Russia, Ukraine, and Eastern Europe Intelligence Report - September 2025

Patrick René Haasler
Oct 20
30 min read

This report is an open-source intelligence (OSINT) assessment of developments in Russia, Ukraine and Eastern Europe. It integrates cross-media sources, official statements and satellite-verified material to provide sourced facts, contextual analysis and clearly defined intelligence cut-off dates for each reporting period.

By Patrick René Haasler for the Europinion Institute for Research

25 August - 3 September 2025

Executive Summary

Russia-Ukraine: Ukraine conducted its first strike with the domestically produced FP-5 “Flamingo” cruise missile against a Russian target in Crimea, marking a significant step in its independent weapons development. The long-range missile enhances Ukraine’s ability to hit deep targets such as refineries and infrastructure in Russia, increasing pressure on Moscow but also heightening the risk of escalation.

Russia-Ukraine: During a security briefing, a map showing Odesa and Mykolaiv as Russian territory appeared behind General Gerasimov, a deliberate move seen as part of Russia’s strategic pressure campaign to push President Zelensky toward accepting a negotiated settlement.

US-Russia-Ukraine: Peace negotiations between Russia and Ukraine remain stalled despite U.S. involvement, as Russia rejects further talks and insists on recognition of its territorial gains and Ukraine’s neutrality, while Putin continues to blame the West for the conflict’s origins.

Bulgaria: Bulgaria is set to join the Eurozone on January 1, 2026, marking a major step in its EU integration, but the move faces strong domestic opposition, with over half the population and pro-Russian groups protesting against rising prices and perceived loss of sovereignty.

Russia-Ukraine: FP-5 “Flamingo” and Ukrainian Refinery Attacks

According to reports from the Institute for the Study of War (ISW), on 30 August 2025 Ukraine carried out its first strike with the domestically produced FP-5 cruise missile against a Russian border post on occupied Crimea.[1] The FP-5, also known as the “Flamingo”, is a ground-launched cruise missile developed and manufactured by the Ukrainian company Fire Point. The missile is regarded as one of Ukraine’s most capable indigenous developments and serves as a cost-effective alternative to Western systems such as Storm Shadow or Taurus. It has already been used in active combat and is designed for strikes against targets deep in Russian territory.

Technical details

Type: ground-launched strategic cruise missile.
Range: approx. 3,000 km (1,864 miles), enabling strikes deep into Russian rear areas.
Accuracy: impacts within 14 meters of the target.
Warhead: over 1 ton (up to 1,150 kg), likely a tandem arrangement such as two FAB-500M-62 free-fall bombs; lethal radius is estimated up to 38 meters, depending on the target.
Launch platform: ground-based launchers, flexibly deployable.
Cost: optimised for low-cost mass production compared with NATO systems like Storm Shadow/Taurus.
Development: Ukrainian development with Western (British-Emirati) influences, supplementing limited Storm Shadow/SCALP deliveries.[2]

Production capacity

Current production: approx. 1 missile per day (about 30 per month).
Planned scaling: by October/November 2025 to 7 missiles per day (about 210 per month).
Cooperation: collaboration with Milanion Group and Ukrainian Armour for components (e.g., unmanned platforms); use of Western technology transfer.
Risks: Russian strikes on production facilities could affect capacity.
Goal: additional operational units to increase independence from Western supplies.[3]

Source: https://t.me/rybar_in_english

Possible targets

Due to its long range, the FP-5 can reach large parts of the Russian defence industry, including military facilities, logistics centres and bridges such as the Kerch Bridge. Russian energy infrastructure is also a particular focus, since the missile is designed to disrupt the wartime economy. In August 2025 Ukraine already attacked roughly ten refineries using drones and other weapons, damaging about 20% of Russia’s refinery capacity. The FP-5 could reinforce this campaign: its heavy warhead is well suited for targets such as distillation columns, oil storage tanks or power grids, where the explosive radius would cause maximum destruction. Past attacks with Ukrainian drones point to further strikes against refineries, industrial plants and power infrastructure intended to weaken Russia’s economy. The missile increases Russia’s vulnerability while reducing Ukraine’s full reliance on Western munitions, but it carries escalation risks due to potential Russian retaliation.[4]

