Loading story…
Poland intercepted and shot down multiple Russian drones that violated its airspace during a large-scale Russian attack on western Ukraine. In response, Poland invoked NATO Article 4, triggering emergency consultations with allies and temporarily closing key airports. This incident marks a significant escalation in regional tensions and highlights the risk of spillover from the Russia-Ukraine conflict into NATO territory.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
4 references tracked. Mallory keeps watching after this page renders.
recordedfuture.com
Open sourcearstechnica.com
Open sourcewired.com
Open sourcecert.gov.ua
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Germany has attributed an August drone incident in Leipzig to Russia, reinforcing concerns that Moscow is intensifying deniable operations on NATO territory. Public reporting linked the incident to an explosive-drone discovery at Leipzig/Halle Airport; related German investigations have also examined alleged Russian-linked reconnaissance of parcel-bomb routes and a suspected weapons cache intended for covert violence. The incident fits a broader Russian hybrid campaign combining sabotage, cyber activity, drone incursions, disinformation, election interference, and pressure on European defense and Ukraine-support supply chains. Intelligence assessments judge further hostile activity and significant cyber operations in NATO countries likely, with ambiguous attacks intended to test alliance cohesion and complicate an Article 5 response, while an imminent conventional Russian invasion of NATO remains unlikely.
Sep 3, 2026
Polish officials reported thwarting what they described as the most serious cyberattack on the country’s energy infrastructure in years, saying the intrusion came close to causing a widespread power outage. The attempted disruption occurred in the final days of December and targeted communications links between multiple renewable energy installations—such as **solar farms** and **wind turbines**—and electricity distribution operators across large parts of Poland, in what authorities characterized as a coordinated sabotage effort. Digital Affairs Minister Krzysztof Gawkowski said the incident “very close to a blackout” appeared to be a deliberate attempt to cut power to Polish citizens and that “everything points to Russian sabotage,” though officials did not provide technical details, name a specific threat actor, or disclose the defensive measures implemented afterward. The incident reflects a broader pattern of increased Russia-linked cyber activity against Polish critical infrastructure since Russia’s 2022 invasion of Ukraine, alongside ongoing kinetic strikes on Ukraine’s energy system that Ukrainian authorities have described as creating an “unprecedented” energy crisis.
Jun 29, 2026
Denmark has raised its threat level for destructive cyberattacks from **medium** to **high**, citing intelligence assessments that Russia is increasingly likely to conduct hybrid activity, including disruptive cyber operations, against Denmark and other NATO members in the coming months. Authorities warned that wiper malware and attacks on operational technology (OT) pose particular risks to critical infrastructure, referencing a late-2024 attack on a Danish waterworks and a disrupted December 2025 attempt against Poland’s energy sector; public agencies and critical-function operators were urged to strengthen incident planning, cyber resilience, and OT defenses. Recorded Future’s Insikt Group reported that Russia has expanded its “New Generation Warfare” across Europe since the invasion of Ukraine, combining cyberattacks, influence operations, physical sabotage, and airspace and maritime incursions. Reported incidents include an explosive drone at Leipzig/Halle Airport, a maritime drone near Romania’s Neptun Deep gas project, attacks on Norwegian public-sector portals, and Russian drones near Estonia. The group assesses that such activity will likely intensify over the next two years, elevating the risk of data loss, service disruption, facility damage, and danger to personnel, while judging Moscow is unlikely to intentionally trigger NATO Article 5 through mass casualties or permanent infrastructure destruction.
Sep 24, 2026