things, the use of an unmanned aircraft carrying explosives and eight counts of bodily harm. What struck the ship, whether anything struck it at all and whether that is linked to the fire has not been established.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
2026-08-28: The prosecutor's office at the Constanța Court of Appeal opened an inquiry into pollution of waters from a ship, destruction or damage of a ship, operation of an unmanned civilian aircraft carrying explosives, and eight counts of bodily harm. Nobody has been named as responsible.
Moldovan airspace; one drone crashed near Chișinău
Early in the morning, on Moldova's national holiday marking the 35th anniversary of independence, five Russian drones entered Moldovan airspace. One crashed near Chișinău, where a local resident found it and alerted the authorities. The incident came during an announced visit to the capital by Presidents Nicușor Dan and Volodymyr Zelensky; President Maia Sandu condemned the violation.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Olimp beach in front of the Steaua de Mare resort, Constanța County
On the morning of 26 August 2026 tourists spotted a drone fragment in the waves off Olimp beach, in front of the Steaua de Mare resort, and alerted the authorities. Police cordoned off an area of about 500 m and closed the beach; IGSU sent an RO-Alert asking people to keep their distance, noting that the operation posed no danger to the public. Sappers established that the fragment carried an explosive charge and detonated it in a pit dug on the beach, among the sunbeds and parasols. Nobody was hurt. The authorities did not say where the drone came from.
date found, not date of flight
object found
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
At about 01:30 on 26 August the sea washed an unmanned aircraft about 2 m long and 1.5 m wide onto Kabakum beach in Varna; the border police cordoned off the area. A team from Naval Base Varna examined the aircraft, found no explosive material and took it to the base, the defence ministry said. It was the last of four finds that night on the Bulgarian coast, alongside Kamchia, Pasha Dere and Pomorie. Defence minister Dimitar Stoyanov said the drones found were mainly Russian Gerbera decoys and Orlan reconnaissance drones, unarmed, carried in by currents; he did not say which object was which, and the operator has not been established.
date found, not date of flight
object found
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Minister obrony Bułgarii Dimityr Stojanow / 2026-08-26: Speaking about the series of finds on 25-26 August, the defence minister said the drones found were mainly Russian Gerbera decoys and Orlan reconnaissance drones, alongside Ukrainian parts and unidentifiable wreckage, and that none carried weapons. He did not say which object was which. That is an assessment of the origin of equipment carried in by currents, not a finding about who flew it or who tasked the flight.
waterfront by the Constanța Casino, among the breakwater blocks
On the evening of 25 August 2026, at about 22:00, passers-by on the crowded waterfront by the Constanța Casino noticed among the breakwater blocks a white, flat fragment washed up by the waves and taken to be part of a drone. Police and firefighters cordoned off the spot, established there was no explosive charge and pulled the fragment out bare-handed; the border police took it for examination to establish its origin. There were no casualties and no damage. No authority has said what aircraft it came from.
date found, not date of flight
object found
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
Between the evening of 25 August and midday on 26 August a Navy team was tasked with examining an object spotted in Black Sea waters off Pomorie. The servicemen found it to be an unmanned aircraft and destroyed it in place at sea, as the defence ministry said in its statement of 26 August, without giving the type or the reason for the destruction. The defence minister said that day that the drones found were mainly Russian and unarmed, without saying which object was which. It was one of four finds that night, alongside Kamchia, Pasha Dere and Kabakum beach; the operator and the flight date have not been established.
date found, not date of flight
object found
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Minister obrony Bułgarii Dimityr Stojanow / 2026-08-26: Speaking about the series of finds on 25-26 August, the defence minister said the drones found were mainly Russian Gerbera decoys and Orlan reconnaissance drones, alongside Ukrainian parts and unidentifiable wreckage, and that none carried weapons. He did not say which object was which. That is an assessment of the origin of equipment carried in by currents, not a finding about who flew it or who tasked the flight.
Between the evening of 25 August and midday on 26 August servicemen from Naval Base Varna examined an unmanned aircraft found in Black Sea waters off Pasha Dere, south of Varna, and detonated it at sea. The defence ministry statement of 26 August gives neither the type nor the reason for the detonation; defence minister Dimitar Stoyanov spoke that day of remains at Pasha Dere and said none of the drones found carried weapons. It was one of four finds that night, alongside Kamchia, Pomorie and Kabakum beach. The operator and the flight date have not been established.
date found, not date of flight
object found
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Minister obrony Bułgarii Dimityr Stojanow / 2026-08-26: Speaking about the series of finds on 25-26 August, the defence minister said the drones found were mainly Russian Gerbera decoys and Orlan reconnaissance drones, alongside Ukrainian parts and unidentifiable wreckage, and that none carried weapons. He did not say which object was which. That is an assessment of the origin of equipment carried in by currents, not a finding about who flew it or who tasked the flight.
Black Sea waters off the Kamchia resort, south of Varna
On the evening of 25 August a team from Naval Base Varna was ordered to examine an object spotted in the water off the Kamchia resort. The servicemen found it to be the wing of a military unmanned aircraft washed out of the sea, without munitions and posing no danger, and took it to the base. It was one of four finds that night on the Bulgarian coast, alongside Pasha Dere, Pomorie and Kabakum beach, covered in a single defence ministry statement of 26 August. The defence minister said of the series that the drones were mainly Russian and unarmed, without saying which object was which; the type of the wing and the operator have not been established.
date found, not date of flight
object found
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Minister obrony Bułgarii Dimityr Stojanow / 2026-08-26: Speaking about the series of finds on 25-26 August, the defence minister said the drones found were mainly Russian Gerbera decoys and Orlan reconnaissance drones, alongside Ukrainian parts and unidentifiable wreckage, and that none carried weapons. He did not say which object was which. That is an assessment of the origin of equipment carried in by currents, not a finding about who flew it or who tasked the flight.
Ciușlea, Vrancea County (possibly via Moldovan airspace, heading towards Târgu Bujor)
The Moldovan army detected a drone entering from the direction of Vynohradivka; the object headed towards Vulcănești, airspace over southern Moldova was closed for 15 minutes, and at 06:09 the drone flew on towards Vlădești in Galați County. At about 06:00 Romanian systems detected an object near the border, at 06:12 the public was alerted, and the drone crashed into a walnut tree 5 m from a house in the village of Ciușlea in Vrancea County; an area of 300 m was evacuated until it was confirmed that the drone carried no explosives. Two Romanian F-16s and an IAR-330 SOCAT were scrambled, and the alert ended at 08:52.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
A floating fragment of a Gerbera drone containing explosives was neutralised in the Black Sea off Gura Portiței in Tulcea County by Romanian Navy divers, who were brought to the site by a Coast Guard vessel.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
Late in the evening of 22 August 2026 the anti-crime unit of the Office for Combating Organised Crime (ÚBOK), acting on information from Slovakia's SIS and military intelligence received in July, foiled a planned arson attack on the drone plant of the Ukrainian company Skyeton at Haniska near Prešov. No fire was set; police seized a large quantity of an incendiary mixture of petrol and polystyrene (a form of napalm), tools, phones, an action camera and a hand-drawn plan of the plant. About 70 people work in the hall in continuous shifts. Three foreign nationals (Latvian and Ukrainian citizens) were charged with preparing an especially serious crime of public endangerment "on commission"; the Prešov court remanded two on 27 August, the third was detained in Germany on a European arrest warrant, and a fourth person was detained in Košice on 28 August. Police president Jana Maškarová said on 28 August that police had for now no evidence that Russia was behind the preparation, and that the authenticity of a claim by a group calling itself "Global Citizens Against War 1984" was being checked. That police statement did not identify who commissioned the attack. Malcontent's pin (48.62, 21.25) marks a different Haniska, near Košice. Reports of a FAZ article of 25 September raised suspicion of a link to the GRU and the group suspected of the Munich arson. This is a journalistic finding, not a newly reviewed ruling by Slovak police. The earlier police position of 28 August is retained as a historical statement; the intervention date remains 22 August. On 15 October 2026, a Latvian national previously detained in Germany was handed over to Slovakia under a European Arrest Warrant. On 16 October, the Prešov court remanded him because of the risk of flight and continued criminal activity; according to its spokesperson, the decision is not final and can be appealed. This is a further stage of the case foiled on 22 August, not a new attack, verdict or new finding of Russian commissioning. The fourth detainee recalled in the reports is the known August arrest, not an additional October arrest.
arson
suspected. Someone has named a perpetrator, but this is neither a court finding nor a formal attribution by a state.
FAZ, relacja Fakti / Focus / 2026-09-25: According to Fakti’s account of a FAZ article, the GRU-linked group suspected of the Munich arson also planned the attack on Skyeton near Prešov. This is an indirect report based on unnamed German security sources, without a newly reviewed official statement from Slovak investigators.
2026-08-27: The Prešov District Court remanded a Latvian and a Ukrainian national in custody.
2026-08-28: A fourth person, a Ukrainian national, was detained in Košice.
2026-08-28: Prezydent Policji Republiki Słowackiej Jana Maškarová: Police said the attack was being prepared on commission but that there is for now no evidence Russia was behind it; the authenticity of a claim by a group calling itself "Global Citizens Against War 1984" is being checked. The investigation into who ordered it continues.
2026-09-25: According to Fakti’s account of a FAZ article, the GRU-linked group suspected of the Munich arson also planned the attack on Skyeton near Prešov. This is an indirect report based on unnamed German security sources, without a newly reviewed official statement from Slovak investigators.
2026-10-16: On 15 October 2026, a Latvian national previously detained in Germany was handed over to Slovakia under a European Arrest Warrant. On 16 October, the Prešov court remanded him because of the risk of flight and continued criminal activity; according to its spokesperson, the decision is not final and can be appealed. This is a further stage of the case foiled on 22 August, not a new attack, verdict or new finding of Russian commissioning. The fourth detainee recalled in the reports is the known August arrest, not an additional October arrest.
From the village of Krutoyarivka in Odesa Oblast towards Caplani, Ștefan Vodă District
At 04:07 the Moldovan army recorded an airspace violation from the direction of Ukraine, from the village of Krutoyarivka in Odesa Oblast. The drone was preliminarily identified as a Geran-3; it headed towards the village of Caplani in Ștefan Vodă District and left Moldovan airspace at 04:24.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
Defence Minister Antti Häkkänen said that in the afternoon a Russian Il-20M aircraft violated Finnish airspace over the Gulf of Finland, south of the island of Utö. The aircraft remained over Finnish territory for about three minutes, coming as close as roughly 4.7 nautical miles to the coast; the Russian ambassador was summoned over the incident.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Black Sea, Romania's exclusive economic zone, near the Neptun Alpha platform (Neptun Deep project), about 80 nautical miles east of Constanța
On 20 August 2026 at about 06:28 a merchant vessel reported a small drifting sea drone in Romania's exclusive economic zone, near the Neptun Alpha platform of the Neptun Deep gas project, about 80 nautical miles east of Constanța. Two F-16s were scrambled; one fired its cannon at the object and hit it without destroying it completely. EOD personnel from a navy ship that reached the site neutralised the drone; after analysing the aircraft data MApN confirmed there had been a single object and that it carried explosives. Defence minister Radu Miruță spoke of protecting the several hundred people working on the platform and said the Ukrainian side had confirmed through a direct channel that the drone was not Ukrainian. Where it came from and who sent it has not been established.
date found, not date of flight
object found
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
Field near Grindu, Tulcea County, about 13 km from Galați
At 02:23 Moldovan surveillance systems detected a group of drones close to the Ukrainian-Romanian border; two Spanish F/A-18s and a Romanian IAR-330 were scrambled, and at 03:20 the public was alerted. A minute later a drone violated Romanian airspace about 13 km east of Galați, and at 03:24 the helicopter crew reported it had crashed 4 km northeast of Grindu, where a fire broke out and went out by itself. The alert was lifted at 03:52 and the debris was secured by the border guard.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
Moldovan airspace; near the Giurgiulești-Reni border crossing
At 03:16 Moldova's armed forces detected an unauthorised entry into the airspace from the Ukrainian side near the village of Kotlovyna; the drone, identified as a Geran-2, headed towards the village of Etulia and left Moldova at 03:22. At about 03:45 the explosion of a drone on the Ukrainian side started a fire 150 m from the Giurgiulești-Reni border crossing, which spread across 70-100 m² of Moldovan territory and was put out at about 04:30. Debris from another Geran-2 drone was found 1 km from the border at Giurgiulești.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
Arsin District Police Department, Trabzon Province
A stray drone crashed and exploded in the yard of the Arsin District Police Department in Trabzon Province. Social media footage indicated it had FPV drone characteristics rather than a fixed-wing pattern.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
In the afternoon a Russian cruise missile crashed in Moldova, 3 km from the village of Talmaza; police and emergency services put out the fire caused by the explosion. According to the Ukrainian Air Force it was an S8000 Banderol missile tracked over Odesa, though Moldova's defence ministry did not link it to that tracked object. Airspace over the Centru sector was closed for 15 minutes. Shortly before the incident President Maia Sandu said some Russian drones enter Moldovan airspace deliberately, to test the response.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Between Galați and the border region, having transited Moldovan airspace
A Russian Geran-2 drone violated Moldovan airspace from the Ukrainian side: at 04:31 it was recorded over the village of Etulia in Gagauzia, at 04:44 Romanian systems detected a violation about 24 km north of Galați, and at 04:49 the drone left Moldova. Two Spanish F-18s from the 57th Air Base at Mihail Kogălniceanu were scrambled as a precaution, and at 05:01 one of them shot the drone down; debris fell near the communes of Băleni and Cudalbi. The same day an unarmed drone was found 1.5 km from Constanța.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Milrem Robotics, Betooni Street, Lasnamäe, Tallinn
On the night of 15 August 2026, a building used by Milrem Robotics on Betooni Street in Tallinn was set on fire. The fire was quickly brought under control; the government said no lives were endangered. The extent of damage was not stated. On 29 September, Estonia’s government officially attributed the sabotage to Russian special services on the basis of KAPO intelligence. Three suspects were detained in Latvia on 17-18 August and handed over to Estonia on 17-18 September. The criminal investigation continues. Milrem supplies THeMIS unmanned ground vehicles to Ukraine. Attribution is grade B: an official finding, without a judgment or identification of a specific Russian service. The entry date records the arson, not the release date. No verified coordinates are available; the entry has no map point.
arson, infrastructure sabotage
officially attributed. A court or a competent state body has attributed it. That is not the same as a proven attack: an indictment is an allegation, not a verdict.
Rząd Estonii / KAPO / 2026-09-29: Estonia’s government: on the basis of KAPO intelligence, the Milrem arson was sabotage commissioned by the Russian Federation’s special services. The criminal investigation continues.
2026-09-29: Estonia’s government: on the basis of KAPO intelligence, the Milrem arson was sabotage commissioned by the Russian Federation’s special services. The criminal investigation continues.
No coordinates - this record has no point on the map.