Russia-Ukraine: Map of Odesa – Mykolaiv Oblast marked as Russian territory

During a security briefing, the Chief of the General Staff of the Russian Federation, Valery Gerasimov, summarised the results of the spring and summer offensives. Nothing unusual in itself—if it weren’t for a map visible in the background showing the Mykolaiv and Odesa oblasts (in addition to the already occupied regions of Luhansk, Donetsk, Zaporizhzhia, Kherson, and Crimea) as part of Russian territory. According to this map, Ukraine would thus be completely cut off from the Black Sea, with the exception of the Dnipro River.[5]

Source: https://x.com/nexta_tv/status/1962478684566163494/photo/3

The display of such maps has occurred before—for example, by Belarusian President Alexander Lukashenko—and is part of Russia’s strategic ambiguity campaign. Experts agree that the map’s appearance in the background was not accidental, but that time and setting were deliberately chosen to produce a certain psychological and political effect.[6] The map is therefore seen as a pressure and warning tool aimed at President Zelensky, signalling that he should accept a still relatively favourable deal with Russia now, rather than facing potentially worse conditions later.

US-Russia-Ukraine: Peace Negotiations

The current state of peace negotiations between Russia and Ukraine, including the involvement of the United States, is characterised by a continuing stalemate and lack of progress. Since the summit meeting between U.S. President Donald Trump and Russian President Vladimir Putin in Alaska in August 2025, the situation has not significantly improved.[7]

Russia continues to reject bilateral meetings between Putin and the Ukrainian president, as well as trilateral formats including Trump. Russian presidential adviser Yuri Ushakov emphasised on September 1, 2025, that no agreement on such meetings exists, even though Trump had announced plans for them on August 18, 2025. Instead, Russia continues to demand recognition of the so-called “new territorial realities”, which implies the annexation of occupied territories such as parts of the Donbas and Crimea, as well as a commitment by Ukraine to neutrality and non-accession to NATO. Putin reiterated this position in his speech at the Shanghai Cooperation Organisation (SCO) Summit in Tianjin on September 1, 2025, where he traced the conflict back to the alleged “coup” of 2014—his term for the Revolution of Dignity in Ukraine—and blamed the West for the escalation.

Bulgaria: Bulgaria will join the Eurozone on January 1, 2026, becoming the 21st member state to adopt the euro as its currency. On July 8, 2025, the EU Council approved the final three legal acts required for accession. Earlier, on June 20, 2025, the EU Economic and Financial Committee had unanimously supported the accession recommendation.[8]

In June 2025, both the European Commission and the European Central Bank confirmed that Bulgaria met all the necessary criteria. The national lev will be replaced by the euro, a move expected to facilitate trade and give Bulgaria greater influence within the EU. However, public opinion in Bulgaria is divided—not all citizens are convinced of the benefits. The accession follows years of preparation and marks a milestone in Bulgaria’s EU integration. Domestically, the decision has sparked considerable controversy. Bulgaria’s 2026 euro accession faces strong resistance, with 54.9% of the population opposing it. Pro-Russian groups, such as Vazrazhdane, are organising protests against rising prices and the perceived loss of national sovereignty.[9]

Assessment and outlook

This report and the assessment are based on news reports, open source intelligence, and governmental sources. The cross-media orientation of this report, as well as the depth with which the various topics are addressed, give us confidence that the present report and the subsequent assessment adequately describe and evaluate the situation.

The prospects for resuming or continuing peace negotiations currently appear slim. Trump and European partners are discussing potential “security guarantees” for Ukraine; however, Russian concessions remain essential for any meaningful progress in the talks. Experts warn that negotiations without sufficient pressure on Russia could result in a “Minsk 4.0” scenario—a false peace that merely delays further escalation between the two sides.

The domestically produced Flamingo cruise missile may increase pressure on the Russian leadership, but it will not be enough to turn the tide of the war in Kyiv’s favour. While Ukraine continues to find ways to inflict significant damage on Russia’s energy and defence industries—and to publicise these strikes effectively—the war will ultimately be decided on land, that is, along the frontlines in eastern Ukraine. Moreover, such operations always carry the risk that Russia could destroy production sites, for instance with Oreshnik missiles, quickly turning initial euphoria into disillusionment. Under Russia’s nuclear doctrine, such a move could even be justified as a precursor to the use of tactical nuclear weapons.

