Loading story…
Slovak authorities disrupted a planned arson attack against a Skyeton drone-manufacturing facility near Prešov that produces unmanned systems for Ukraine’s military. In Germany, authorities investigated suspected sabotage using improvised devices intended to short-circuit a substation connected to the Jänschwalde power complex, while Berlin publicly attributed a drone attack on Leipzig/Halle Airport to Russia and raised its threat assessment.
The incidents indicate an escalation in suspected Russia-linked hybrid activity targeting European defense production, logistics, airports, and energy infrastructure supporting Ukraine. Russia is increasingly assessed to be using locally recruited criminal proxies—reportedly including recruits found via Telegram—as expulsions of intelligence personnel restrict operations conducted under diplomatic cover; affected organizations should incorporate physical-security, insider-risk, reconnaissance, and proxy-recruitment indicators into security programs.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
Germany publicly accused Russia of responsibility for a drone attack on Leipzig/Halle Airport. German officials raised the national threat assessment and announced diplomatic measures in response.
German authorities reported an attempted deliberate short circuit of a substation connected to the Jänschwalde power complex using improvised devices.
Slovak authorities said they disrupted a planned arson attack targeting Skyeton's drone-manufacturing facility near Prešov, Slovakia, which produces unmanned systems for Ukraine's military.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcetruesec.com
Open sourcemorgenpost.de
Open sourceeuronews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Germany has attributed an August drone incident in Leipzig to Russia, reinforcing concerns that Moscow is intensifying deniable operations on NATO territory. Public reporting linked the incident to an explosive-drone discovery at Leipzig/Halle Airport; related German investigations have also examined alleged Russian-linked reconnaissance of parcel-bomb routes and a suspected weapons cache intended for covert violence. The incident fits a broader Russian hybrid campaign combining sabotage, cyber activity, drone incursions, disinformation, election interference, and pressure on European defense and Ukraine-support supply chains. Intelligence assessments judge further hostile activity and significant cyber operations in NATO countries likely, with ambiguous attacks intended to test alliance cohesion and complicate an Article 5 response, while an imminent conventional Russian invasion of NATO remains unlikely.
Sep 3, 2026
U.S. prosecutors unsealed an indictment accusing a Russian intelligence-linked **RIS Network** of directing surveillance, assassination, and sabotage operations across Europe and the United States. The alleged network recruited operatives to target Russian dissidents, offered payments for attacks on NATO-related electrical infrastructure in countries supporting Ukraine, and was linked to an attempted June 2024 arson attack on a Prague bus depot and a planned September 2024 attack in Lithuania. Five defendants—including former Russian intelligence colonel Yuri Khrameev, FSB officer Kirill Khrameev, and logistics coordinator Oemis Romagoza Durruthy—remain at large on U.S. terrorism-financing charges. Separately, reporting indicates Russia-linked actors have approached participants in **“The Com,”** a largely Western online ecosystem containing violence-for-hire and cybercriminal subcommunities, to recruit young people as disposable agents for sabotage missions. Recruitment reportedly occurs through online platforms including Telegram and forms part of a broader hybrid campaign intended to weaken European backing for Ukraine; at least two UK attacks have reportedly been tied to Russia-linked actors. The reporting found no indication that Russian intelligence has recruited the distinct **Hacker Com** segment, despite activity in overlapping online spaces.
Sep 17, 2026
New analysis warns Russia is likely to escalate its opportunistic hybrid activity in Europe into a more coordinated campaign consistent with **New Generation Warfare (NGW)** doctrine, integrating cyber operations, influence activity, and sabotage across a broader geographic footprint and at higher tempo. The assessment anticipates more synchronized, multi-domain actions designed to degrade NATO cohesion and readiness—such as pairing physical disruption (for example, airspace violations affecting critical infrastructure like airports) with cyberattacks (for example, **DDoS** against communications) to amplify operational and psychological impact. Ukrainian officials are simultaneously pushing for tighter regulation of **Telegram**, citing its repeated use by Russian intelligence to recruit locals for sabotage and terrorist attacks; the calls followed a deadly incident in Lviv that Ukrainian leadership attributed to Russia and said involved recruitment via Telegram. Separately, polling across major NATO countries indicates strong public support for treating severe hybrid actions—such as cyberattacks that shut down hospitals or power grids and sabotage of undersea cables or energy pipelines—as **acts of war**, highlighting a growing gap between public sentiment and NATO governments’ typically restrained responses to hybrid aggression.
Jul 12, 2026