/ Romania
Field near Luncavița, Tulcea County
A Russian drone entered Romanian airspace shortly after 11:00 and crashed in a field near the village of Luncavița, close to Brăila and Galați; the crash and explosion started a vegetation fire that was quickly put out. The drone was not picked up by radar because it was flying low. The same day, debris from another drone of unknown origin was found at Plauru, right by the border.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
An unidentified drone entered Latvian airspace in the Balvi region as a result of Russian electronic warfare during a Ukrainian attack on Russian ports. Two Italian Eurofighters from Šiauliai and two Turkish F-16s from Ämari, both on the Baltic Air Policing mission, were scrambled, and the drone was shot down at high altitude by the Italian Eurofighter near Rugāji. Finland restricted airspace over the eastern part of the Gulf of Finland at the time.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Three Russian drones violated Romanian airspace within twelve hours, with no collisions recorded: the first was reported at 01:27 (10 minutes of flight over Romania), the second at 09:02 (2 minutes) and the third at 15:17 (12 minutes). Romanian F-16s were scrambled for the first two incidents and Spanish F/A-18s for the third.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
An unidentified drone that could neither be tracked nor jammed appeared over Hanover airport, halting traffic temporarily; the runways and the airspace were closed repeatedly for more than two hours. The authorities suspected a link to several Russian drones seen in Germany a week earlier.
airspace incident, airport disruption
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Another drone entered Moldovan airspace during a Russian attack on Odesa Oblast and was identified as a Geran-3 (Shahed-238) before returning to Ukraine.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
A Russian drone crashed and exploded near the village of Crocmaz; the blast broke windows in several houses and started a vegetation fire, causing damage within 800 metres. Preliminary reports indicated it may have been an S8000 Banderol cruise missile, the first of its kind in Moldova; the identification remains preliminary. Prime Minister Vasile Tofan condemned the war, Moldova recalled its ambassador from Moscow for consultations, and the Russian embassy accused Chișinău of using the incident to worsen relations.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Field near the Kardam border crossing, Dobrich Province (entered from Romania)
Prime Minister Rumen Radev announced that a drone entered Bulgarian airspace from Romania and exploded in a field near the Kardam border crossing, 100 m from the border, 200 m from a compressor station in Romania and 1,000 m from a second compressor on the Trans-Balkan pipeline. There were no casualties and no damage, and neither country detected the drone on radar. A preliminary analysis of the debris pointed to a Ukrainian Maya decoy drone; Ukraine denied deliberately directing any such device towards Bulgaria.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
Bundeswehr base at Mechernich, near the Belgian border
Two drones overflew a German military base at Mechernich near the Belgian border. The Bundeswehr facility houses defence equipment and Patriot system maintenance operations.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
outskirts of the village of Văleni, Cahul district
On 5 August 2026 fragments of an unmanned aircraft were found on the outskirts of Văleni village, Cahul district. The General Police Inspectorate said that after a preliminary examination of construction features, materials and markings specialists identified them as debris of a Geran-2 type drone; all fragments were documented and seized for expert examination, and the police technical-explosives unit is handling the case. The foreign ministry condemned the airspace violation as a further breach of Moldova's sovereignty and territorial integrity and a serious risk to citizens' safety. The day of the find is what is recorded; the sources do not say when the drone arrived or whether it carried explosive, and name no operator. No casualties were reported.
date found, not date of flight
object found
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Inspectoratul General al Poliției / 2026-08-05: Police identified the fragments as debris of a Geran-2 type drone from construction features, materials and markings. That identifies the type of equipment, not who flew it or who tasked the flight; the foreign ministry condemned the violation but named no operator.
On 4 August 2026, an explosive-laden drone was used in an attempted attack on a Ukrainian transport aircraft at Leipzig/Halle Airport. According to the NDR/WDR/Süddeutsche Zeitung investigation, one drone bomb hit a parked aircraft but did not explode. On 1 September, Germany’s government officially attributed the attack to Russia; the Foreign Office’s transcript of 2 September confirms this position and the event date. The government cited technical, police and intelligence findings without releasing the full evidence. A separate journalistic investigation of 15 September describes suspected logistician Oleg L. and his longstanding contacts with GRU Colonel Denis Smoljaninov. The contacts and suspected roles are journalistic findings, not a verdict. The official attribution concerns this attempted attack; it is not automatically applied to every other object reported near the airport. The Telegraph/Welt investigation of 2 October expands the suspects’ names: Oleg Levushkin and Andrei Karshakou. The new details of their roles and evidence remain journalistic findings.
airspace incident, transport sabotage
officially attributed. A court or a competent state body has attributed it. That is not the same as a proven attack: an indictment is an allegation, not a verdict.
Rząd Niemiec, transkrypt Auswärtiges Amt / 2026-09-01: On 1 September Germany’s government officially attributed the attempted Leipzig attack to Russia. The 2 September transcript cites technical, police and intelligence findings; the full evidence was not presented publicly.
NDR / WDR / Süddeutsche Zeitung / 2026-09-15: NDR/WDR/Süddeutsche Zeitung describe suspected logistician Oleg L. and his contacts with GRU Colonel Denis Smoljaninov, citing security sources and documents. These are journalistic findings about suspects, not a court ruling.
The Telegraph / Welt am Sonntag / 2026-10-02: The Telegraph/Welt investigation identifies Oleg Levushkin as the suspected organiser and Andrei Karshakou as the suspected executor. It describes reconnaissance and matching DNA on a glove fragment at the antenna. These are journalistic findings, not a verdict.
2026-09-01: On 1 September Germany’s government officially attributed the attempted Leipzig attack to Russia. The 2 September transcript cites technical, police and intelligence findings; the full evidence was not presented publicly.
2026-09-15: NDR/WDR/Süddeutsche Zeitung describe suspected logistician Oleg L. and his contacts with GRU Colonel Denis Smoljaninov, citing security sources and documents. These are journalistic findings about suspects, not a court ruling.
2026-10-02: The Telegraph/Welt investigation identifies Oleg Levushkin as the suspected organiser and Andrei Karshakou as the suspected executor. It describes reconnaissance and matching DNA on a glove fragment at the antenna. These are journalistic findings, not a verdict.
An unmanned aerial vehicle crashed in the village of Örhenli after losing communication with its operator. Authorities recovered the wreckage for analysis.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
56 km north-west of Koszalin; 60 km north-west of Łeba
Defence Minister Władysław Kosiniak-Kamysz said that two Polish fighter jets had intercepted a Russian Il-20M reconnaissance aircraft 56 km north-west of Koszalin before noon. A similar incident had occurred the previous day, when Polish aircraft intercepted an Il-20 60 km north-west of Łeba; the aircraft was flying in international airspace without a flight plan and with its transponder switched off.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Romanian territorial waters and the Sulina branch of the Danube
Romania's defence ministry said two F-16s were scrambled after a Russian drone was detected over territorial waters during an attack on southern Ukraine. The drone flew along a branch of the Danube for about 20 minutes and then returned to Ukraine, where it was shot down; its debris fell in a field near Periprava, 1 km from the border. An air alert was issued for Tulcea County.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
During a Russian attack on Lviv a missile was detected near the border and turned back; then, at about 03:46, radar detected another missile in Polish airspace. F-16s were scrambled, but the missile disappeared from radar, flew 92 km and exploded in a field near Tarnawa-Kolonia. Identification was complicated by the presence of Ukrainian MiG-29s with similar radar signatures; sirens sounded in Lublin, Krasnystaw and across the voivodeship. Prime Minister Donald Tusk said debris scattered over a 200 m radius allowed the missile to be identified as a Kh-101.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Another Russian drone briefly entered Romanian airspace on 27 July and quickly returned to Ukraine before it could be intercepted.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
A Romanian F-16 shot down a third drone: the target was destroyed at 10:13 over Romanian territorial waters, 12 km northeast of Sulina, five minutes after it entered the airspace. After a third violation in three days the foreign minister Oana Țoiu summoned the Russian ambassador and lodged a firm protest, Romania's ambassador in Moscow was recalled, and on 27 July a member of the Russian embassy staff was declared persona non grata.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
At 06:21 radar northwest of Snake Island identified a group of drones during an attack on Ukrainian infrastructure, and two Romanian F-16s were scrambled in response. At 08:22 one of the drones entered Romanian airspace, and 11 minutes later the same pilot who had shot down a drone the day before neutralised another over an uninhabited area of Sfântu Gheorghe commune close to the Ukrainian border.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
At 09:39 Romanian radar detected an air target 20 km from Sulina; two Italian Eurofighters, two Romanian F-16s and an IAR 330 SOCAT were scrambled. The drone, identified visually as a Shahed, flew over Romania for about one hour and twenty minutes; the Eurofighter's first missile missed, and at 11:02 a Romanian F-16 neutralised the drone near Padina. It was the first drone shot down in Romanian airspace, and the Prosecutor General's Office confirmed the following day that the machine was of Russian origin.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Karaburun shore, Arnavutköy district, Istanbul (between Karaburun beach and Ormanlı beach in Çatalca)
On Sunday 19 July walkers noticed a broken-up object on the shore between Karaburun beach in Arnavutköy and Ormanlı beach in Çatalca and alerted the authorities. Teams of the Coast Guard Marmara and Straits Regional Command and the Underwater Defence Group (SAS) arrived; SAS commandos assessed it as the wreckage of a kamikaze-type strike drone, found explosive material on it and destroyed it in a controlled detonation. That is how the DHA and IHA agencies reported it; no official statement by the Coast Guard or the governorate was found. The type, origin and operator of the aircraft were not given.
date found, not date of flight
object found
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
During a night attack on the Odesa region, at 01:03 a Russian drone violated Moldovan airspace and crashed near Copanca in Căușeni district, about 30 km from the border; a fire broke out and residents of a nearby building were evacuated. Moldova's defence ministry confirmed the violation and objected to the repeated incidents; the head of the regional emergency department Igor Calancea said the preliminary identification was a Geran-2 carrying about 50 kg of explosive.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Near Lopatna, 55 km northeast of Chișinău, by the Dniester
Moldova's defence ministry said a drone bearing Ukrainian markings crossed the border at 00:20 and then crashed and exploded in a field near the village of Lopatna, 55 km northeast of Chișinău. Ukrainian origin was indicated at first, but the Ukrainian foreign minister Andrii Sybiha said it was another Russian decoy drone. The incident came hours after President Maia Sandu called for counter-drone systems to be strengthened.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
French Rafale fighters on NATO air policing duty shot down a Ukrainian Maya decoy drone over the village of Bērzgale after it entered Latvian airspace from Russia, having strayed because of electronic warfare.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
On the night of Sunday 7 to Monday 8 June Vilnius Airport restricted traffic from 01:18 to 04:00 after navigation traces typical of balloons were detected in areas risky for aviation. According to Lithuanian Airports (via LRT/BNS) 5 flights and about 453 passengers were affected: 4 aircraft were diverted (2 to Kaunas) and 1 flight was cancelled. NKVC head Vilmantas Vitkauskas spoke of five balloons recorded over the Vilnius and Salcininkai districts, not very intense in number, but crossing the landing approach path. The operator called the restriction a response to a hybrid attack by Belarus. Delfi's headline speaks of six flights; 5 is adopted after LRT/BNS. Who launched the balloons has not been established.
airspace incident, airport disruption
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
On 5 June 2026 at 10:27, a Ukrainian maritime drone exploded at berth 78 in Constanța port. Three further explosions at sea were confirmed at 11:05; that is the confirmation time, not an established time for all detonations. According to a presidential administration response dated 17 August and published by PRO TV on 28 September, Ukrainian forces had lost four drones and an automatic self-destruction mechanism caused the blast. The area around the drone was evacuated beforehand. The administration reported no casualties or significant damage. Its preliminary assessment supports the hypothesis that Russia took control; the investigation and technical findings remain incomplete. This is not final attribution. Ukrainian origin does not establish who controlled the device at the time.
infrastructure disruption
suspected. Someone has named a perpetrator, but this is neither a court finding nor a formal attribution by a state.
Administrația Prezidențială, odpowiedź dla PRO TV / 2026-08-17: Romania’s presidential administration, in its 17 August response reported by PRO TV on 28 September: preliminary hypothesis of Russia taking control; further technical details remain to be established.
2026-08-17: Romania’s presidential administration, in its 17 August response reported by PRO TV on 28 September: preliminary hypothesis of Russia taking control; further technical details remain to be established.
A drone carrying a 5 kg warhead was found in a field in Võru County, southern Estonia. Officials said it might be one of the drones spotted during a Ukrainian attack on north-western Russia; neither its model nor its origin was confirmed, and Defence Minister Hanno Pevkur called on Ukraine to keep better control of its drones.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
On Saturday 30 May 2026, during the Whitsun holiday rush, shortly after 9am two flight crews independently reported a suspected drone over Munich Airport to the tower. In coordination with Deutsche Flugsicherung both runways were closed and take-offs and landings suspended; federal and state police searched the grounds, including from a helicopter. The alert was lifted at about 10.05am and the first aircraft landed at 10.24am. According to the airport operator about 20 aircraft were diverted to other airports, among them Frankfurt, Nuremberg and Vienna; t-online reported 26 diversions in total and about 40 aircraft waiting for take-off. A Federal Police spokesperson said nothing was found and no danger was identified. Proceedings against unknown persons for dangerous interference with air traffic were opened; whether a drone was actually there has not been established.
airport disruption, airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
During a Russian attack on Ukrainian ports, radar detected several drones near the border; two F-16s and an IAR 330 SOCAT helicopter were scrambled. One Russian Shahed drone entered Romanian airspace and struck a residential building in Galați: at least two people were injured, about 70 were evacuated and five cars were damaged. The foreign ministry summoned the Russian ambassador, the Russian consul-general in Constanța was declared persona non grata and the consulate was ordered closed; Romanian technical examination and SHAPE confirmed it was a Russian Geran-2 drone.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
The Finnish Defence Forces reported that a Russian aircraft violated Finnish airspace off Porkkala in the Gulf of Finland while taking a safe route around a thunderstorm.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
A drone came down into Lake Drīdzis in Kombuļi rural municipality and exploded on impact. A search operation was launched involving a State Police drone, a fire service boat and soldiers of the National Armed Forces; debris from the drone was reportedly found.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
Lithuanian border guards at the Purvėnai post shot down a home-made drone that had come from Belarus, after an alert from the Lithuanian Air Force. The drone, probably belonging to smugglers, was neutralised as it approached the post at Eišiškės; it came down near the village of Dumblė. Since the start of 2026, 18 drones carrying smuggled goods had been brought down, against 59 in 2025.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
Lithuania issued a "red" air warning after a drone violated its airspace, the first of its kind since the restoration of the Lithuanian state. Air traffic in Vilnius, rail services in the capital and the opening of shops were suspended, and residents in part of the country were told through the alert system to take shelter. Attempts by NATO aircraft to shoot the drone down failed.
airspace incident, airport disruption
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
A Russian drone entered Latvian airspace, triggering an alert in the border region. The incident halted rail traffic, interrupted ninth-grade school examinations and closed shops; the authorities were not sure whether it was the same drone that Estonian forces later shot down. Latvian authorities subsequently stated that they had found no evidence of a drone incursion into their airspace.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
A Ukrainian drone was shot down by a Romanian F-16; two Romanian aircraft of the "Carpathian Vipers" squadron, flying the Baltic Air Policing mission, were scrambled by the Combined Air Operations Centre at Uedem. It was the first time during the war that a drone was shot down over Estonia by NATO aircraft. Ukraine's defence minister Mykhailo Fedorov apologised for the incident.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The Latvian armed forces issued air alerts along the border with Russia while NATO aircraft searched for an intruding drone, which eventually left the airspace.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The National Crisis Management Centre reported the discovery, in the evening, of a drone wreck in the village of Samanė in Utena district; explosives found at the site were neutralised. On 21 May the defence minister Robertas Kaunas said the drone belonged to Ukraine, that its target was in Russia, and that the most likely cause of its deviation was Russian electronic warfare systems.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
A UAV crashed in the city of Samsun, damaging two buildings. Turkish authorities identified it as a Ukrainian Maya decoy drone that had probably suffered a technical malfunction.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
overflight of Moldova from north to south: from Sauca (Ocnița District) via Bălți and the districts of Ungheni, Hîncești and Cahul to Giurgiulești
On 13 May 2026 at 16:00 an unmanned aerial vehicle crossed the border from the direction of Mohyliv-Podilskyi towards Sauca village in Ocnița District, was over Bălți at 16:05, then over the districts of Ungheni and Hîncești (Lăpușna 16:19, Cărpineni 16:23), dropped off radar near Mingir at 16:26, reappeared near Colibași in Cahul District at 16:55 and vanished near Giurgiulești after 16:58. The National Army's air operations service tracked it throughout the flight. For the safety of civil flights the airspace in the North and Centre zones was temporarily closed; according to the Civil Aviation Authority it reopened at 16:59 and operations were kept at an acceptable level of safety. Moldova's foreign ministry called the overflight an unacceptable violation of sovereignty and territorial integrity. Neither the foreign nor the defence ministry gave the vehicle's type or said who operated it.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
In the early hours of Wednesday 13 May Vilnius Airport halted traffic for one hour, from 02:16 to 03:16, after navigation signals characteristic of balloons were detected in areas sensitive to air traffic. According to Lithuanian Airports (via LRT/BNS) 2 flights and about 128 passengers were affected: one aircraft was diverted to Copenhagen and one flight was cancelled. The operator called the restriction a response to a hybrid attack by Belarus against Lithuania, civil aviation and the public. The sources give no balloon count; who launched the balloons has not been established.