Intelligence cut-off date: 3 September 2025

4 September - 10 September

Executive Summary

Russia-Ukraine: Russia launched its largest drone and missile attack on Ukraine on September 6-7, 2025, with 823 projectiles, killing two, injuring 44, and damaging civilian infrastructure, including Kyiv’s Cabinet of Ministers building.

Russia-Poland: On September 10, 2025, Russian drones violated Polish airspace, with one crashing in Czosnowka; Polish and NATO forces shot down several, causing airport closures and escalating tensions.

Russia-Ukraine: Ukraine struck Russian oil and military targets on the same night, destroying key infrastructure in Krasnodar and Bryansk, while Russian drones violated Polish airspace, leading to NATO interceptions and airport closures.

Russia-Ukraine: Reports indicate that Russia is amassing over 100,000 troops and advanced equipment in western Donetsk Oblast, targeting the Ukrainian "fortress belt" of Sloviansk, Kramatorsk, Druzhkivka, and Pokrovsk to disrupt logistics and achieve a breakthrough into Dnipropetrovsk Oblast.

Europe-Russia-Ukraine: Discussions about deploying up to 50,000 European peacekeeping troops to protect Ukrainian civilian infrastructure face significant hurdles, including the lack of a UN mandate, security concerns, and reliance on U.S. support, with doubts about their effectiveness in resolving the conflict.

Russia-China: On September 2, 2025, Russia and China signed a binding agreement for the Power of Siberia 2 pipeline, a 6,700-km project to deliver up to 50 billion cubic meters of gas annually from Western Siberia to Northern China via Mongolia, strengthening their geopolitical ties despite Western sanctions, with completion expected around 2030.

Europe-Russia: Since Russia’s invasion of Ukraine in 2022, GPS jamming and spoofing incidents have surged across Europe, particularly in the Baltic Sea, Black Sea, and Eastern Europe, with thousands of cases annually attributed to Russia, increasing navigation risks and prompting the use of alternative systems.

Russia-Ukraine: Largest Russian Drone Attacks on Ukraine

On the night of September 6 to 7, 2025, Russia conducted the largest combined drone and missile attack of the entire war to date. A total of 823 projectiles were launched, including 810 Shahed drones and decoy drones, deployed from various regions such as Kursk, Bryansk, Oryol, Rostov, Smolensk, Krasnodar, and Crimea. The assault was supplemented by nine Iskander-K cruise missiles and four Iskander-M/KN-23 ballistic missiles. The regions most heavily affected included Kyiv, Sumy, Dnipro, Zaporizhzhia, Kremenchuk, Kryvyi Rih, Sloviansk, Chernihiv, and Cherkasy. The attack resulted in 44 injuries—20 of which were in Kyiv alone—and two fatalities in the capital. According to Ukrainian reports, their air defences managed to intercept or disrupt 747 drones and four cruise missiles. Nevertheless, nine missiles and 54 drones reached their targets, striking 33 locations across Ukraine, with debris also falling in eight other cities.[10]

For the first time since the invasion began, Russian projectiles hit the building of the Ukrainian Cabinet of Ministers in Kyiv. It remains unclear whether the drones were deliberately aimed at the building or were diverted from their intended course by Ukrainian air defences. The attack, lasting over seven and a half hours, was primarily symbolic, targeting the Ukrainian capital. Although Russia claimed to have attacked only military targets, such as drone facilities and air force bases, evidence contradicts this, showing significant damage to civilian infrastructure.[11]

Source: https://www.kyivpost.com/uk/post/59602

The attack was facilitated by Russia’s massively expanded drone production, which continues to rely on components from China and Iran. Russia currently produces around 2,700 Shahed drones per month, with plans to increase capacity to over 5,700 drones per month by the end of 2025. This attack, involving over 800 drones, is seen as a precursor to Russia’s goal of launching 1,000 drone attacks per day, expected in the fall of 2025.[12]

