Loading story…
Russia’s Rubikon drone unit emerged as a heavily resourced military formation combining combat operations, research, and training, and became known for using unmanned systems to strike Ukrainian logistics, vehicles, artillery, and drone crews. Reporting says the unit gained influence on multiple fronts and emphasized deep interdiction of supply lines rather than frontline infantry attacks. Its operations reportedly included long-range drone strikes using terminals linked to Starlink, but public disclosure of those tactics prompted SpaceX to disable non-whitelisted terminals in Ukraine, disrupting a key Russian communications channel and reducing the unit’s ability to coordinate such attacks.
The pressure campaign tied to Russia’s war effort has also extended beyond the battlefield into Europe’s defense-industrial base supporting Ukraine. Recent reporting describes Russia-linked espionage, sabotage, intimidation, and possible assassination plotting aimed at drone manufacturers, logistics firms, technology providers, and senior executives, including surveillance of Donaustahl CEO Stefan Thumann and references to an earlier alleged plot against Rheinmetall CEO Armin Papperger. Russian military publication of European drone manufacturers’ addresses and GRU-linked cyber activity targeting shipment schedules, routes, manifests, and cargo details point to a broader effort to disrupt the people, companies, and supply chains sustaining military aid to Ukraine.
TTPs, infrastructure, and targeting history in one profile.
13 events from the most recent confirmed update back to the earliest known activity.
In April 2026, Russia’s Ministry of Defense publicly released the addresses of European drone manufacturers supporting Ukraine, an action the article assesses as target signaling and intimidation.
The article says Rubikon alone conducted 48,500 combat sorties in January 2026 and struck about 1,300 Ukrainian personnel and nearly 1,000 vehicles and armored vehicles that month.
Canada sanctioned Rubikon leader Colonel Sergey Budnikov in November 2025 for supporting Russia’s invasion of Ukraine.
Rubikon’s logistics interdiction campaign on the Sumy-Kursk border continued into March 2025, with Ukrainian sources and analysts describing it as an important factor in pressuring Ukrainian positions.
According to the article, Rubikon’s operations against Ukrainian logistics on the Sumy-Kursk border in February and March 2025 contributed to Ukraine’s withdrawal from its Kursk foothold.
At the end of 2025 and beginning of 2026, Rubikon began publishing videos of long-range strikes conducted 100 to 240 kilometers from the front using drones equipped with Starlink terminals.
German authorities reportedly investigated surveillance of Donaustahl CEO Stefan Thumann and his family in late 2025 and early 2026, including alleged filming of his home and efforts to identify his whereabouts through family members.
The article says Rubikon began using and developing unmanned surface vessels from summer 2025, expanding beyond aerial drone operations.
The first public videos showing Rubikon’s combat activity appeared in October 2024, marking its public emergence as a Russian military drone formation.
Russia’s Ministry of Defense says the Experimental Center for Advanced Unmanned Technologies Rubikon was created in August 2024 by decision of Defense Minister Andrei Belousov, based on an existing drone unit.
Western officials warned in 2024 that Russia was conducting sabotage across Europe, including arson, vandalism, and assassination plots.
In 2024, U.S. intelligence reportedly helped Germany disrupt a Russian plot against Rheinmetall CEO Armin Papperger, cited as part of a broader Russia-linked campaign against European defense support for Ukraine.
After videos of Rubikon’s long-range strikes appeared, SpaceX blocked non-whitelisted Starlink terminals on the territory of Ukraine, according to the article. Ukrainian military sources said the deactivations disrupted Russian command and control and caused pauses in assault operations on some sectors.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcebbc.com
Open sourcesvoboda.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ukrainian hacktivists linked to the **Fenix cyber analytics center**, supported by **InformNapalm**, reported compromising accounts belonging to dozens of Russian military personnel and gaining access to monitoring systems used by Russian attack-drone operators. The operation allegedly enabled covert, near real-time surveillance of drone-operator activity and the transfer of collected data to Ukrainian Defense Forces, and it was cited in reporting around Ukraine’s decision to sanction Belarusian leader Alyaksandr Lukashenka over Belarus’s role in enabling Russia’s use of **repeater infrastructure** on Belarusian territory to extend UAV control and expand strike reach into northern Ukraine, including against energy and rail targets. Separately, Dutch intelligence services (**AIVD/MIVD**) warned that Russia is intensifying a broader **hybrid warfare** campaign across Europe—combining cyberattacks, sabotage, disinformation, covert influence, and espionage—to undermine public trust and weaken support for Ukraine while staying below the threshold of open war. In parallel, telecom-focused research highlighted how **public mobile networks** are increasingly being used as command/telemetry links for combat drones, citing examples from the Russia–Ukraine war and describing how 4G/5G standards work (e.g., 3GPP enhancements in Releases 15–18) has made cellular-connected UAV operations more feasible—raising infrastructure-security concerns for mobile operators and national critical infrastructure.
Jun 29, 2026
The UK Ministry of Defence reported a sharp increase in **drone sightings near British military bases**, citing **266 incidents** last year versus **126 in 2024**, and linked the trend to concerns about hostile reconnaissance of sensitive defence sites, including airbases used by the **US Air Force**. In response, the UK government is moving to expand authorities under the **Armed Forces Bill** so designated military personnel can directly intervene against threatening uncrewed systems—covering **air, land, and submersible drones**—without first requiring police involvement. In Ukraine, **SpaceX and Ukrainian authorities** implemented an **emergency measure** to disable **unauthorized Starlink terminals** being used to control Russian long-range drones, following reports that Russia continued leveraging Starlink-enabled connectivity for strikes deeper inside Ukraine. Ukrainian officials characterized the action as a temporary fix that may also disrupt some legitimate users, while SpaceX and Ukraine pursue a more durable approach to prevent unauthorized use of the satellite service in contested environments—highlighting how **commercial communications infrastructure** is being exploited as part of drone-enabled warfare and broader hybrid threats across Europe.
Jul 3, 2026
Cyber operations tied to Russia’s invasion of Ukraine ranged from destructive malware and espionage to broader disruption against Ukrainian and allied targets. Researchers and government agencies documented **WhisperGate**, **HermeticWiper**, **CaddyWiper**, **DoubleZero**, and **FoxBlade** activity against Ukrainian networks, while Microsoft said it seized seven **Strontium** domains used to target Ukrainian institutions, media, and foreign-policy organizations in the U.S. and EU. Talos also reported a campaign against a Ukrainian software developer using a modified **GoMet** backdoor, raising supply-chain concerns, and Symantec described sustained **Shuckworm/Gamaredon** espionage using multiple **Pterodo** variants for persistence. Later reporting warned that Russian operations were expanding beyond Ukraine to logistics, transportation, defense, and energy organizations supporting Kyiv, including activity in Poland and across Europe’s defense supply chain.
Aug 15, 2026