airspace incident, airport disruption
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
A Russian reconnaissance drone marked with Cyrillic inscriptions and equipped with cameras fell near the village of Oseka in Warmian-Masurian Voivodeship. Authorities said it carried no explosives and posed no threat.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
An undetermined number of drones entered Latvian airspace from Russia; one hit an oil storage depot at Rēzekne, setting it on fire and damaging four empty tanks, and another crashed elsewhere. French military aircraft were scrambled. The Russian defence ministry claimed Ukraine had used Latvian airspace, while the Ukrainian foreign minister Andrii Sybiha said the drones had ended up over Latvia because of Russian electronic warfare.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
sea cave near Cape Doukato (Lefkatas), Lefkada, Ionian Sea
On 7 May fishermen spotted a black uncrewed surface vessel with its engine running and nobody aboard in a sea cave near Cape Doukato on Lefkada; they towed it to the port of Vasiliki, where the Coast Guard and then the defence ministry took custody. According to Reuters, preliminary examination found three detonators; defence minister Nikos Dendias said on 12 May that the government was certain the vessel was Ukrainian, the case was referred to a prosecutor, and Greece raised it with the Ukrainian defence minister. A mid-May report by the EYP and GEETHA found that the vessel lost its orientation through a navigation failure and drifted out of control; Skai reported from the report about 100 kg of explosives and an announced demarche to Kyiv. The launch point, the target and the operator have not been officially established.
date found, not date of flight
object found
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Minister obrony Grecji Nikos Dendias / 2026-05-12: The defence minister said the government was certain the vessel was Ukrainian and raised it with the Ukrainian defence minister, who promised explanations about its purpose and handlers. That is a finding about whose equipment it was; the EYP and GEETHA report speaks of a navigation failure and drift, not of an intended act against Greece. The operator, launch point and target have not been officially established.
2026-05-15: EYP and GEETHA report: the vessel lost its orientation through a navigation failure and drifted; launch point and target not established.
2026-05-29: Skai, citing the GEETHA report: about 100 kg of explosives, detonators removed; an official demarche by Athens to Kyiv announced.
Near Șerbăuți, Suceava County, about 20 km from the Ukrainian border
An unmarked drone carrying no explosives came down about 20 km inside Romanian territory, near the village of Șerbăuți in Suceava County; a local resident found it and alerted the authorities. It was the third violation of Romanian airspace across the northern stretch of the border with Ukraine since the start of the conflict.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
On 3 May 2026, two drones were sighted over Virolahti near the border before flying from Finland into Russia. The police statement of 9 September confirms unauthorised entries but no findings indicating an intention to violate Finnish airspace. These sightings are not equated with the forensic findings on four UAVs recovered in spring. The preceding entry direction and operator remain undetermined here. The former entry also named Hamina and a three-hour airspace closure; the new statement does not confirm those details. Exact coordinates are unavailable; the entry has no map point.
airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
NBI / Finnish Border Guard / 2026-09-09: No indication of an intention to violate Finnish airspace was found; the May UAVs’ operator remains undetermined in this entry.
2026-09-09: Police clarified the flight over Virolahti and onward into Russia; no indication of intent to violate airspace.
No coordinates - this record has no point on the map.
/ Romania
Chilia Veche area, northern Tulcea County
During the night of 1 to 2 May 2026 MApN radars detected a group of twenty drones, which the ministry said belonged to the Russian Federation, heading for the Izmail area. At about 02:00 two F-16s on combat air-policing duty were scrambled from the 86th Air Base at Fetești. Ground radars detected one drone briefly entering Romanian airspace in the Chilia area before continuing towards Izmail. At 02:03 an RO-Alert went out for northern Tulcea County; the alert was lifted at 02:50. MApN noted numerous explosions on the Ukrainian bank of the Danube; nothing fell on Romanian territory.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
field near the village of Băneștii Noi, Telenești district
On 29 April 2026 residents of Băneștii Noi village, Telenești district, alerted police to a drone-like object lying in a field. The General Police Inspectorate said all parts of the aircraft were collected, that they posed no danger and that they would go for expert examination to establish their structure and origin. The same day the defence ministry stated that the aircraft matches the trajectory and characteristics of the target tracked on 30 March 2026: detected at 21.29 after crossing the border from the direction of the Odesa region and lost from radar at 22.03 over Orhei district. The day of the find is what is recorded. The sources give neither the drone's type nor its operator; no casualties were reported.
date found, not date of flight
object found
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Bariera Traian quarter, Galați; second drone near Văcăreni, Tulcea County
A Russian drone entered Romanian airspace and damaged a house and a power pole in the Bariera Traian quarter of Galați, the first occasion on which a Russian drone caused property damage in Romania. A second drone carrying explosives was identified near Văcăreni and destroyed by an SRI pyrotechnics team. The Russian ambassador was summoned.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
During a wave of Russian drone attacks on Ukraine on the night of 16-17 April, Romanian military radar detected an airspace violation over the border village of Chilia Veche.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Two Polish F-16s were scrambled to intercept an Il-20 reconnaissance aircraft flying over the Baltic Sea with its transponder switched off and no filed flight plan. A similar incident occurred on 8 April 2026.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
On the night of 9 to 10 April Vilnius Airport restricted traffic from 22:30 to 03:30 because of smugglers' balloons from Belarus; the restriction was first announced until 01:30 and then extended, and full operations resumed at 05:15. According to the NKVC (Darius Buta, via LRT) up to 20 navigation traces typical of smugglers' balloons were recorded that night, and in the assessment of the experts managing the airspace over the airport at least some of the balloons were directed almost straight into the airport's airspace. LRT reports: 9 flights cancelled, 5 delayed, 8 diverted to Kaunas and 2 to Riga, more than 3,000 passengers. Lithuanian Airports called the restriction a response to a hybrid attack by Belarus. Who launched the balloons has not been established.
airspace incident, airport disruption
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
electricity installations at La Chapelle-Saint-Ursin, Bourges and Saint-Florent-sur-Cher (Cher)
On the night of 6 to 7 April 2026 three electricity installations around Bourges were set on fire: a high-voltage substation at La Chapelle-Saint-Ursin, a transformer at Saint-Florent-sur-Cher and a pylon near the MBDA plant in Bourges. According to the Cher prefecture these were "coordinated acts of particular gravity": two transformers and a pylon were destroyed, about 3,000 households lost power for the night, the damage was put at several million euros and repairs could take several months; Enedis restored supply provisionally. The installations fed networks serving the KNDS and MBDA arms plants; the sources do not say whether the factories themselves lost power. A tag reading "Actions contre la guerre" was found at one site, and on 8 April a far-left group announced on the Indymedia platform that it had sabotaged the network; the authenticity of that claim has not been confirmed. On 11 April the Paris prosecutor's office took over the investigation, classifying the act as destruction by dangerous means and an attack on the fundamental interests of the nation. No perpetrator has been identified; one event for three Malcontent pins.
infrastructure sabotage, arson
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
On 3 April 2026 at 08:13 the National Army's surveillance systems detected a Shahed-type drone that entered Moldovan airspace from the direction of Bilyaivka in Odesa region and headed towards the village of Tudora in Ștefan Vodă District; at 08:15 it left the country towards Krutoyarivka. The defence ministry gave an altitude of 3,000 m and a speed of 167 km/h. Moldova's foreign ministry called the overflight an unacceptable violation of sovereignty and territorial integrity, contrary to international law, and demanded respect for its airspace. It was the third such overflight within days, after 30 and 31 March. Who operated the drone is not stated in the statements; the Shahed designation comes from the defence ministry.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
On the night of 30 to 31 March 2026, according to Colonel Uku Arold of the Estonian Defence Forces, several most likely stray drones entered Estonian airspace during Ukrainian drone strikes on Russia's Baltic coast areas; they were detected by radar and fighter jets, public warnings were in force from around midnight until 6am, and NATO fighters took off from Ämari air base. No drone was shot down over Estonia. At about 3am residents of Kastre Parish reported an explosion near Kannu village; patrols found no trace overnight, and at 9.48am a local man found the debris of one drone on a field in the neighbouring village of Hammaste. Police cordoned off the site, Rescue Board bomb disposal experts worked there, and the PPA deputy director confirmed the find at a 10am press conference. The Internal Security Service is establishing the circumstances; the drone type and operator have not been officially given, and the word "Ukrainian" comes from the Defence Forces' assessment, not from an investigative finding.
date found, not date of flight
airspace incident, object found
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
On 29 March 2026, two UAVs fell in Finland: one north of Kouvola and one in Luumäki. On 9 September, police said the UAVs recovered in spring originated in Ukraine and formed part of its defensive operations; GNSS jamming and weather diverted them, without Finland being targeted. The statement does not identify the jammer. Investigations ended without pursuing criminal liability further; the entries remained unlawful. No injuries or property damage resulted from the UAVs’ arrival. Exact coordinates are undetermined; the former schematic route has been removed. The entry has no map point.
airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
NBI / Finnish Border Guard / 2026-09-09: Ukrainian origin of recovered UAVs; the statement does not identify a specific operator or the jammer.
No coordinates - this record has no point on the map.
/ Romania
Near Parcheș, Tulcea County
A Russian drone entered Romanian airspace at 00:44 and crashed four kilometres into Romanian territory near the village of Parcheș. It detonated on impact but caused no casualties or damage.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Auvere power plant near Narva, Estonia; a second drone crashed in Latvia
During a Ukrainian attack on Ust-Luga, drones entered from Russian airspace: one struck the chimney of the Auvere power plant near Narva in Estonia and another crashed in Latvia. The deviation was attributed to Russian GPS jamming.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Lake Lavysas, about 20 km from the Belarusian border
Security camera footage showed a drone crashing into the frozen Lake Lavysas about 20 kilometres from the Belarusian border. It was later confirmed to be a Ukrainian drone aimed at Russia that had strayed because of Russian electronic warfare.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
beach in the Yüceler neighbourhood, Ünye district, Ordu province
On 20 March at about 16:00 the sea washed an uncrewed surface vessel onto the beach in the Yüceler neighbourhood of Ünye; residents spotted it and the gendarmerie secured the area. According to the Ordu governorate, on 21 March at about 14:00 a team of the Istanbul Underwater Defence Group (SAS) examined the vessel, judged it active and loaded with munitions, and destroyed it in a controlled detonation about 4 km offshore. Defense News and the Turkish portal haber.aero identified it as an AEGIR-W made by the US company Sierra Nevada Corporation; the governorate gave no type. Who operated the vessel and where it came from has not been established; the country where the equipment was made says nothing about the operator.
date found, not date of flight
object found
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The Estonian Defence Forces said a Russian Su-30 fighter violated Estonian airspace over the Gulf of Finland near the island of Vaindloo. The aircraft had no published flight plan and kept no radio contact with air traffic control; Italian fighters were scrambled, and the Estonian foreign ministry handed a note of protest to a representative of the Russian embassy.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
A Russian Geran-2 drone fell near the village of Tudora in the Ștefan Vodă district, close to the state border. Moldova summoned the Russian ambassador and delivered a formal protest note.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
from the direction of Oleksandrivka (Ukraine) over the village of Ucrainca, Căușeni district; according to the Ukrainian side it vanished from radar near Troițcoe, Cimișlia district
At about 1.30 on the night of 14 March 2026, during a mass Russian attack on Ukraine, the Ukrainian side informed Moldova's Border Police of a Shahed-type drone that entered Moldovan airspace from the direction of Oleksandrivka over the village of Ucrainca, Căușeni district. The defence ministry's Air Operations Service confirmed observing the object, which it said left national airspace toward Novoselka in Ukraine; according to Ukrainian data the drone vanished from radar over Moldovan territory near Troițcoe, Cimișlia district. Defence minister Anatolie Nosatîi urged people not to approach any debris, and the foreign ministry condemned the overflight as a grave violation of sovereignty and territorial integrity. No damage or casualties were reported; no debris was found and no operator was named.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
A resident captured video of a Russian drone flying low over the village of Pardina, prompting Romanian F-16s and German Eurofighters to be scrambled.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Øresund Strait, near Malmö (French carrier Charles de Gaulle in port)
The Swedish Navy patrol boat HSwMS Rapp neutralised a Russian reconnaissance drone by jamming it over the Øresund Strait, about seven miles from the French aircraft carrier Charles de Gaulle, which was making a port call at Malmö.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
During Russian strikes on Ukrainian Danube ports, Romanian F-16s were scrambled when a drone briefly traversed Romanian airspace on 26 February. The following day a Ukrainian missile downed another Russian drone roughly 100 metres from the Romanian village of Chilia Veche.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
A Russian drone entered Romanian airspace shortly before 18:00 over Sfântu Gheorghe, tens of kilometres from the border, and left about 20 minutes later over Sulina, continuing over the Romanian Exclusive Economic Zone. Tulcea County residents received RO-Alert warnings about possible falling objects. The incident came two weeks after Russian drone fragments drifted ashore near Mamaia, Constanța County.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
railway station in Puławy, line 7 Warsaw-Lublin-Dorohusk
On the afternoon of 16 February 2026, at the railway station in Puławy, a 25-year-old Moldovan citizen applied the emergency brakes on three wagons of a train made up of a locomotive and 37 tank cars of diesel fuel travelling from Szczecin to Dorohusk, for Ukraine; according to police the engaged brakes could have caused a derailment. He was detained on the spot by a police officer, a railway guard and a Territorial Defence soldier from an Operation "Tor" patrol while standing on the platform between wagons; he carried a bag with phones, electronic equipment, SIM cards and documents in Russian, and had entered Poland from Belarus via Terespol the day before. On 18 February the Lublin Regional Prosecutor's Office charged him with creating a direct danger of an explosion of flammable materials threatening the lives of many people and property on a large scale (up to 10 years), a court remanded him for three months and the Internal Security Agency took over the investigation. There was no derailment and no damage; the train was checked and no dangerous materials were found. The prosecution's spokesman said the question of whether anyone inspired the suspect would be examined; nobody has named a principal.
transport sabotage
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Moldovan police reported the discovery of a Russian Gerbera drone in the village of Sofia, Drochia District, not far from the border with Ukraine. The area was sealed off and explosive ordnance disposal specialists were sent in.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Polish airspace along the border with Belarus (area not specified in the statement)
On the night of 1 to 2 February 2026 military radar systems recorded further balloon-like objects entering Polish airspace from the direction of Belarus. The Operational Command of the Armed Forces said the flights were monitored and posed no threat to air traffic or citizens, and that the scale of the Belarusian side's hybrid incidents was clearly smaller than on previous nights; cooperation between the military and the security services allowed objects to be seized and persons suspected of the incidents to be detained. The statement gives neither the number of objects, nor the area of entry, nor any air traffic restriction. It was the third consecutive night of balloon incursions, after the nights of 30/31 January and 31 January/1 February. Who physically launched the balloons has not been established.
airspace incident
suspected. Someone has named a perpetrator, but this is neither a court finding nor a formal attribution by a state.
Dowództwo Operacyjne Rodzajów Sił Zbrojnych / 2026-02-02: The Operational Command wrote of "hybrid incidents by the Belarusian side" and at the same time of detentions of persons suspected of those incidents. The statement attributes the action to the Belarusian state as a whole, gives no basis for that assessment and does not settle who physically launched the balloons.
