Full Report
The Russian special services are targeting military facilities, critical infrastructure, and communication systems, Ukraine's military intelligence service (HUR) warned.
Analysis Summary
# Threat Actor: Russian Special Services (GRU & FSB)
## Attribution & Identity
* **Actor Identification:** General Staff of the Russian Armed Forces (GRU) and the Federal Security Service of the Russian Federation (FSB).
* **Aliases:** Russian Special Services, Kremlin-backed agents.
* **Known Associations:** Aggressor state of Russia, specialized sabotage units within the Russian military and intelligence apparatus.
## Activity Summary
According to Ukrainian military intelligence (HUR), these actors are executing a coordinated "hybrid warfare" campaign across Europe. Recent operations include:
* **August 2026:** A sabotage attempt involving modified FPV drones targeting Ukrainian Antonov cargo aircraft at Leipzig Airport, Germany.
* **September 2026:** A suspected arson attack/sabotage at a Starlink ground station in Wola Krobowska, Poland, operated by Exatel.
* **Ongoing:** Preparations for increased activity within EU and NATO states to undermine aid to Ukraine and weaken Alliance capabilities.
## Tactics, Techniques & Procedures
* **Kinetic Sabotage:** Arson, assassinations, and bombings of infrastructure.
* **Aerial Attacks:** Use of modified FPV (First Person View) drones for precision strikes on high-value logistical assets (e.g., transport aircraft).
* **Hybrid Warfare:** Coordinated use of cyberattacks, drones, and physical sabotage to test NATO defenses.
* **Agent Recruitment:** Involvement of recruited agents based within European territory to execute local operations.
* **MITRE ATT&CK IDs:** While not explicitly named in the text, the activities correspond to:
* **T1592:** Gather Victim Host Information (Surveillance of critical infrastructure).
* **Physical Security Breach:** (Implied through arson/sabotage).
## Targeting
* **Sectors:** Military facilities, Critical Infrastructure, Telecommunications, Logistics, and Transport.
* **Geography:** European Union (EU), NATO member states (specifically Germany and Poland).
* **Victims:** Starlink satellite internet receiving stations, Exatel (Polish telecom), Antonov cargo aircraft, and military aid supply lines to Ukraine.
## Tools & Infrastructure
* **Modified FPV Drones:** Used as improvised explosive devices (IEDs).
* **Satellite Ground Stations:** Starlink receiving stations (primary communication targets).
* **Logistics Hubs:** European airports and telecommunication hubs.
* **Infrastructure:** Polish state-owned telecommunications company Exatel (targeted infrastructure).
## Implications
The strategic shift toward kinetic "hybrid" operations on NATO soil indicates a Russian effort to move beyond cyber-espionage into physical disruption. By targeting satellite communication hubs (Starlink) and logistics (Antonov aircraft), Russia aims to sever the supply and communication lines essential for Ukrainian battlefield operations. This represents a significant escalation in the risk profile for critical infrastructure providers across Europe.
## Mitigations
* **Enhanced Physical Security:** Increase surveillance and perimeter security around satellite ground stations and military logistics hubs.
* **Drone Defense:** Implementation of C-UAS (Counter-Unmanned Aircraft Systems) at civilian airports and critical communications sites.
* **Intelligence Sharing:** Strengthening of HUR, EU, and NATO intelligence cooperation to identify and neutralize GRU/FSB recruited agents operating within Europe.
* **Resiliency Planning:** Diversification of communication channels beyond single points of failure like specific Starlink ground hubs.