Full Report
Polish Defense Minister Wladyslaw Kosiniak-Kamysz said the drone struck Ukrainian territory around 2 kilometers (1.2 miles) from the Dorohusk crossing and did not enter Polish airspace.
Analysis Summary
# Incident Report: Kinetic Strike Near Yahodyn-Dorohusk Border Crossing
## Executive Summary
On September 28, 2026, a Russian unmanned aerial vehicle (UAV) conducted a kinetic strike in Ukrainian territory approximately 2 kilometers from the Polish border. While the strike did not breach Polish airspace or damage the Yahodyn crossing infrastructure, it represents a continued pattern of Russian military operations targeting logistics and transit hubs in close proximity to NATO territory. In response, Poland has announced a significant shift in its Rules of Engagement (ROE) to allow for radar-based identification and neutralisation of aerial threats.
## Incident Details
- **Discovery Date:** September 28, 2026
- **Incident Date:** September 28, 2026
- **Affected Organization:** State Border Guard Service of Ukraine / Yahodyn Border Crossing
- **Sector:** Government / Critical Infrastructure / Logistics
- **Geography:** Volyn Oblast, Ukraine (near Dorohusk, Poland)
## Timeline of Events
### Initial Access
- **Date/Time:** September 28, 2026 (Afternoon)
- **Vector:** Aerial Incursion (Kinetic)
- **Details:** Ukrainian monitoring channels detected Russian drones moving toward the Yahodyn border crossing during the afternoon hours.
### Lateral Movement
- **N/A:** This was a kinetic strike; movement involved the flight path of the UAV through Ukrainian airspace toward the western border.
### Data Exfiltration/Impact
- **Kinetic Impact:** The drone struck Ukrainian territory several hundred meters from the border and approximately 2 kilometers from the Polish crossing at Dorohusk.
- **Physical Damage:** No damage was reported to the Yahodyn crossing infrastructure itself during this specific event, though previous strikes in the same month hit a gas station, a truck, and a passenger train locomotive.
### Detection & Response
- **Detection:** Detected via Ukrainian monitoring channels and Polish radar/air defense systems.
- **Response actions taken:** Poland scrambled military aircraft and placed air defense systems on high alert.
## Attack Methodology
- **Initial Access:** Physical airspace incursion via UAV.
- **Persistence:** N/A
- **Privilege Escalation:** N/A
- **Defense Evasion:** Low-altitude flight intended to bypass or pressure air defense responses near international borders.
- **Credential Access:** N/A
- **Discovery:** Surveillance of logistics and transport hubs (trains, border crossings).
- **Lateral Movement:** Flight trajectory toward western Ukrainian borders.
- **Collection:** N/A
- **Exfiltration:** N/A
- **Impact:** Kinetic strike (Explosive/Physical destruction).
## Impact Assessment
- **Financial:** Minimal for this specific strike; however, previous strikes in the area damaged transport vehicles and locomotives.
- **Data Breach:** None.
- **Operational:** Disruption of border transit security; increased alert levels for Polish and Ukrainian border forces.
- **Reputational:** Increased regional tension and pressure on NATO border security protocols.
## Indicators of Compromise
- **Network indicators:** N/A
- **File indicators:** N/A
- **Behavioral indicators:** UAV flight paths originating from Russian-controlled areas heading toward sensitive border transit points (Yahodyn/Dorohusk).
## Response Actions
- **Containment measures:** Scrambling of Polish military aircraft and activation of air defense readiness.
- **Eradication steps:** (Pending) Polish government announced a policy shift to allow shooting down objects based on "positive identification" via radar.
- **Recovery actions:** Ongoing monitoring of the border region by the Ukrainian State Border Guard Service.
## Lessons Learned
- **Visual Identification Limits:** The previous requirement for Polish pilots to visually confirm a target in peacetime is insufficient for high-speed drone incursions near the border.
- **Proximity Risk:** Strikes occurring within 800m to 2km of a NATO border create a high risk of accidental escalation or debris falling into neutral territory.
- **Pattern Recognition:** Russia is systematically targeting the logistics artery between Ukraine and Poland.
## Recommendations
- **Modernize ROE:** Implement the proposed Polish policy change allowing radar-based identification for immediate threat neutralisation.
- **Enhanced Signal Intelligence:** Increase electronic warfare (EW) and jamming capabilities at border crossings to neutralize drones before they reach the border perimeter.
- **Civilian Protection:** Maintain heightened security protocols for passenger rail and commercial trucking operating within 5km of the border.