Polish airspace along the border with Belarus (area not specified in the statement)
On the night of 31 January to 1 February 2026 military radar systems again registered balloon-like objects entering Polish airspace from the direction of Belarus; the Border Guard assessed them as probably smuggling balloons. The Operational Command of the Armed Forces wrote that the Belarusian side had made another attempt to probe and test the reaction of Poland's air defence systems, and that the flights were monitored and posed no threat. The statement gives neither the number of objects, nor the area of entry, nor any air traffic restriction that night. It was the second of three consecutive nights of balloon incursions, after the night of 30/31 January, when civil traffic over Podlaskie was restricted. Who physically launched the balloons has not been established.
airspace incident
suspected. Someone has named a perpetrator, but this is neither a court finding nor a formal attribution by a state.
Dowództwo Operacyjne Rodzajów Sił Zbrojnych / 2026-02-01: The Operational Command wrote that "the Belarusian side made another attempt to probe and test the reaction of Poland's air defence systems". That is a military command's assessment that the incursions were an act of the Belarusian state; the statement gives no basis for it, names no institution and does not settle who physically launched the smuggling balloons.
airspace over Podlaskie Voivodeship, along the border with Belarus
On the night of 30 to 31 January 2026 military radar systems registered objects entering Polish airspace from the direction of Belarus, which the Operational Command of the Armed Forces assessed from their flight parameters as most likely balloons drifting with the weather; the Border Guard said they were probably smuggling balloons. To ensure safety, temporary restrictions on the use of part of the airspace over Podlaskie Voivodeship were introduced for civil aviation, described by the command as precautionary and in line with procedures; the statement gives neither the hours of the restrictions nor the number of objects. The command called the event another in a series of hybrid incidents in eastern Poland and recorded no threat to airspace security. It was the first of three consecutive nights of balloon incursions. Who launched the balloons has not been established.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
Przasnysz - military unit of the 2nd Electronic Warfare Centre
A drone of unknown origin fell on the military unit of the 2nd Electronic Warfare Centre in Przasnysz, about 70 metres from an ammunition depot. The object had earlier been observed by the duty watch; it was suspected to be a reconnaissance drone reading data from the antenna field.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
On 22 January 2026 at about 9.25 residents reported to police a drone about 2.5 m long lying in the garden of an uninhabited house in Crocmaz village, Ștefan Vodă district. According to police the aircraft fell the previous night; its body was damaged on power lines and branches but the charge stayed intact: police described it as a Geran-2 model with a BST-52 warhead holding 50 kg of explosive and a 493M fuze. Nearby residents were evacuated and police sappers with the Codru engineer battalion destroyed the charge in a controlled explosion on site; nobody was hurt. Moldova's foreign ministry called the find a drone of Russian origin and a grave violation of sovereignty, and defence minister Anatolie Nosatîi confirmed the aircraft was armed. Who flew it and where it was launched from, the sources do not establish.
date found, not date of flight
object found, airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Poliția Republicii Moldova / 2026-01-22: Police described the aircraft as a Geran-2 model drone with a BST-52 warhead (50 kg of explosive) and a 493M fuze. That identifies the type and armament of the equipment, not who flew it or where it was launched from.
Ministerul Afacerilor Externe al Republicii Moldova / 2026-01-22: The foreign ministry called the find a drone of Russian origin, condemned the incident as a grave violation of sovereignty and territorial integrity and pointed to Russia's war against Ukraine as the source of the danger. That is a statement about the origin of the equipment and about context, not a formal attribution of the operator or tasking.
Moldovan authorities reported the discovery of a crashed Russian Gerbera drone in the village of Nucareni, Telenești District, about 54 km from the border with Ukraine; it was found by a hunter. Police published a photograph of the drone, noting that it carried no explosives; when it crashed is not known.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
seabed of the Gulf of Finland between Helsinki and Tallinn, in Estonia's exclusive economic zone, partly in Finnish territorial waters
On 31 December 2025 two subsea telecommunications cables between Finland and Estonia, owned by Elisa Oyj and Arelion Finland Oy, were damaged in Estonia's exclusive economic zone, with some of the damage in Finnish territorial waters. The Finnish Border Guard identified the Saint Vincent and the Grenadines-flagged cargo ship Fitburg, sailing from St Petersburg to Haifa, prevented further damage and directed the vessel to an anchorage; police found drag marks on the seabed running for tens of kilometres. The National Bureau of Investigation seized the ship from 7 to 12 January 2026, arrested one crew member (an Azerbaijani national) and placed three under a travel ban; the investigation into aggravated criminal damage, its attempt and aggravated interference with telecommunications was concluded on 5 June 2026 with four suspects and referred to the Deputy Prosecutor General for consideration of charges. Nobody has been charged or convicted, and whether the damage was deliberate or ordered by anyone has not been established. Malcontent calls the ship a shadow-fleet vessel; that association alone is not evidence of an order from the Russian authorities. The event has no single point on the map: it runs for tens of kilometres of seabed outside territorial waters.
infrastructure sabotage
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Keskusrikospoliisi (fińska Centralna Policja Kryminalna) / 2026-06-05: Police concluded the investigation with four suspects from the Fitburg's crew for aggravated criminal damage, its attempt and aggravated interference with telecommunications, and referred the case to the prosecutor. The release does not say whether the damage was deliberate and names nobody as having ordered it. The vessel's association with the so-called shadow fleet is not evidence of an order from the Russian authorities.
2026-01-12: The seizure of the vessel was lifted after Finnish and Estonian police completed their work on board; one crew member remained in custody and three were placed under a travel ban.
2026-06-05: The National Bureau of Investigation concluded the investigation with four suspects and referred the case to the Deputy Prosecutor General for consideration of charges.
No coordinates - this record has no point on the map.
/ Poland
distributed generation sites in the Polish power system
Remote terminal units, network equipment and the communications linking distributed generation sites to control centres were compromised: wind farms, solar installations and combined heat and power plants. No loss of supply followed; the prime minister said the attack had been thwarted and the system was never at risk. This was not a nationwide blackout. The event has no single point on the map because it touched multiple sites whose full list the source does not give.
cyberattack with physical effect
suspected. Someone has named a perpetrator, but this is neither a court finding nor a formal attribution by a state.
Dragos / 2026-01-28: The analytics firm Dragos writes that it "can confirm with moderate confidence that the threat group ELECTRUM is responsible". That is a technical assessment by a private company with a stated confidence level, not an official state attribution. Dragos names a group, not a state; ELECTRUM's links to any state apparatus are not established here.
No coordinates - this record has no point on the map.
/ Poland
Polish airspace along the border with Belarus
According to the National Security Bureau, several dozen objects, four of them identified as smuggling balloons, entered Polish airspace from Belarus overnight. Polish officials called it "a provocation disguised as a smuggling operation". In a separate incident, a Russian reconnaissance aircraft flying close to Polish airspace was intercepted over the Baltic by Polish fighters.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
At about 9.53am three Russian Federation border guards travelled by hovercraft to the Vasknarva breakwater, disembarked and crossed the control line on foot towards Estonia, then returned to the hovercraft and left. Surveillance recorded the crossing; Estonian services increased patrols, contacted the Russian border representative, and the foreign ministry announced it would summon the Russian chargé d'affaires. The statement does not say how long they remained on the Estonian side, nor whether they were armed.
action by state forces
officially attributed. A court or a competent state body has attributed it. That is not the same as a proven attack: an indictment is an allegation, not a verdict.
Ministerstwo Spraw Zagranicznych Estonii / 2025-12-17: From surveillance footage and a ground inspection Estonia established that the control line was crossed by Russian Federation border guards.
Black Sea coast near Çankırı; further crashes in Kocaeli and Balıkesir
An out-of-control drone that entered Turkish airspace was shot down by a Turkish Air Force F-16 over the Black Sea near Çankırı. Two other drones crashed on 19 and 20 December in Kocaeli and Balıkesir respectively; Turkey's interior minister identified the Kocaeli drone as a Russian-made Orlan-10.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Five unidentified drones overflew the French naval base at Île Longue in Finistère, Brittany, home to four Triomphant-class ballistic missile submarines. Naval troops reportedly fired at the intruders and Defence Minister Catherine Vautrin confirmed the drones were 'intercepted' by personnel at the base, without specifying whether they were shot down, jammed or otherwise neutralised.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
Black Sea, about 36 nautical miles east of Constanța, in Romania's exclusive economic zone
On 3 December 2025, at the Coast Guard's request, EOD divers of the Romanian Navy's 39th Divers Centre, brought to the site by the vessel MAI 1107, identified a drifting object about 36 nautical miles east of Constanța, beyond territorial waters in Romania's exclusive economic zone, as a Sea Baby type sea drone. At about 13:00 they destroyed it by controlled detonation; MApN spoke of removing an object endangering navigation. The ministry did not say where the vessel came from. Ukraine's SBU, for which the type was developed, stated that it had lost no Sea Baby drone and that none had entered Romanian territorial waters. Where the vessel drifted from remains unestablished.
date found, not date of flight
object found
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
On 3 December 2025 police were alerted when a resident of Pepeni village, Sângerei district, was carting a drone into the village on the trailer of a walking tractor; according to police he had found it in a field on Saturday 29 November and taken it for a toy. Two men had dismantled the aircraft and removed the engine; the parts were found at one man's home. Police said it was a Gerbera-type drone, used to deceive air defences and for observation, that it contained no explosive and posed no danger. The day of the report is what is recorded; police did not say when the drone fell or where it came from, and named no operator. No casualties were reported.
date found, not date of flight
object found
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Poliția Republicii Moldova / 2025-12-03: Police described the aircraft as a Gerbera-type drone, used to deceive air defences and for observation, with no explosive. That identifies the type of equipment, not who flew it or who tasked the flight; no operator has been named.
Vilnius airport operations were temporarily shut down in the evening for the tenth time in two months after suspected weather balloons from Belarus violated Lithuanian airspace.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
Annaburg German Air Force site, Saxony-Anhalt (Arrow-3 deployment site)
Three suspected Russian drones overflew the site of the Arrow-3 anti-ballistic missile deployment at the Annaburg German Air Force base in Saxony-Anhalt. A Bundeswehr rapid reaction detachment launched its own drone to intercept and, after making visual contact with one intruder, troops attempted to shoot it down with G27P assault rifles fitted with Israeli Smash X4 smart sights, without success.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Vilnius airport was closed for 11 hours because of meteorological balloons from Belarus. Deputy Foreign Minister Taurimas Valys called it 'a cynical hybrid attack against our economy, aviation security, and the entire nation'. Belarusian officials subsequently claimed a drone from Lithuania carrying a camera and extremist printed materials had landed near Grodno; Granta Autonomy later confirmed it was a modified Hornet XR, suggesting a Belarusian provocation.
airspace incident, airport disruption
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
Chilia Veche and Galați County, over Tecuci, crashing at Puiești, Vaslui County
Two drones were detected over Romania. The first entered near Chilia Veche around 06:30, was tracked by German Eurofighters and re-entered Ukrainian airspace. Minutes later another drone was detected over Galați County heading west; two Romanian F-16s were scrambled without visual contact. At 08:50 a passer-by filmed the drone over Tecuci after the government issued a RO-Alert warning for Vrancea County. It flew the deepest into Romanian territory since the escalation of the war in February 2022 and, after four hours, crashed in a courtyard in Puiești, Vaslui County.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
A Russian drone crashed on the roof of a house in Cuhureștii de Jos, about 20 kilometres from the Ukrainian border, without exploding. Nobody was injured and nearby residents were evacuated. Six drones were recorded violating Moldovan airspace that morning.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Two Italian Eurofighter Typhoons intercepted a Russian 'special' training aircraft, a Tu-134A-4 known to NATO as the 'Black Pearl', escorted by a pair of Su-30SM2 and a Tu-134UBL, flying over Ämari as part of Operation Eastern Flank.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
On the night of Sunday 23 to Monday 24 November Vilnius Airport halted traffic twice because of smugglers' balloons from Belarus: from 18:55 to 00:25 and from 01:40 to 03:25. NKVC head Vilmantas Vitkauskas called it the most intense night in November: balloon launches from Belarus began at about 17:00 and lasted until about 02:00, more than 40 balloons with smuggling characteristics were recorded and six had been found by morning; Latvian radars also detected about 30 balloons. According to LRT, over the whole night 18 flights were cancelled and 10 diverted (7 to Kaunas, 1 to Warsaw, 2 to Riga); more than 1,300 passengers were bused from Kaunas to Vilnius. The flight figures cover both stoppages together. Who launched the balloons has not been established.
airspace incident, airport disruption
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
Several drones overflew Volkel Air Base, home to Royal Netherlands Air Force and USAF squadrons. Dutch military personnel on the ground opened fire on the intruders but no wreckage was found. Eindhoven Airport was shut down for several hours.
airspace incident, airport disruption
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
On the evening of Thursday 20 November Vilnius Airport halted traffic from 18:38 to 19:55 because of navigation traces consistent with smugglers' balloons arriving from Belarus. According to the NKVC and Lithuanian Airports (via LRT/BNS) initial data pointed to up to ten balloon-like objects; 10 flights and more than 1,100 passengers were affected: 4 flights were cancelled and 6 could not land or depart as scheduled. Among the delayed flights was one from Brussels carrying Foreign Minister Kestutis Budrys and EU Commissioner Andrius Kubilius. Who launched the balloons has not been established.
airspace incident, airport disruption
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
Periprava and Chilia Veche (Romania); Gagauzia and Colibași (Moldova); re-entry near Oancea
A Russian drone entered Romanian airspace around 00:20 near Vylkove, penetrated about 8 kilometres into Romanian territory near Periprava and Chilia Veche, then crossed into Ukraine. Minutes later it entered Moldovan airspace over Gagauzia, flew over Colibași, and re-entered Romanian airspace near Oancea before 01:00. Four jets, two Romanian and two German, were scrambled but the drone's radar signal was lost.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Plauru and a neighbouring village; the port of Izmail on the Ukrainian side
A Russian drone struck the Turkish LPG tanker Orinda anchored in the Danube port of Izmail, setting the ship on fire. Although no violation of Romanian airspace was recorded, two Romanian villages on the southern bank of the river, including Plauru, were evacuated because of the risk of an explosion.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
On line 7 near Gołąb the overhead line was damaged and metal fittings were bolted to the rail with the aim of derailing a train. The driver of a PKP Intercity service from Świnoujście to Rzeszów carrying 475 people braked after a damage alert; falling overhead line components broke the outer panes of windows in one carriage. No one was injured. A phone wired to the track was also found nearby.
transport sabotage
officially attributed. A court or a competent state body has attributed it. That is not the same as a proven attack: an indictment is an allegation, not a verdict.
Prezes Rady Ministrów Donald Tusk / 2025-11-18: On 18 November 2025 the Prime Minister told parliament that the direct perpetrators were two Ukrainian citizens, one from Donbas, "cooperating with the Russian services". The perpetrators' nationality and their cooperation with those services are two separate claims; the statement set out no evidentiary basis.
near the village of Mika, Warsaw-Lublin line, Garwolin county
On the Warsaw-Lublin line near the village of Mika an explosive charge destroyed a section of rail, with roughly a metre of track missing. The interior minister described the event as an act of sabotage. The damage was found the following morning after a driver reported irregularities on the track. No one was hurt.
transport sabotage
officially attributed. A court or a competent state body has attributed it. That is not the same as a proven attack: an indictment is an allegation, not a verdict.
Prezes Rady Ministrów Donald Tusk / 2025-11-18: On 18 November 2025 the Prime Minister told parliament that the direct perpetrators were two Ukrainian citizens, one from Donbas, "cooperating with the Russian services". The perpetrators' nationality and their cooperation with those services are two separate claims; the statement set out no evidentiary basis.