Russia-Poland: Russian Drone Crashes in Poland

On September 10, 2025, more than a dozen Russian drones violated Polish airspace during attacks on Ukraine, particularly in the eastern voivodeships of Podlachia, Masovia, and Lublin. One drone crashed and was recovered in the village of Czosnowka. For the first time, the Polish air force, in coordination with NATO fighter jets, shot down several drones, leading to temporary closures of four airports—including Warsaw's Chopin Airport—and disruptions to air traffic.[13]

Source: https://x.com/AndySch64494719/status/1965654306993913893

The incident represents a violation of European airspace, which Polish Prime Minister Donald Tusk described as a major provocation. Ukrainian President Zelenskyy accused Russia of deliberately testing Poland's and NATO's alertness. While Russian drones entering the airspace of other countries is not unprecedented—similar incidents have occurred in Poland, the Baltics, Moldova, and Romania—this marked the first time they were actively shot down by Polish air defences. Without further technical details, the cause remains highly speculative; it could involve unintentional deviations or technical malfunctions.[14]

Russia-Ukraine: Ukrainian Counterattacks on Russia

In the same night of September 6 to 7, 2025, Ukrainian forces continued their strikes on Russian territory, focusing primarily on oil and military infrastructure. In the Bryansk region, the Armed Forces of Ukraine (AFU) targeted an oil pumping station near Naitopovychi, which is part of the "Steel Horse" pipeline with an annual capacity of 10.5 million tons. The attack ignited a fire at the station and in nearby tanks. In Krasnodar Krai, Ukrainian special forces, in coordination with resistance groups, assaulted the Ilsky Refinery, which processes around 6.42 million tons of oil annually. The central ELOU-AT-6 complex, the facility's key processing unit, was destroyed. Geolocated footage shows a massive plume of smoke rising over the refinery. While Russian authorities acknowledged the fire, they attributed it to debris from downed drones.

Additionally, Ukraine's General Staff reported successful strikes on Russian military depots and supply routes in the Kursk and Donetsk regions, though the full extent of the damage is still being assessed.[15]

Russia-Ukraine: Preparations for an Autumn Offensive?

Ukrainian and other sources report that Russia is preparing a major offensive in western Donetsk Oblast, focusing on troop redeployments, reinforcements, and tactical adjustments to breach Ukrainian defense lines.[16]

Scale and Scope

According to Ukrainian and Western estimates, Russia has amassed over 100,000 troops in Donetsk Oblast, aiming to break through into Dnipropetrovsk Oblast and capture a) the Sloviansk-Kramatorsk-Druzhkivka urban belt and b) Pokrovsk. These forces are supported by marine infantry brigades, a tank regiment, an infantry regiment, and two motorised rifle brigades in the Dobropillya sector.[17]

Additional troop movements include elements of the 70th Motorized Rifle Division redeployed from Kherson to Chasiv Yar and Bakhmut, as well as units such as the 155th and 40th Naval Infantry Brigades, the 177th Naval Infantry Regiment, the 11th Separate VDV Brigade, and the 76th VDV Division from Kursk and Sumy, deployed to Pokrovsk and Dobropillya.[18] Newly added units include the 2nd, 41st, and 51st Combined Arms Armies, the 56th Separate Spetsnaz Battalion for logistics, the 20th and 150th Motorized Rifle Divisions, the 98th VDV Division, and other special forces. Special attention is drawn to units like the 56th Separate Spetsnaz Battalion and the 98th VDV Division, tasked with special operations and support roles. The buildup includes a significant stockpile of drones, including FPV and fiber-optic drones, as well as heavy armored vehicles, signaling comprehensive preparations for a large-scale offensive.

Source: https://t.me/RVvoenkor

Location, Strategic Objectives, and Tactics

The Russian military leadership is likely focusing its main efforts on western Donetsk Oblast, particularly the Pokrovsk sector, where the fiercest fighting is occurring, as well as Dobropillya northeast of Pokrovsk, Siversk, Sloviansk-Kramatorsk, and Chasiv Yar, with reinforcements drawn from Sumy, Kursk, and Kherson. New attack points are expected to include Nove Shakhove, Oleksandro-Shultyne, Zvirove, and the E-40 highway between Izyum and Sloviansk.[19]

The strategic goal is to capture the Ukrainian "fortress belt" consisting of Sloviansk, Kramatorsk, Druzhkivka, and Kostyantynivka, alongside Pokrovsk, which form the backbone of Ukraine’s defence in Donetsk Oblast, aiming to disrupt Ukrainian logistics, prevent counterattacks, encircle Pokrovsk, and ultimately achieve a breakthrough into Dnipropetrovsk Oblast, while securing the complete capture of Donetsk Oblast and potentially Zaporizhzhia and Kherson Oblasts, objectives unmet in the summer.[20]

Europe-Russia-Ukraine: Deployment of Troops to Ukraine?

