CIVIL Hybrid Threats Monitoring
THE STRATEGY | Exhausting the support network
Russia’s latest escalation is not best understood as preparation for an immediate conventional attack on NATO. It is a campaign against the systems that connect Ukraine’s defence to European support: communications, defence manufacturers, logistics infrastructure, commercial shipping and political cohesion.
The objective extends beyond physical damage. Moscow is attempting to make support for Ukraine slower, more expensive and personally dangerous, and to persuade European governments, companies and citizens that continued involvement carries uncontrollable risks.
THE SHADOW WAR | Sabotage and psychological operations in Europe
Poland has formally attributed the September arson attack on a Starlink facility south of Warsaw to Russian intelligence. Two Turkish citizens were arrested in Germany on suspicion of setting fire to a Starlink satellite ground station. Polish authorities say Moscow is increasingly using expendable intermediaries connected to criminal networks, recruited for limited tasks that obscure the connection to Russian handlers.
The Polish case is part of a much wider pattern. Germany’s interior minister described the situation as a “shadow war,” while the head of the Bundesamt für Verfassungsschutz (BfV – Federal Office for the Protection of the Constitution) warned of Russian sabotage, information manipulation and assassination planning. The Financial Times, citing five European intelligence services, reported that defence-company executives – particularly those working on drones and specialised components – are increasingly being targeted. Even when these plots are foiled or fail to materialize, their true aim is psychological. The goal is to create a chilling effect, terrorizing employees, investors, and suppliers into reconsidering their support for Ukraine.
WEAPONIZATION OF THE WINTER | Accelerating infrastructure strikes
Inside Ukraine, Russia’s winter coercion campaign is accelerating. On 15 October, Russia launched 580 drones – including more than 360 against the central Kirovohrad region. Critical infrastructure, transport, logistics facilities and residential buildings were struck.
Satellite imagery analysed by Reuters also shows that Russia constructed a vast new jet-drone launch complex near Millerovo in only six weeks. Experts assess that it could support faster Geran-4 and Geran-5 drones, further straining Ukraine’s already limited interception capacity.
THE BLACK SEA | Expanding the danger zone and testing NATO
The danger zone is also expanding across the Black Sea. At least seven commercial vessels have been attacked by drones during October, leaving two people dead and at least 25 missing. Most incidents occurred in the exclusive economic zones of Romania and Bulgaria, while one attack reached Romanian territorial waters.
While Russia remains the principal suspect and the obvious strategic beneficiary, attribution has not been definitively established. That calculated ambiguity is a weapon in itself. Even without formal attribution, these attacks drive up maritime insurance costs, choke Ukraine’s export routes, and deliberately test the limits of NATO’s response threshold.
COALITION VULNERABILITIES | Tech dependencies and political disruption
A particularly serious vulnerability appeared within Ukraine’s support coalition. Ukraine’s access to the US-controlled Starshield satellite system was temporarily restricted, disrupting strike and air-defence drone missions. The service was restored after approximately one day, but the episode demonstrated how one external political or administrative decision could suddenly degrade Ukrainian battlefield capabilities.
Reuters traced the instruction to the White House, although who ordered it and why remain unresolved. The strategic effect benefited Moscow by constraining Ukraine and shifting attention from Russian attacks to divisions among Ukraine’s partners.
THE WESTERN BALKANS | Information operations and electoral integrity
The Western Balkans form another part of this contested space. Montenegro expelled Rybar founder Mikhail Zvinchuk and four Russian associates on national security grounds after police seized a drone, cameras, phones and sophisticated digital equipment. Their precise intended activity has not been publicly established, but the case shows that information operations also possess a physical infrastructure involving travel, filming, equipment and local relationships.
As detailed in an extensive investigative dossier by CIVIL in Macedonian, Zvinchuk returned to Moscow and explicitly thanked Russian intelligence services and the state defense corporation Rostec for their intervention, publicly announcing that the Rybar network will continue its operations across the Western Balkans.
Serbia’s 25 October election is now the region’s immediate democratic-resilience test. International monitors have documented intimidation, surveillance allegations, media inequality and unexplained voter-register anomalies.
While the EU recently sanctioned 77 individuals for organizing Russia’s sham elections in occupied Ukraine, a glaring policy gap remains. Foreign ‘pseudo-observers’ who lend a veneer of international legitimacy to these illegal processes face little to no consequences. This loophole makes CIVIL’s documented case on Goran Dimov and Levica case (published April 2026) particularly relevant.
FORECAST | Sustained escalation below the threshold
The most likely near-term scenario is not a direct Russian military invasion of NATO territory. Rather, it is a sustained escalation just below that threshold. We can expect an increase in sabotage operations, intensified strikes on Ukrainian infrastructure, mounting pressure on commercial shipping, and relentless information campaigns designed to transform fear into fatigue, and fatigue into political retreat.
This report was prepared with the assistance of AI systems for monitoring, copyediting, and structure. The CIVIL team retains full editorial responsibility.
IF YOU VALUE CIVIL’S WORK, SUPPORT IT. Donate TODAY.
IF YOU VALUE CIVIL’S WORK, SUPPORT IT. YES, YOU.
Your support helps us report independently, sustain democratic dialogue, expose disinformation and hybrid threats, and defend human rights and freedom of expression.
Support for independent journalism starts with you.
Support CIVIL. Donate TODAY.