Romanian territory opposite the Izmail area, Tulcea County
A Russian drone entered and crashed on Romanian territory just after midnight during an attack on Ukraine in the Izmail area. Weather conditions prevented NATO and Romanian fighter jets from being deployed. Drone fragments were identified in an inhabited area.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Kleine Brogel Air Base, Belgium; drones continued towards the Netherlands
Over 2-3 November several drones were observed over Kleine Brogel Air Base. A helicopter was deployed to the airbase in response and the drones continued flying towards the Netherlands, with further sightings reported over other Belgian military bases.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
On Sunday 26 October at 21:42 Vilnius Airport halted traffic for the third night in a row because of smugglers' balloons from Belarus; operations resumed at 04:30 on Monday, after almost seven hours. According to Lithuanian Airports (via LRT/BNS) 47 flights and more than 7,000 passengers were affected; AeroTime gives 13 flights cancelled, 14 diverted and 20 delayed. The Medininkai and Salcininkai border crossings were closed the same evening, and the government announced a plan to close the border with Belarus indefinitely. Over the three weekend nights 112 flights and more than 16,500 passengers were affected in total. Who launched the balloons has not been established.
airspace incident, airport disruption
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
On Saturday 25 October at about 21:35 Vilnius Airport again halted traffic because of smugglers' balloons from Belarus; operations resumed at about 03:30 on Sunday. According to Lithuanian Airports (via LRT/BNS and tv3.lt) about 25 flights and about 3,500 passengers were affected; AeroTime gives 5 flights cancelled, 7 diverted and 13 delayed, with diversions mainly to Kaunas. NKVC head Vilmantas Vitkauskas spoke of one recovered balloon with 1,500 packs of cigarettes and four people detained. The second of three consecutive nights of closures. Who launched the balloons has not been established.
airspace incident, airport disruption
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
On Friday 24 October at about 20:30 Vilnius Airport halted traffic because of smugglers' balloons from Belarus; Kaunas Airport was closed the same night, both until about 02:35. According to Lithuanian Airports (via LRT/BNS) 40 flights and more than 6,000 passengers were affected; AeroTime gives the breakdown: 10 flights cancelled, 14 diverted, 16 delayed. It was the first of three consecutive nights of closures (24, 25 and 26 October); after the weekend the Medininkai and Salcininkai border crossings were closed. The sources give no balloon count; who launched the balloons has not been established.
airspace incident, airport disruption
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
A Russian Su-30 fighter and an Il-78 refuelling tanker taking off from Kaliningrad briefly violated Lithuanian airspace. Spanish Eurofighter jets took off on air policing duty in response.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Camp Reedo (US Army base), southern Estonia near Võru
Two unidentified drones overflew Camp Reedo, a US Army base in southern Estonia. One was neutralised with an anti-drone gun while Estonian security forces continued searching for the other.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
Nova Post courier office, Sector 3, Bucharest (ground floor of a seven-storey residential block in the city centre)
On 15 October 2025 two Ukrainian citizens, who had entered Romania from Poland the day before, lodged at the office of the Ukrainian courier company Nova Post in Sector 3 of Bucharest two parcels containing home-made incendiary devices based on thermite and barium nitrate, with remote initiation and a GPS module, hidden in headphones and car parts. SRI pyrotechnicians disarmed the devices; nothing ignited. On 16 October DIICOT detained the two suspects (aged 21 and 24), and on 21 October SRI announced it had foiled a sabotage operation which it said was directed by the Russian Federation, the two men acting under the direct coordination of representatives of Russian secret services. The office is on the ground floor of a seven-storey block; DIICOT assessed that a fire could have spread to neighbouring buildings.
arson, infrastructure sabotage
officially attributed. A court or a competent state body has attributed it. That is not the same as a proven attack: an indictment is an allegation, not a verdict.
Serviciul Român de Informații (SRI) / 2025-10-21: SRI announced it had foiled a "sabotage operation directed by the Russian Federation": the two Ukrainian citizens were said to act "under the direct coordination of representatives of Russian secret services", as part of a saboteur network controlled by those services. That is the agency's position, not a court finding; no individual on the Russian side has been named.
Direcția de Investigare a Infracțiunilor de Criminalitate Organizată și Terorism (DIICOT) / 2026-04-06: In the indictment of 2 April 2026 DIICOT charged the two men with attempted sabotage and complicity, maintaining that the operation was directed by the Russian Federation. An indictment is an allegation, not a verdict.
2026-04-06: On 2 April 2026 DIICOT sent the two Ukrainian citizens (aged 23 and 24) to trial at the Bucharest Court of Appeal for attempted sabotage and complicity; expert examination confirmed the devices were functional.
At least 14 weather balloons carrying black-market cigarettes were launched from Belarus, forcing the shutdown of Vilnius airport and the cancellation of 30 flights. Lithuanian officials described the balloons as a tool of hybrid aggression against Europe, and Lithuania closed its border with Belarus, with the closure extended to 30 November 2025.
airspace incident, airport disruption
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
Elsenborn military training camp, East Cantons, on the German border
At about 1.45am on 3 October 2025 police from Düren in Germany observed drones that had flown over the Belgian training camp at Elsenborn in the East Cantons and entered German airspace; according to VRT there were 15 of them and a Belgian test aircraft stationed at the camp also detected all of them. The German authorities passed the information to the Belgian defence ministry. Defence minister Theo Francken confirmed that several drones had been detected by police on both the Belgian and the German side and announced an investigation into what happened, what the aim was and why the drones were there; a ministry spokesperson called it the first such incident they were aware of. The mayor of Bütgenbach, Daniel Franzen, said one drone had been used to search for a lost horse; Francken rejected that explanation. Asked about Russia, the minister said it was possible but that there were no concrete indications. The exact number of drones, their operator and their origin have not been established.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
2025-10-22: Minister Francken told the defence committee that a judicial investigation into the Elsenborn drones is under way and that the military intelligence service ADIV has been appointed to help conduct it; because of the ongoing proceedings the ministry gives no details.
2026-04-13: VRT's Pano programme: half a year after the drone wave over Belgium there is no evidence of hostile drones; two police officers from Bütgenbach confirmed seeing the drones over Elsenborn with their own eyes. The federal prosecutor is running 26 investigations into about 40 incidents and considers it too early to conclude anything about origin.
On the evening of 2 October drones were reported near Munich Airport: first sightings at about 8.30pm, by the perimeter fence at about 9.05pm and over the airfield at about 10.10pm. Flight operations were progressively halted from 10.18pm and the runways closed at 10.35pm. Sightings ended around midnight and operations resumed on 3 October. State and federal police searched the area with helicopters. Per the police statement, no perpetrator has been identified.
airport disruption, airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Yoroz harbour, Çarşıbaşı district, Trabzon province
On the night of 29 September fishermen working off Çarşıbaşı pulled a foreign object out of their nets, towed it to Yoroz harbour and notified the Coast Guard. The Trabzon governorate said it was an uncrewed surface vessel of foreign origin, secured for examination by Navy diver teams and the gendarmerie; the harbour was closed. On 1 October the vessel was towed out to sea and destroyed in a controlled detonation; according to the governor there were no casualties and no environmental damage. The governorate named neither the country of origin nor the operator; media described a Ukrainian strike craft that had drifted across the Black Sea.
date found, not date of flight
object found
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
near the Șontea Nouă canal, Danube delta, Tulcea county
After a call to the 112 emergency number, fragments of an unmanned aircraft were found near the Șontea Nouă canal. The defence ministry confirmed the find and described the debris as most likely of Russian origin, noting that specialists had yet to examine it. The day of the find is what is recorded; neither the flight date nor the operator has been established.
date found, not date of flight
object found
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Ministerul Apărării Naționale (MApN) / 2025-09-29: The defence ministry described the debris as most likely of Russian origin, ahead of examination by specialists. That is a preliminary assessment of where the equipment came from, not a finding about the operator.
Police and the armed forces reported drone sightings lasting two and a half hours over Ørland Main Air Station, a base that is also key for NATO. A day later Norwegian police released footage showing five to six drones at once over the restricted airspace of Brønnøysund Airport.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
On the night of 26-27 September, unidentified drones were observed over Karup Air Base. They appeared at 20:15 local time and remained for several hours. The airspace over the base was briefly closed; the Danish Ministry of Defence reported similar incidents at other military sites.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
Kiel, Schleswig-Holstein (TKMS shipyard, power plant, university hospital, Landeshaus, Kiel Canal)
On the night of 25 to 26 September 2025 the Schleswig-Holstein state police recorded drone flights over Kiel and in the districts of Dithmarschen and Rendsburg-Eckernförde, including over critical infrastructure and military sites. According to Der Spiegel, citing an internal government memo, two small drones crossed the TKMS shipyard grounds at about 9.15pm, a drone group with a larger mother drone then appeared over the university hospital, and after 10pm a similar formation flew over the gas power plant on the Kiel fjord and the Kiel Canal; the Landeshaus and reportedly the Heide refinery were also overflown. Interior minister Sabine Sütterlin-Waack confirmed to a Landtag committee on 1 October that the report matched what the police had told her ministry and that the state criminal police office was evaluating the case; she added that some sightings, including over military sites, had not yet been verified and that in many reports an illegal overflight was ruled out. Prosecutors opened proceedings against unknown persons. The number of drones, their operator and their origin remain unestablished.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
Aalborg, Billund, Esbjerg, Sønderborg and Skrydstrup airports
On the night of 24-25 September, unauthorised drones were observed near Aalborg, Billund, Esbjerg, Sønderborg and Skrydstrup airports. The first drones appeared at 21:44 local time near Aalborg, and a few minutes later police received reports of drones at the other airports.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
Copenhagen Airport and other Danish airports; also Norwegian airports
Between 22 and 28 September unidentified drones, suspected to be Russian, violated Danish airspace near Copenhagen Airport, with further sightings near other Danish airports in the following days. Norway also reported drone sightings over its airports during the same period, causing airport closures and flight disruption.
airspace incident, airport disruption
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Two Russian fighter jets violated the safety zone of the Orlen Petrobaltic drilling platform in the Baltic Sea.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Three Russian MiG-31 fighter jets violated Estonian airspace around Vaindloo in the Gulf of Finland for a total of 12 minutes; they reportedly had no flight plans and their transponders were switched off. The Estonian Defence Forces published flight charts showing the jets flying a straight line parallel to the Estonian coast. Estonia invoked Article 4 of the North Atlantic Treaty and summoned the Russian chargé d'affaires.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
A Russian drone was detected in Romanian airspace; two F-16s were scrambled at 18:05 and intercepted it, tracking it for about 50 minutes from Chilia Veche to Pardina where it crossed into Ukraine. Permission to shoot it down was granted but the pilots decided against opening fire to avoid potential collateral damage.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
On the morning of 12 September residents called 112 about an object floating in the water off North Beach in Burgas; police received the report at about 09:30 and cordoned off the area. A team from Burgas Naval Base found it to be an aeroplane-type unmanned aircraft without explosive material and posing no danger, and with the authorisation of the Navy chief of staff took it to the base. The defence ministry statement gives neither the type nor the origin of the aircraft; local media wrote that there was no official information on its origin. The flight date and the operator have not been established.
date found, not date of flight
object found
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
Multiple locations across eastern and central Poland; Warsaw Chopin, Warsaw Modlin, Rzeszów and Lublin airports closed
On the night of 9/10 September multiple Russian drones entered Polish airspace. Polish, Dutch, Italian and American aircraft operated in the airspace and air defence and radar systems were placed on high alert. At least 21 drones were recorded over Poland and up to four were shot down. Warsaw Chopin, Warsaw Modlin, Rzeszów and Lublin airports were temporarily closed because of 'unplanned military activity'. Poland invoked Article 4 of the North Atlantic Treaty.
airspace incident, airport disruption
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
nine mosques and cultural centres in and around Paris
On the night of 8 to 9 September 2025 pig heads were left outside nine mosques and cultural centres in and around Paris, and found on the morning of 9 September. Per documents described by OCCRP the operatives flew into Paris on 7 September, carried out reconnaissance on 8 September and left the country after delivering the heads. One coordinated set of drops, not nine independent operations. In December 2025 the Higher Court in Smederevo convicted three Serbian nationals; the written verdicts point to orders and money from structures of Russian intelligence.
provocation or vandalism
officially attributed. A court or a competent state body has attributed it. That is not the same as a proven attack: an indictment is an allegation, not a verdict.
Sąd Wyższy w Smederewie / 2025-12-24: On 22 and 24 December 2025 the Higher Court in Smederevo convicted three Serbian nationals of espionage, inciting racial discrimination and criminal association. The written verdicts say the group received orders, instructions and money from "structures of the intelligence service of the Russian Federation", without naming which service or which officials. The acts covered are the severed pig heads left at nine mosques in and around Paris in September 2025 and green paint thrown at Paris synagogues and the Mémorial de la Shoah in May 2025. The sentences: 18 months in prison, one year of house arrest and six months of house arrest. The verdicts followed plea agreements and were not appealed, so they are final. The alleged organiser is beyond the court's reach.
OCCRP i Delfi Estonia / 2026-05-24: Journalists described leaked documents pointing to the Social Design Agency, a Russian firm sanctioned by the US, the UK and the EU, and to a role for the Russian presidential administration. This is a journalistic finding, separate from the verdict: the Serbian court did not name that company. No charges have been brought in France.
Two Russian drones entered Polish airspace during an attack on western Ukraine. Polish and allied aircraft were scrambled and the drones were closely monitored until they left Polish territory.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Tartu County, Estonia (drone transited Latvian airspace)
During a Ukrainian drone attack on Saint Petersburg and Ust-Luga, a drone violated Latvian airspace and crashed in Tartu County, Estonia. Early findings from an Estonian investigation identified it as a Ukrainian drone that had veered off course due to Russian radio jamming.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
A Russian drone, probably a Geran-2, flew more than 200 km into Poland and around midnight crashed and exploded in a field at Osiny. The debris was identified in the morning across a burnt area 8-10 m across; during the 2.5-hour flight the drone was not detected by Polish air defence. The explosion damaged buildings in the village, but nobody was injured.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
At 10:00 the Burgas regional administration asked the military to deal with a drone washed up on Harmanite beach in Sozopol. A team from Burgas Naval Base found it to be an unmanned aircraft of unknown model and could not establish whether it carried a warhead; for safety it was destroyed in place at 11:20. In a written answer to an MP, defence minister Atanas Zapryanov wrote that the aircraft had been in the sea for about a month, carried no identification markings, an explosive charge inside it could not be excluded, and the Navy had no information about the tasks it had performed. Its description as a Russian Orlan-10 comes from the parliamentary question, not from a ministry finding.
date found, not date of flight
object found
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
2025-08-25: Defence minister in a written parliamentary answer: the drone had been in the sea for about a month, without markings, an explosive charge could not be excluded, the Navy does not know its tasks.
five sites: the Ogre area, Jēkabpils municipality and Riga (railway relay cabinets and a locomotive)
In August 2025 two Latvian citizens, born in 1999 and 2006, according to the State Security Service (VDD) doused with fuel from plastic bottles and set fire to railway relay cabinets, a railway lighting distribution cabinet and a diesel locomotive of the private company Baltijas tranzīta serviss; according to the head of VDD two cabinets burned in the Ogre area, two in Jēkabpils municipality and the locomotive in Riga, five episodes in all. The event spans several sites tens of kilometres apart, so there is no single point on the map. Police opened proceedings at the end of August 2025, both perpetrators were detained in early September and VDD took over the case in October. On 2 March 2026 VDD asked the prosecution to bring charges under the article on assistance to Russia in action directed against Ukraine (Section 77.4 of the Criminal Law) and for intentional destruction of property by arson; according to VDD the perpetrators filmed the fires and sent the footage to their taskers, who used it in psychological operations as supposed events in Ukraine. Charges were brought in March 2026; the victims claimed losses of over 370,000 euros (the locomotive) and about 14,000 euros (Latvijas dzelzceļš). The exact days are not given, so the record carries month precision; there is no verdict.
day not established
arson, infrastructure sabotage
suspected. Someone has named a perpetrator, but this is neither a court finding nor a formal attribution by a state.
