Russia · 24 September, 2026 · 2 min read
Recorded Future Says Russia Tests Defenses With Hybrid Cyber-Physical Attacks Across Europe
CIA warned several European governments Russia may launch sea-based Gerbera drones at Spain, France, Italy. Mediterranean targets cited include Spain, France, and Italy, per El Mundo report.
Whether the main risk is provocations or conventional incursion.
11 of 12 outlets skipped it: narva scenario: limited attack to break NATO Article 5 commitments.
47outlets compared
Same story, two versions
tap a side to read it in full
Radio Free Europe/Radio Liberty
“We are not talking about a conventional war. We are talking about all kinds of provocations”Read the original ↗
Institute for the Study of War
“a full-scale Russian invasion of a NATO state is extremely unlikely while Russia remains fully committed to war against Ukraine.”Read the original ↗
Radio Free Europe frames the threat as broad provocations, while ISW emphasises limited scenarios like Narva rather than conventional invasion.
Hybrid war, Europe targeted
Recorded Future’s Insikt Group said Russia’s hybrid cyber-physical war in Europe is aimed at testing defenses, degrading, and fostering fear in an enemy’s government and population, and it stops short of a kinetic, boots-on-the-ground invasion. Recorded Future linked the approach to water and wastewater attacks targeting Norway and Poland, and it also described attacks against Poland’s energy infrastructure attributed to Russia-aligned actors.
Recorded Future reported that Russian drones have violated NATO airspace by flying near Estonia’s border, and it added that Romanian authorities intercepted and destroyed a Russian drone detected near Romania’s Neptun Deep offshore gas project in the Black Sea. Chelsea Cederbaum, a senior threat intelligence analyst at Recorded Future, said the key metric for evaluating a company’s risk of Russian targeting is its proximity to providing material support to Ukraine’s war effort, and she said outside of traditional critical infrastructure, logistics and dual-use firms are at high risk.
CIA drone warning disputed
El Mundo’s reporting, as repeated in multiple outlets, said U.S. intelligence services warned several European governments that Russia could prepare drone attacks against Spain, France, or Italy using drones launched from ships at sea. Emmanuel Macron denied that the CIA had informed French services of such an attack, while Macron still called Russia’s actions in Europe “hostile acts that can kill” and said Russia now views Europe as the strategic depth of Ukraine.
The scenario described drones launched from merchant ships that would sail as part of ordinary commercial traffic, and it said the aircraft indicated is Gerbera, measuring about two meters, weighing around 18 kilograms, and traveling at approximately 160 km/h. France 3 Régions said the map published by El Mundo put Marseille, Toulouse, and Lyon within reach of the devices, while it said Paris would not be within reach.
NATO, risk assessments, next steps
The Danish Defense Intelligence Service assessed that Russia will probably intensify its so-called hybrid war against the West and NATO, and it placed the risk of limited military attacks against a member country of the Alliance as “low, but rising.” Thomas Ahrenkiel said there is a “small but growing risk” that Russia would carry out limited military strikes against a neighboring NATO country.
The CIA warning, relayed through a source close to Lithuania’s Ministry of Defense, described drones launched from the sea hidden in the hold of a ship, and it said the ships would position themselves 200 to 300 kilometers off the French, Spanish, or Italian coasts. Krzysztof Gawkowski described a fire at a Starlink station in the Mazovia voivodeship as “deliberately set to disable the station,” and it said he stated that “many clues suggest that this aligns with Russia's new doctrine of attack.”