Valsts drošības dienests (VDD) / 2026-03-12: VDD stated that the investigation obtained evidence linking the acts to Russia and that footage of the fires went to the taskers, who used it in psychological operations; the head of VDD told LTV the acts were carried out on the instructions of Russian special services. VDD alleges assistance to Russia in action against Ukraine. That is an official suspicion by an agency and a charge, not a court finding; VDD itself notes that nobody is guilty until a court says so.
Prokuratura Łotwy (prokurator Lita Brumermane) / 2026-03-22: The prosecutor brought charges of property damage and of assisting Russia, stating that the accused were aware they were working in Russia's interests. An indictment is an allegation, not a verdict.
No coordinates - this record has no point on the map.
/ Lithuania
Gaižiūnai military training camp (drone flew over Vilnius en route)
An explosive-laden drone launched from Belarus flew over Vilnius and struck the Gaižiūnai military training camp, roughly 100 kilometres from the Belarusian border. The Gerbera-type drone was found to carry 2 kilograms of explosives, discovered on 1 August.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Estonian territorial sea east of Vaindloo island, Gulf of Finland
The Russian Svetlyak-class border guard vessel SOCHI 500 entered about half a kilometre into Estonian territorial waters east of Vaindloo island and stayed for some 35 minutes. The Estonian Navy tracked the passage and confirmed the violation. The vessel had not given the required 48 hours' notice. On 28 July the foreign ministry summoned the Russian chargé d'affaires and lodged a protest. Per ERR this was the first violation of Estonia's maritime border by a Russian Federation vessel.
action by state forces
officially attributed. A court or a competent state body has attributed it. That is not the same as a proven attack: an indictment is an allegation, not a verdict.
Ministerstwo Spraw Zagranicznych Estonii / 2025-07-28: Estonia identified the vessel as the Russian border guard ship SOCHI 500, confirmed the maritime border violation and lodged a protest.
Sighetu Marmației and Vicovu de Sus, northern Romania
Four Ukrainian aircraft unintentionally entered Romanian airspace during a Russian attack on northern Ukraine; Romanian radar detected twelve Ukrainian contacts near the border. Two Romanian F-16s and two Italian Typhoons were scrambled. The Ukrainian aircraft briefly crossed near Sighetu Marmației and Vicovu de Sus without posing a threat.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Lithuanian territory just across the Belarusian border
A Gerbera drone crossed Belarusian airspace and crashed about 1 km from the Belarusian-Lithuanian border. Once the object was detected, the Lithuanian government was moved to a shelter.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
On the afternoon of 10 June 2025 a Russian military aircraft is suspected of having violated Finnish airspace over the Gulf of Finland off Porvoo. The Ministry of Defence spoke of a suspicion; minister Antti Häkkänen said the investigation was launched immediately and is led by the Border Guard. The ministry gave neither the aircraft type nor the duration or depth of the incursion; lentoposti.fi identifies the aircraft as a Russian Navy Tu-154M flying east to west over international waters. On 11 June the foreign ministry summoned Russia's chargé d'affaires. This was the second suspected violation within weeks, after the event of 23 May. Malcontent dates its pin to 26 May; no Finnish source gives that date for a violation.
airspace incident
suspected. Someone has named a perpetrator, but this is neither a court finding nor a formal attribution by a state.
Ministerstwo Obrony Finlandii / 2025-06-10: The Ministry of Defence said a Russian military aircraft was suspected of having violated Finnish airspace. The suspicion covers the fact of the violation itself; the Border Guard is investigating.
On the afternoon of 23 May 2025 two Russian military aircraft are suspected of having violated Finnish airspace over the Gulf of Finland off Porvoo. The Ministry of Defence spoke of a suspected violation; minister Antti Häkkänen said the matter was being taken seriously and that an investigation, led by the Border Guard, was under way. The aircraft type, the duration and the depth of the incursion were not given. On 26 May the Finnish foreign ministry summoned the Russian ambassador. Malcontent dates the event to 22 May after The Watch; the ministry's release and Finnish media give 23 May.
airspace incident
suspected. Someone has named a perpetrator, but this is neither a court finding nor a formal attribution by a state.
Ministerstwo Obrony Finlandii / 2025-05-23: The Ministry of Defence said two Russian military aircraft were suspected of having violated Finnish airspace. The suspicion covers the fact of the violation as well as who committed it; the Border Guard is investigating.
On the night of 12 May 2025 the front door of Prime Minister Keir Starmer's house on Countess Road in Kentish Town was set on fire; since his move to Downing Street the house had been occupied by members of his family, who were asleep upstairs. The perpetrator used a modified mixture of flammable substances. One of the occupants saw smoke and an orange glow by the door and called 999; smoke filled the stairway, she struggled to breathe, and her nine-year-old daughter was woken by the smoke. The fire brigade arrived promptly and nobody was injured. The court found that the perpetrator acted on the instructions of a person known as "EL Money", whom he did not know, for money. This was the third fire in the series of 8, 11 and 12 May. The court did not establish who ordered the attacks; counter-terrorism police found no evidence of a foreign state's involvement.
arson
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Central Criminal Court (Old Bailey), sędzia Garnham / 2026-06-19: The court found that the perpetrator acted on the instructions of a man he knew only as "EL" ("EL Money"), whom he had never met, for promised money, and was to him "a useful idiot" used "for some unknown cause". The court did not establish who EL is or whom he worked for. Counter-terrorism police said after the verdict that there was no evidence the attacks were sponsored by a hostile state; the prosecution described the perpetrators' motive as financial. The verdict concerns the perpetrators, not whoever ordered the acts.
2026-06-19: Old Bailey: Roman Lavrynovych sentenced to 7 years and Stanislav Carpiuc to 2 years for conspiracy to commit arson reckless as to endangering life; the third defendant, Petro Pochynok, was acquitted. A sentencing does not create a new incident on the timeline; whether the judgment is final is not established.
Just after 2am on 11 May 2025 the front door of a house on Ellington Street linked to Prime Minister Keir Starmer was set on fire: the perpetrator poured an accelerant onto the steps and part of the door and lit it, filming as he did so. The fire spread into the hallway. The occupant was woken by an alarm, saw and smelt the smoke, and escaped onto the roof of the building to await the fire brigade. The court found that the perpetrator acted on the instructions of a person known as "EL Money", for money, and was reckless as to whether life was endangered. This was the second of the three fires of 8, 11 and 12 May. The court did not establish who ordered the attacks; counter-terrorism police found no evidence of a foreign state's involvement. The CPS places all three fires in Kentish Town; Ellington Street lies in Islington.
arson
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Central Criminal Court (Old Bailey), sędzia Garnham / 2026-06-19: The court found that the perpetrator acted on the instructions of a man he knew only as "EL" ("EL Money"), whom he had never met, for promised money, and was to him "a useful idiot" used "for some unknown cause". The court did not establish who EL is or whom he worked for. Counter-terrorism police said after the verdict that there was no evidence the attacks were sponsored by a hostile state; the prosecution described the perpetrators' motive as financial. The verdict concerns the perpetrators, not whoever ordered the acts.
2026-06-19: Old Bailey: Roman Lavrynovych sentenced to 7 years and Stanislav Carpiuc to 2 years for conspiracy to commit arson reckless as to endangering life; the third defendant, Petro Pochynok, was acquitted. A sentencing does not create a new incident on the timeline; whether the judgment is final is not established.
In the early hours of 8 May 2025 a parked Toyota RAV4 that had previously belonged to Prime Minister Keir Starmer was set alight on Countess Road in Kentish Town. The car, worth about £17,500, was completely destroyed; the court noted the risk to passers-by and residents and recorded no injuries. The court found that the perpetrator, a 21-year-old Ukrainian, took the job from a person he did not know, contacted via Telegram and known as "EL Money", for promised money, and was to film the fire as proof. This was the first of three fires set in the area over five nights; the next, on 11 and 12 May, hit houses linked to the prime minister. The court did not establish who was behind "EL"; counter-terrorism police found no evidence of a foreign state's involvement.
arson
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Central Criminal Court (Old Bailey), sędzia Garnham / 2026-06-19: The court found that the perpetrator acted on the instructions of a man he knew only as "EL" ("EL Money"), whom he had never met, for promised money, and was to him "a useful idiot" used "for some unknown cause". The court did not establish who EL is or whom he worked for. Counter-terrorism police said after the verdict that there was no evidence the attacks were sponsored by a hostile state; the prosecution described the perpetrators' motive as financial. The verdict concerns the perpetrators, not whoever ordered the acts.
2026-06-19: Old Bailey: Roman Lavrynovych sentenced to 7 years and Stanislav Carpiuc to 2 years for conspiracy to commit arson reckless as to endangering life; the third defendant, Petro Pochynok, was acquitted. A sentencing does not create a new incident on the timeline; whether the judgment is final is not established.
A Russian military helicopter from the Baltic Fleet entered Polish airspace over Polish territorial waters. It was tracked by military radar and the Polish Air Navigation Services Agency until it left.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Someone gained unauthorised access to the control system of the dam at Risavatnet and opened a valve for just under four hours. About 497 litres per second were released above the required minimum; no consequences beyond exceeding the minimum flow were recorded. The date recorded here is the day the open valve was found, 7 April; the source used does not establish when the valve was opened. Norway's NSM was notified on 10 April and the case became public in June.
date found, not date of flight
cyberattack with physical effect
suspected. Someone has named a perpetrator, but this is neither a court finding nor a formal attribution by a state.
Politiets sikkerhetstjeneste (PST) / 2025-08-13: The Norwegian security service concluded that a pro-Russian hacker group was behind the attack and described it as a demonstration of capability. PST points to links between people in that group and Russian state actors, which is not the same as establishing that the attack was ordered at state level.
2025-08-13: The criminal case was closed because no perpetrators were identified. PST maintains its assessment of the group, but the closure means no individuals were established.
two impact sites near the Ukrainian border: about 5 km west of Reni, less than a kilometre from the left bank of the Danube, and 500 m from the Danube bank, about 5 km south of Reni
On Thursday 13 February 2025, after an overnight Russian attack on Ukrainian port infrastructure on the Danube, a team of specialists from MApN, SRI and the interior ministry examined two impact sites on Romanian territory: about 5 km west of Reni, less than a kilometre from the left bank of the Danube, and 500 m from the bank, about 5 km south of Reni. Both held fragments of Geran-1/2 drones, which the ministry says are used by the Russian Federation; both carried explosive charges that detonated on impact. Both sites lie outside inhabited areas and no infrastructure was affected. During the night of 12 to 13 February an RO-Alert warning went out for northern Tulcea County and MApN radars detected an object that briefly entered Romanian airspace. Samples were taken; no operator has been named.
date found, not date of flight
object found, airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Ministerul Apărării Naționale (MApN) / 2025-02-13: The defence ministry described the fragments as coming from Geran-1/2 drones used by the Russian Federation in attacks on Ukrainian Danube ports. That names the type and user of the equipment in the context of an attack on Ukraine, not a finding about who directed the aircraft that fell on Romanian territory.
A Russian Su-24 violated Polish airspace near Gdańsk Bay for one minute and twelve seconds, penetrating 6.5 kilometres into Polish territory. Russia admitted the violation and blamed a malfunction in the aircraft's navigation system.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
At about 5.15pm a Russian state aircraft is suspected of having violated Finnish airspace over the Gulf of Finland west of Hanko, for a few minutes. The government release speaks throughout of a suspicion, not a confirmation; the Border Guard is investigating. The aircraft type, its registration and the depth of the incursion are not given.
airspace incident
suspected. Someone has named a perpetrator, but this is neither a court finding nor a formal attribution by a state.
Rząd Finlandii / 2025-02-07: The government release says a Russian state aircraft is suspected of having violated Finnish airspace. The suspicion covers the fact of the violation as well as who committed it.
At 4.30am an attacker smashed the windows of the Slava Ukraini restaurant in Tallinn and threw petrol inside, setting it alight, while an accomplice filmed from across the road. The source used gives neither the extent of the damage nor any casualty information.
arson
officially attributed. A court or a competent state body has attributed it. That is not the same as a proven attack: an indictment is an allegation, not a verdict.
Harju Maakohus (sąd okręgowy w Harju) / 2025-07-02: On 2 July 2025 the court convicted two Moldovan citizens of arson in support of intelligence activity against Estonia. The court found the restaurant arson to be an influence operation ordered by Russian intelligence, the perpetrators having been recruited by the GRU in the summer of 2024. Whether the judgment is final is not established in the source used.
Several Russian drones entered Romanian airspace. A possible drone impact zone was identified near Plauru.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Arson at the Coop shop in Osula, about 10 km from the Nursipalu training area. The perpetrator filmed the act as instructed by his handlers. The source used gives neither the extent of the damage nor any casualty information.
arson
officially attributed. A court or a competent state body has attributed it. That is not the same as a proven attack: an indictment is an allegation, not a verdict.
Harju Maakohus (sąd okręgowy w Harju) / 2025-07-02: On 2 July 2025 the court convicted two Moldovan citizens of arson in support of intelligence activity against Estonia. The court found the restaurant arson to be an influence operation ordered by Russian intelligence, the perpetrators having been recruited by the GRU in the summer of 2024. Whether the judgment is final is not established in the source used.
Moldovan and Romanian territory; impact in Chernivtsi Oblast (Ukraine)
A Kh-101 cruise missile flew over Ukraine, across Moldovan and Romanian territory, and then fell on a field in Chernivtsi Oblast. The Romanian authorities did not confirm the incident.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
seabed of the Gulf of Finland, along the EstLink 2 link and telecommunications cables
On the afternoon of 25 December 2024 the EstLink 2 power link between Finland and Estonia disconnected from the grid; the fault was located in the submarine cable and repairs were estimated at several months. Finland's electricity system kept running. The same day the Cook Islands-flagged tanker Eagle S was detained. Its master and two senior officers were accused of deliberately dragging the ship's anchor some 90 kilometres along the seabed and damaging five undersea cables. This is one series of damage, not several separate attacks. The vessel is often associated with the so-called shadow fleet; that association alone is not evidence of an order from the Russian authorities. The event has no point on the map: it runs for tens of kilometres of seabed, and a Finnish court found it had no jurisdiction over the case.
infrastructure sabotage
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Prokuratura fińska / 2025-01-10: Prosecutors accused three crew members of deliberately dragging the anchor. A first-instance court dismissed the case, finding Finnish criminal law inapplicable; the prosecutor appealed. Nobody has been convicted, and whether anyone ordered the cable damage has not been established. The vessel's association with the so-called shadow fleet is not evidence of an order from the Russian authorities.
2025-01-10: The first-instance court dismissed the case for want of jurisdiction. The prosecutor announced an appeal to the Helsinki Court of Appeal.
No coordinates - this record has no point on the map.
/ Moldova
field near the village of Podgoreni, Orhei district
On 3 December 2024 residents alerted police to a drone lying in a field near the village of Podgoreni, Orhei district, less than 20 km from the Dniester. Police cordoned off the area and sent the technical-explosives unit of the General Police Inspectorate's forensic centre to examine the aircraft. The day of the find is what is recorded; the sources do not establish when the drone arrived, what type it was or where it came from. No casualties were reported.
date found, not date of flight
object found
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
In December 2024, shortly before Christmas, hackers took control of the pumps of the small Tureby-Alkestrup waterworks in Køge Municipality and raised the pressure until pipes burst in three places; hundreds of households were without water for up to seven hours. The sources do not give the day, hence month precision. The waterworks' board admitted that remote access had been poorly secured. On 18 December 2025 the head of the Danish Defence Intelligence Service (FE), Thomas Ahrenkiel, said the service was very confident that pro-Russian groups connected to the Russian state were behind the attack and named the group Z-Pentest; the government summoned the Russian ambassador. On 13 July 2026 the Council of the EU sanctioned Z-Pentest, its leader and its main hacker, linking the CARR grouping they belong to with Russia's military intelligence, the GRU. Nobody has been convicted.
day not established
cyberattack with physical effect
suspected. Someone has named a perpetrator, but this is neither a court finding nor a formal attribution by a state.
Forsvarets Efterretningstjeneste (FE, duński wywiad wojskowy) / 2025-12-18: The head of the FE said at a press conference that the service assesses it as very likely that pro-Russian groups connected to the Russian state were behind the attack, and named Z-Pentest. This is an intelligence assessment, not a verdict or a charge; no specific organ of the Russian state was named as having ordered it.
Rada Unii Europejskiej / 2026-07-13: The Council of the EU sanctioned Z-Pentest for the December 2024 cyber-attack on a Danish water utility, together with the group's leader and its main hacker, both from the CARR grouping, which the Council links to Russia's military intelligence, the GRU. Sanctions are a political and legal decision of the member states, not a court finding.
2025-12-18: The FE publicly attributed the attack to Z-Pentest; the Danish foreign ministry summoned the Russian ambassador.
2026-07-13: The Council of the EU imposed sanctions on Z-Pentest and on Yuliya Pankratova and Denis Degtyarenko over the attack on the Danish waterworks.
A flying device was found in the village of Coșernița, Criuleni district, which police described as an escort aircraft for Shahed-type drones, of Russian origin, with no explosive payload attached. The day of the find is what is recorded. The source does not establish when the device was launched or how long it lay there, so no flight date is added.
date found, not date of flight
object found
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Poliția Republicii Moldova / 2024-11-12: Police described the device as being of Russian origin. That is a claim about where the equipment came from, not about who flew it or who tasked the flight; no operator has been established.
45 km east of Sfântu Gheorghe, Tulcea; radar contact lost south of Cogealac
A small aerial target was detected 45 km east of Sfântu Gheorghe, Tulcea. Spanish and Romanian fighters were sent for visual identification but detected nothing; radar contact was lost south of Cogealac and no impact zone was found.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
Eforie Nord towards Topraisar, radar contact lost near Amzacea, Constanța County
A small aerial target detected about 150 km east of the Mihail Kogălniceanu Air Base flew roughly 14 km inside Romanian airspace from Eforie Nord towards Topraisar. Spanish and Romanian jets were sent up but made no visual contact, and radar contact was lost near Amzacea with no impact zone identified.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
Litcov canal, about 1 km from its junction with the Sfântu Gheorghe arm, Danube delta, Tulcea County
On the morning of 4 October 2024 the Border Police informed the defence ministry of drone fragments found in the Litcov canal area of the Danube delta, about a kilometre from its junction with the Sfântu Gheorghe arm. A team of specialists from MApN, SRI and the interior ministry searched the site and collected the fragments, which the ministry described as coming from a drone of Russian origin, pending expert examination. The site lies outside any built-up area; no infrastructure was affected. The day of the find is recorded; the flight date and the operator have not been established.
date found, not date of flight
object found
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Ministerul Apărării Naționale (MApN) / 2024-10-04: The defence ministry described the collected fragments as coming from a drone of Russian origin, ahead of expert examination. That is an assessment of where the equipment came from, not a finding about the operator or who tasked it.
Romanian airspace in the border region with Ukraine
A Russian drone briefly violated Romanian airspace during a Russian attack on Ukraine. Four aircraft were brought up to monitor the situation.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
A Russian drone came down near Periprava in the Danube Delta; wreckage was searched for in the deserted area.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
A Russian drone that had flown through Belarus entered Latvia and came down in Rēzekne Municipality. The incident came a week after Latvia's Defence Minister announced there would be a 'concrete reaction' if drone incidents continued.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
A drone of unknown type, probably a Shahed, violated Polish airspace and crashed in the Tyszowce area of Lublin Voivodeship, about 25 km from the border with Ukraine.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
A Russian Shahed drone crashed in the village of Periprava in Tulcea County, where its wreckage was found.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
During Russian night attacks on Ukraine on 24 and 25 July, multiple drones were observed approaching the Romanian border. Romanian F-16s were sent to monitor the situation over Tulcea County. Three Geran-2 drones entered Romanian territory on 25 July and subsequently crashed, their wrecks being identified afterwards.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
A parcel detonated at a DHL transport warehouse in Birmingham, after it had left the airport. The source used gives neither the extent of the damage nor any casualty information.
arson, infrastructure sabotage
suspected. Someone has named a perpetrator, but this is neither a court finding nor a formal attribution by a state.
VSquare i partnerzy śledczy / 2024-11-01: A journalistic investigation attributes the series of parcel fires to Russian military intelligence. The publication cites the Lithuanian prosecutor's office, which named three suspects publicly, a joint investigation team coordinated by Eurojust, and unnamed security sources. I have not read those documents, so the grade stays journalistic rather than official. No verdict has been reached on the parcel explosions themselves.
At 9am pallets of courier parcels caught fire at the DPD depot in Jabłonowo near Warsaw. Four crews of twenty firefighters each took two hours to put it out. Nobody was hurt.
arson, infrastructure sabotage
suspected. Someone has named a perpetrator, but this is neither a court finding nor a formal attribution by a state.
VSquare i partnerzy śledczy / 2024-11-01: A journalistic investigation attributes the series of parcel fires to Russian military intelligence. The publication cites the Lithuanian prosecutor's office, which named three suspects publicly, a joint investigation team coordinated by Eurojust, and unnamed security sources. I have not read those documents, so the grade stays journalistic rather than official. No verdict has been reached on the parcel explosions themselves.
At 5.45am a container of parcels burst into flames during scanning, before loading onto an aircraft, at the DHL hub at Leipzig airport. The consignment held sex toys, cosmetic tubes and black massage pillows. Nobody was hurt.
arson, infrastructure sabotage
suspected. Someone has named a perpetrator, but this is neither a court finding nor a formal attribution by a state.
VSquare i partnerzy śledczy / 2024-11-01: A journalistic investigation attributes the series of parcel fires to Russian military intelligence. The publication cites the Lithuanian prosecutor's office, which named three suspects publicly, a joint investigation team coordinated by Eurojust, and unnamed security sources. I have not read those documents, so the grade stays journalistic rather than official. No verdict has been reached on the parcel explosions themselves.
A Russian Su-24 violated Swedish airspace east of the southern point of Gotland in the evening. Two Swedish JAS 39 Gripen fighters intercepted and escorted it away; the Swedish pilots issued warnings which received no response from the Russian pilot.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Prague public transport (DPP) bus garages at Klíčov, Prague 9
On the night of Wednesday to Thursday, 5 to 6 June 2024, a Colombian national entered the Klíčov bus garages of Prague's transport operator DPP and set buses alight after pouring engine oil and petrol on their fronts; he filmed the act on his phone. Depot staff put the fire out with hand equipment before it spread; the damage was put at about 200,000 crowns and the court later awarded about 115,000 crowns in compensation. Nobody was hurt. The perpetrator was detained on Saturday 8 June. On 10 June 2024, after a meeting of the State Security Council, Prime Minister Petr Fiala spoke of a suspicion that the attack had been organised and financed from Russia. On 9 June 2025 the Prague Municipal Court, approving a plea agreement, sentenced the perpetrator to eight years for a terrorist attack and the preparation of another; the prosecutor said then that the evidence did not allow a finding that the person who ordered it came from the Russian Federation. On 15 September 2026 the US Department of Justice charged a former colonel of Russian intelligence, an FSB officer and three intermediaries with financing a network one member of which coordinated an attack in Prague in June 2024; the indictment does not name the depot.
arson
officially attributed. A court or a competent state body has attributed it. That is not the same as a proven attack: an indictment is an allegation, not a verdict.
Departament Sprawiedliwości USA (Southern District of New York) / 2026-09-15: The indictment charges a former colonel of Russian intelligence, an FSB officer and three recruiters with conspiring to finance terrorism; among the acts described, one defendant in June 2024 coordinated an attack in Prague by sending a participant potential targets and arranging his travel. The indictment names neither the Klíčov depot nor the man convicted in Czechia; it is a prosecutor's allegation, not a verdict.
Premier Czech Petr Fiala po posiedzeniu Rady Bezpieczeństwa Państwa / 2024-06-10: The government said there was a suspicion that the attack had been organised and financed from Russia as part of hybrid warfare; the prime minister called it probable, not established. A year later, at sentencing, the prosecutor said the evidence did not allow a finding that the person who ordered it came from the Russian Federation.
2025-06-09: The Prague Municipal Court approved a plea agreement: eight years in prison, expulsion and about 115,000 crowns in compensation for a terrorist attack and the preparation of another. The verdict concerns the perpetrator; it does not establish who ordered the act.
2026-09-15: The US Department of Justice announced an indictment of five people, including a former colonel of Russian intelligence and an FSB officer, for financing a network one member of which coordinated an attack in Prague in June 2024. An allegation, not a verdict.
At about 3am the Russian Border Guard unilaterally removed the light buoys with which Estonia marks the course of the border on the Narva river. The Estonian foreign ministry called it a provocative border incident and demanded an explanation and the return of the buoys. The statement does not give their number. Russia offered no explanation.
action by state forces
officially attributed. A court or a competent state body has attributed it. That is not the same as a proven attack: an indictment is an allegation, not a verdict.
Ministerstwo Spraw Zagranicznych Estonii / 2024-05-23: The Estonian foreign ministry stated that the buoys were removed by the Russian Border Guard and demanded their return. The actor here is a state formation acting openly, not an unidentified operator.
Mémorial de la Shoah, Wall of the Righteous, Paris
On the night of 13 to 14 May 2024 red hands were stencilled onto the Wall of the Righteous at the Mémorial de la Shoah in Paris. That night the perpetrators made more than 500 such marks across the city, 35 of them on the memorial itself. A Paris court convicted four Bulgarian nationals of aggravated criminal damage and criminal conspiracy. Nobody was hurt.
provocation or vandalism
suspected. Someone has named a perpetrator, but this is neither a court finding nor a formal attribution by a state.
Direction générale de la sécurité intérieure (DGSI) / 2025-10-31: French counter-intelligence assesses that the operation bears the hallmarks of Russian hybrid interference. In convicting the perpetrators the court spoke of a "concerted and hostile operation" in "a context of interference", but did not establish Russian direction. Convicting those who carried it out and establishing who ordered it are two different things.
2025-10-31: The court sentenced four Bulgarian nationals to between two and four years in prison. The verdict covers criminal damage and conspiracy, not Russian direction.
The fire at the Marywilska 44 retail hall in Warsaw broke out on 12 May 2024 at about 3.30am. More than 240 firefighters and 79 appliances attended, supported by over 60 police officers, and a remote-controlled firefighting robot was used. The governor's statement gave no cause and no casualty information. The 2026 indictment places the fire within a series of arson attacks.
arson
officially attributed. A court or a competent state body has attributed it. That is not the same as a proven attack: an indictment is an allegation, not a verdict.
Prokuratura Krajowa / 2026-03-25: On 25 March 2026 the National Prosecutor's Office filed an indictment covering the arson of the Marywilska 44 shopping centre in Warsaw, alleging that the accused acted "on behalf of the foreign intelligence service of the Russian Federation". An indictment is an allegation, not a verdict.
Arson at the IKEA store in Vilnius, dated 9 May 2024 in the Polish National Prosecutor's indictment covering a series of arson attacks on large retail sites. The extent of the damage and any casualties are not established in the source used. Lithuanian proceedings are separate.
arson
officially attributed. A court or a competent state body has attributed it. That is not the same as a proven attack: an indictment is an allegation, not a verdict.
Prokuratura Krajowa / 2026-03-25: On 25 March 2026 the National Prosecutor's Office filed an indictment covering the arson of the IKEA store in Vilnius, alleging that the accused acted "on behalf of the foreign intelligence service of the Russian Federation". An indictment is an allegation, not a verdict.
Near Mihail Kogălniceanu Air Base, Constanța County
Three unidentified small commercial-type drones were detected near the Mihail Kogălniceanu Air Base on 17 April and brought down using electronic warfare; no wreckage was found. Another similar drone was detected on 18 April. The military prosecutor's office opened an investigation.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
Arson at the OBI store on ul. Radzymińska in Warsaw. The National Prosecutor's indictment dates the act to 13-14 April 2024. The extent of the damage and any casualties are not established in the source used.
arson
officially attributed. A court or a competent state body has attributed it. That is not the same as a proven attack: an indictment is an allegation, not a verdict.
Prokuratura Krajowa / 2026-03-25: On 25 March 2026 the National Prosecutor's Office filed an indictment covering the arson of the OBI store in Warsaw, alleging that the accused acted "on behalf of the foreign intelligence service of the Russian Federation". An indictment is an allegation, not a verdict.
A Russian cruise missile aimed at Ukraine violated Polish airspace near the village of Oserdów for 39 seconds. Polish and allied aircraft were activated in response.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
After 11.30pm a warehouse on the Cromwell Industrial Estate in east London was set alight with petrol. The fire badly damaged two units occupied by Oddisey Ltd and Meest UK Ltd, which shipped parcels and aid to Ukraine. Eight fire engines and sixty firefighters attended. The court put the occupants' loss at nearly £200,000 and the overall damage, including reinstatement, at about £1.3m.
arson
officially attributed. A court or a competent state body has attributed it. That is not the same as a proven attack: an indictment is an allegation, not a verdict.
Central Criminal Court (Old Bailey) / 2025-10-24: In its sentencing remarks the court found: "The attack on the warehouse was commissioned by the terrorist organisation the Wagner Group", proscribed in the United Kingdom on 15 September 2023. The court described the Wagner Group as funded by and closely connected to the Russian state, and from June 2023 under the direct control of the Russian leadership.
2025-10-24: Sentence and remarks at the Central Criminal Court. A sentencing does not create a new incident on the timeline; whether the judgment is final is not established.
Museum of the Occupation of Latvia, Old Town, Riga
At about 1am on 28 February 2024 the perpetrator smashed the first-floor window of the director's office at the Museum of the Occupation of Latvia with a home-made hammer and threw in a bottle of incendiary mixture; the fire covered about 0.5 square metres, rooms and equipment were damaged (property worth over 10,000 euros according to the indictment) and nobody was injured. Police detained the perpetrator on 1 March and the intermediary in the following days; according to the indictment the orderer was Konstantīns Engels, serving a sentence in Daugavpils prison, who promised 4,500 dollars by phone for finding an executor, who agreed for 2,000 euros. On 25 March 2025 Riga City Court sentenced the three men to between four and a half years and six years and two months in prison; the judgment was not yet final. The State Security Service (VDD) examined a possible action in Russia's interests, but in September 2024 the prosecution said no evidence had been obtained that the arson was carried out on the orders of Russian services; a journalistic investigation by dossier.center and TV3's "Nekā personīga" attributed supervision of the operation to a GRU officer. Who stood behind the orderer remains unestablished.
arson, provocation or vandalism
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Rīgas pilsētas tiesa / 2025-03-25: The court convicted the orderer (a prison inmate), the intermediary and the executor. Nothing in the reporting of the judgment indicates a court finding on the involvement of a foreign state; the judgment settles who threw the bottle and who paid for it, not who stood behind the orderer.
Prokuratura Łotwy (za LETA) / 2024-09-04: The prosecution stated that at that stage no evidence had been obtained that the museum arson was carried out on the orders of Russian special services. That is neither an attribution nor an exclusion; it is a statement that evidence was lacking.
dossier.center i TV3 „Nekā personīga” / 2024-09-29: A journalistic investigation reported that the arson was a Russian services operation supervised from Russia by GRU officer Vladimir Lipchenko under the pseudonym "Wlodek Lyakh". That is a journalistic finding, confirmed by neither the prosecution nor the court.
2025-03-25: Riga City Court judgment: Engels 6 years and 2 months, Razmerics 6 years, Lukjanovičs 4 years and 6 months in prison, plus compensation (730 euros material and 1,800 euros moral damages, 5,151 euros to Valsts nekustamie īpašumi). The judgment could be appealed to the Riga Regional Court.
In early 2024, in February according to the prosecution, a parked car with Ukrainian registration plates was set on fire on Mõisavahe street on the outskirts of Tartu; the perpetrators sprayed "KOOS", the name of an Estonian party, on the bonnet and left a message on the Molotov cocktail bottle that Ukrainians could go home. The arson was filmed and spread via Telegram, staged to look like the work of the KOOS party. On 25 March 2025 Tartu County Court convicted Andrey Makarov, a citizen of Estonia and Russia, of treason and sentenced him to 15 years, finding it proven that he had received the arson task from Russia - according to ERR from the General Staff of the Russian Armed Forces, after GRU training; his accomplice, Belarusian citizen Stanislav Markin, had pleaded guilty earlier. On 30 April 2026 Tartu Circuit Court reduced the sentence to 13 years while upholding the finding that the arson was carried out in Russia's interests. The exact day of the arson is not given in the available statements, so the record carries month precision.
day not established
arson, provocation or vandalism
officially attributed. A court or a competent state body has attributed it. That is not the same as a proven attack: an indictment is an allegation, not a verdict.
Tartu Maakohus (Sąd Okręgowy w Tartu) / 2025-03-25: The court found the treason charge proven, including that in early 2024 Makarov received from Russia the task of setting fire to a Ukrainian-plated car in Tartu; according to ERR the court confirmed he had GRU training and that the instruction came from the General Staff of the Russian Armed Forces. A first-instance judgment, not final when delivered.
Tartu Ringkonnakohus (sąd apelacyjny) / 2026-04-30: The appeal court reduced the sentence to 13 years but agreed with the first-instance court that Makarov acted in Russia's interests when he set fire to the Ukrainian-plated car in Tartu in early 2024. Whether the ruling is final is not established.
2025-03-25: Tartu County Court judgment: 15 years for treason, 18,990 euros awarded to the victim jointly with the accomplice. A judgment does not create a new incident on the timeline.
2026-04-30: Tartu Circuit Court reduced the sentence to 13 years, treating two of the four episodes as treason; the finding that the arson served Russia's interests was upheld.
Polish airspace near the Ukrainian border (Lublin Voivodeship area)
A Russian missile violated Polish airspace for less than three minutes, tracked throughout by Polish and allied radar systems. Poland summoned the Russian chargé d'affaires.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Romanian territory near the Ukrainian border (Tulcea County)
A Russian drone violated Romanian airspace and crashed on Romanian territory, prompting German and Romanian fighter jets to be scrambled.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Romanian airspace near the Danube Delta border with Ukraine
A Russian drone was detected in Romanian airspace during an overnight Russian drone attack against Ukraine.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
rocks on the shore near Tyulenovo, Shabla municipality, Dobrich province
On the evening of 17 September, at 21:40, a resident called 112 about an object on the rocks by the shore near Tyulenovo: a section of an unmanned aircraft with a munition attached. A Navy bomb-disposal team arrived at 06:10 and identified an 82 mm fragmentation-high explosive mortar round, too damaged to be moved; at about 11:00 it was detonated in place inside a 150 m cordon, with no damage to buildings or boats. Defence minister Todor Tagarev said the ministry had only photographs and debris and would try to establish the origin from those; the aircraft most likely fell into the sea and was carried ashore. Neither the type of the drone nor its operator has been established.
date found, not date of flight
object found
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
A Romanian Air Force helicopter crew identified drone fragments between the villages of Nufăru and Victoria following a Russian attack on Izmail. According to locals, the drone fell about one kilometre from a nearby military unit.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
A Russian drone fell on Romanian territory during attacks on Ukraine's Izmail port. Romania initially denied any violation, but drone fragments were identified near Plauru on 5 September, with additional fragments found on 9 September.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Shahed drones were confirmed to have flown through Romanian airspace for the first time, probably in order to bypass Ukrainian air defences. Romanian officials said there was no military threat to the country but condemned the Russian strikes on Ukrainian civilian infrastructure.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
From late July 2023, during Russian attacks on Ukrainian ports on the Danube, residents in Romania reported Shahed drones flying over Romanian territory.
day not established
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Moldovan airspace (northern Moldova, missile en route to Ukraine)
A Russian missile violated Moldovan airspace during a mass strike on Ukraine. Moldova summoned the Russian ambassador in protest.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
near the village of Larga, Briceni district (Larga Border Police sector)
On 14 January 2023, the day of mass Russian attacks on Ukrainian cities, a Border Police patrol in the Larga sector of Briceni district found missile debris. The interior ministry said a warhead holding about 80 kg of explosive was detected in the debris; on 15 January engineers of the interior ministry and the National Army destroyed it on site and a 1.5 km radius was searched. The ministry called it the third case of missile debris from the Russian bombardment of Ukraine on Moldovan territory. On 1 February 2023 minister Ana Revenco told the government that the elements found near Briceni and in the Larga sector were fragments of the upper stage of an S-300 system missile and that their origin had not been established. No casualties were reported.
date found, not date of flight
object found, airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Ministerul Afacerilor Interne al Republicii Moldova (Ana Revenco) / 2023-02-03: Moldova's interior ministry (minister Ana Revenco) told the government that the elements found on 5 December 2022 near Briceni and on 14 January 2023 in the Larga sector are fragments of the upper stage of an S-300 system missile and that their origin has not been established. That is a statement about the type of equipment, not about who launched it: the S-300 system is used by both Russia and Ukraine.
2023-02-03: The interior ministry told the government that the elements found near Briceni and in the Larga sector are fragments of the upper stage of an S-300 system missile; the origin was not established.
Near Bydgoszcz (remains found in forest at Zamość near Bydgoszcz)
An unidentified object was detected on Polish radar during a Russian missile attack on Ukraine; neither a US F-15 nor a Polish MiG-29 could visually identify it before radar contact was lost. Missile remains were found in a forest near Bydgoszcz on 27 April 2023 and identified as a Russian Kh-55. The delayed disclosure and radar gaps caused a major political controversy in Poland.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
orchard near the town of Briceni, Briceni district
On 5 December 2022, the day of a mass Russian missile strike on Ukraine, a Border Police patrol found a missile in an orchard near the town of Briceni. Moldova's interior ministry said the area was cordoned off and bomb disposal (Bombteh) and emergency services were called in; the Border Police reinforced patrols in the Briceni and Ocnița sectors. No casualties were reported. On 1 February 2023 interior minister Ana Revenco told the government that the recovered elements were fragments of the upper stage of an S-300 system missile and that their origin had not been established. Who launched the missile remains unestablished: the S-300 system is used by both Russia and Ukraine.
date found, not date of flight
object found, airspace incident
unresolved. The case was looked at and not settled, or the findings are disputed or have been rejected.
Ministerul Afacerilor Interne al Republicii Moldova (Ana Revenco) / 2023-02-02: Moldova's interior ministry (minister Ana Revenco) told the government that the elements found on 5 December 2022 near Briceni and on 14 January 2023 in the Larga sector are fragments of the upper stage of an S-300 system missile and that their origin has not been established. That is a statement about the type of equipment, not about who launched it: the S-300 system is used by both Russia and Ukraine.
2023-02-02: The interior ministry told the government that the recovered elements are fragments of the upper stage of an S-300 system missile; the origin was not established.
A Ukrainian air-defence missile went out of control and crashed into a grain drying facility in the village of Przewodów, killing two Polish civilians. The Polish investigation concluded the missile was of Ukrainian origin, fired during Ukrainian defence against a Russian missile barrage.
airspace incident
officially attributed. A court or a competent state body has attributed it. That is not the same as a proven attack: an indictment is an allegation, not a verdict.
Prokuratura Krajowa, Mazowiecki Wydział Zamiejscowy ds. Przestępczości Zorganizowanej i Korupcji / 2023-09-26: An expert opinion commissioned by the National Prosecutor's Office found that the object which fell on Przewodów was a Russian-made S-300 5W55 air-defence missile fired from a Ukrainian air-defence position. The prosecution service spokesman confirmed the opinion exists. The missile's Russian manufacture and Russian responsibility are two different things: the opinion speaks to the first, not the second.
Prokuratura Krajowa / 2024-01-23: On 23 January 2024 the National Prosecutor's Office said the event was an accident involving a Ukrainian air-defence missile, and suspended the investigation pending requests for international legal assistance. It added that the circumstances cannot be established conclusively, and so it cannot say who specifically is responsible for the two deaths.
northern edge of Naslavcea village, Ocnița District, on the border with Ukraine
On the morning of 31 October 2022 a missile shot down by Ukrainian air defence fell on the northern edge of Naslavcea village, Ocnița District, on the border with Ukraine. According to Moldova's interior ministry it was a Russian missile; there were no casualties, windows in several houses were broken, the area was cordoned off and National Army sappers went to the site. The Ukrainian side reported that Russia had attacked the electrical components of the Dniester dam on the Ukrainian side that morning, 10 km from the Naslavcea dam; Moldova's defence ministry said its systems had detected no illegal flights in the country's airspace. Moldova's foreign ministry condemned the Russian attacks and declared a member of the Russian embassy in Chișinău persona non grata. The number of damaged houses was not given; the description of the missile as Russian comes from the interior ministry's statement.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
A Russian An-30 violated Swedish airspace south of Blekinge on a Friday evening. The violation lasted less than one minute.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
A Russian Orlan-10 reconnaissance drone crashed in Bistrița-Năsăud County, about 100 km from the border with Ukraine; a navigation failure was the most likely cause. It was initially taken for a private commercial drone, but was soon identified as a Russian army machine.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
Zagreb (after transiting Romanian and Hungarian airspace)
A Tu-141 drone flew through Romanian and Hungarian airspace before crashing in Zagreb. Both Ukraine and Russia denied ownership. The Croatian Defence Minister said the governments knew who had launched it but the information was classified.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
Four Russian aircraft (Su-24s and Su-27s) violated Swedish airspace over the Baltic Sea east of Gotland. Swedish JAS 39 Gripen fighters responded and photographed the violation.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
The word "Russian" in this description comes from the source's account of where the object was made or what type it is. It is not a finding about who sent it or on whose orders. This record carries no assessment of responsibility: see the attribution band below.
A Ukrainian Air Force Su-27 suffered technical problems resulting in loss of communication and accidentally entered Romanian airspace on the first day of the full-scale invasion. Romanian F-16s intercepted it and escorted it to the 95th Air Base at Bacău. The aircraft was returned to Ukraine on 1 March.
airspace incident
not assessed. Nobody has yet assessed responsibility for this record. Not assessed is not the same as not established.
Borderline is a register of security incidents in NATO countries and Moldova linked to Russia's war against Ukraine: 11 types of event, from airspace violations to sabotage, arson and cyberattacks with physical effects. This is not a list of Russian attacks. We record separately what happened, and who named a perpetrator on what basis.
Why this map?
A single report says little on its own: a drone over an airport, debris in a forest, fighters scrambled. Placed together in time and space, the same incidents show where they repeat, which months see the numbers rise and how rarely any of it ends in a shoot-down.
The map does not argue on the reader's behalf. It keeps a date, a description and a source next to every point.
How to read Borderline?
Four views divide the work. The map: pick a period on the timeline, click a point, a card opens. The archive: full-text search and every filter, from type of event to effects. The story walks through selected cases, chapter by chapter.
One point is one event, placed at a location representative of the name given in the source rather than at an impact site. A circle with a number is a group of nearby events; clicking expands it. Some entries have no point and appear only in the archive.
Sources & method
The register holds 312 events from 24 February 2022 to 28 October 2026. Below: what it covers, what counts as one event, where the information comes from, how we assess responsibility and how precise the locations are.
Scope and exclusions
We observe events on the territory of current NATO members and Moldova. The research window opens on 1 January 2022; the earliest entry held dates from 24 February 2022. The first date says when we start looking, the second when we first have something. The absence of earlier entries is not a finding that nothing happened.
Other European states are out of scope, even where comparable events occurred. That is a limit of scope, not an assessment: the register is an editorial selection, not a complete census of incidents in Europe.
Some events happen outside any state's territory: in international waters and on the seabed. We do not assign such entries to the nearest landmass.
Individual cases are excluded by a scoping decision of the author and kept in a separate internal list. An exclusion asserts neither that responsibility has been settled nor that it has not.
The register also holds events with no Russian thread, and those stay too.
What counts as an event
One event is one entry, even when it carries several types or touches several countries. Types overlap: an airport disruption is often also an airspace violation. Per-type tallies are therefore higher than 312, by design.
We record separately whether the event occurred and whether the act was completed, attempted or foiled. A drone sighting is not evidence of an attempted attack, and a confirmed airport stoppage can have an unconfirmed cause.
Successive closures of the same airport are not added together twice, and the number of months in which something happened is not the number of events.
Verdicts, indictments and later findings are recorded as updates to an existing event. They do not create a new point on the timeline.
Sources and verification
The core of the register comes from the Polish and English Wikipedia survey lists, that is from secondary sources. 183 entries have since gained sources other than those lists: institutional statements, case documents and media reporting. 129 entries still rest on those two lists alone.
Verification is our editorial check, separate from what agencies or courts have established. An entry is marked verified when it rests on a source outside those two lists and that source was read in full. There are 182 such entries; 130 of 312 have not passed that check. Verified does not mean we have established who did it; unverified does not mean false, only unchecked against a source of our own.
For 75 entries the sources give different values, most often dates. The disagreement is recorded on the entry, together with the value we adopted.
Attribution and uncertainty
Officially attributed covers 26 entries, where a court or a competent state body has attributed it. This is not a count of proven attacks: an indictment is an allegation, not a verdict.
Suspected covers 23 entries: someone has named a perpetrator, but neither a court nor a state has done so formally. An official suspicion is still a suspicion.
Unresolved covers 92 cases examined and not settled, disputed, or where an attribution was rejected. A rejected attribution is not the same as a live suspicion.
Not assessed covers 171 entries with no assessment of responsibility in this register. It is the largest group. It does not mean "nobody has looked" or "no connection".
Every attribution carries the grade of its basis: A is a court finding, B an official attribution by a state body, C an official suspicion, D a documented journalistic investigation. D never masquerades as C.
The country where equipment was made, the nationality of the person who carried something out, who flew the device and who ordered the act are four different pieces of information. An object described as Russian-made is not a suspicion against anyone: such entries stay in the "unresolved" band, and the validator refuses any attribution resting on equipment origin alone.
Location and routes
Coordinates are usually derived from a place name rather than read from a source; 0 have been verified. A marker's outline shows the attribution band, not the precision of the coordinates. We deliberately do not draw an uncertainty radius, because there is no basis on which to estimate one.
The country a record is filed under is not the same thing as where the event happened in law. 15 events happened outside that country's territory: 14 in its exclusive economic zone, 1 in international waters. For 6 entries the sources do not settle it. The card says so plainly. A violation over the territorial sea counts as an event on territory, because that is how the law counts it.
74 entries have no point on the map: the event runs for tens of kilometres, or touches several places at once. Those entries live in the archive and say so, rather than being given an invented pin.
39 entries carry a route: 39 are schematic, straight segments between places named in the reporting, and 0 have documented geometry. A schematic route is not a radar track, and the path between the points is unknown.
Jakub Górnicki.
A Polish journalist and artist, winner of the Polityka Passport award, co-founder of Outriders. Borderline is another project in which reporting takes the form of a tool, after the reporting game Bottleneck about the Strait of Hormuz and after Zondatracker.
This is a working editorial prototype, not a finished publication. The data is incomplete and will keep growing.
If you spot an error in a date, a place or a source attribution, or you know of an incident that is missing here, get in touch. A message on LinkedIn or Instagram reaches me fastest.