Discussions about deploying European peacekeeping troops to Ukraine are in an early, highly contentious phase, lacking a legally binding mandate due to the UN Security Council's paralysis caused by Russian and Chinese vetoes, which undermines the traditional basis for organising peace missions. The core challenge is ensuring the safety of these troops, requiring robust situational awareness, modern air defence systems, and the capacity for retaliatory strikes, with Ukraine needing to guarantee protection and effective counterattacks against potential Russian aggression.[21]

Despite these hurdles, concrete proposals are circulating, including a "coalition of the willing" that could deploy up to 50,000 troops, with a headquarters in Paris and a coordination centre in Kyiv, tasked with protecting civilian infrastructure, urban areas, and the population to free up Ukrainian forces for frontline duties. Direct military confrontations with Russia are to be avoided to prevent formal Western entry into the war, with potential models including buffer zones patrolled by neutral non-European forces (e.g., from China or India) or a layered approach with neutral troops near the front, Ukrainian forces in a second line, and European troops in western Ukraine handling training and support roles.[22]

The critical issue remains security guarantees, as a purely European mission is deemed unrealistic without U.S. support in intelligence, deterrence, and protection, given Europe’s limited global military capabilities. Political skepticism persists, with doubts about Russia’s interest in a peace process under these conditions, suggesting that European peacekeeping plans may, at best, have symbolic value without significantly contributing to conflict resolution.

Russia-China: On September 2, 2025, during the SCO Summit in Beijing, Moscow and Beijing signed a binding agreement for the construction of the Power of Siberia 2 pipeline, connecting Western Siberia to Northern China via Mongolia. The legally binding memorandum between Russia’s Gazprom and China National Petroleum Corporation (CNPC) outlines a 6,700-km pipeline, with 2,600 km in Russia, 950 km through Mongolia (as the Soyuz-Vostok transit line), and additional segments in China, designed to transport up to 50 billion cubic meters (bcm) of natural gas annually from Arctic fields in Yamalo-Nenets (e.g., Bovanenkovo and Kharasavey) for 30 years, complementing the existing Power of Siberia 1 (expanded to 44 bcm) and potentially enabling Russia to supply up to 106 bcm to China annually via an additional Far Eastern Route.[23]

Source: https://www.specialeurasia.com/2022/02/27/ukraine-russia-gas-pipelines/

The price, expected to be lower than European rates and linked to Asian oil prices, remains unset, and while the agreement underscores geopolitical alignment despite Western sanctions, the construction timeline is uncertain, with estimates suggesting 5–6 years for completion (around 2030) and the Mongolian segment potentially starting earlier (2026–2027). Total costs are estimated at $13.6–34 billion, with Russia financing its domestic section and China covering its portion; Russia bears most financial risks due to its loss of European markets (from 157 bcm in 2021 to 39 bcm in 2025), while China negotiates favourable terms, potentially delaying the project if external funding is lacking.[24]

China stands to gain more economically and strategically, covering 20–25% of its gas needs by 2030, while Russia faces higher risks and lower profits but strengthens geopolitical ties and long-term economic prospects, with analysts viewing China as the primary beneficiary due to its tough negotiations and flexibility, such as avoiding fixed volume commitments.[25]

Europe-Russia: Since the Russian invasion of Ukraine began in February 2022, disruptions to European air traffic have significantly increased, primarily involving GPS jamming (interference with satellite signals) and GPS spoofing (transmission of false positional data), which are considered byproducts of regional military activities but increasingly interpreted as hybrid warfare. The European Union Aviation Safety Agency (EASA) reports thousands of incidents annually, with nearly 80 documented cases in Europe since 2022 attributed to Russia by Western authorities, raising navigation risks for aircraft, necessitating alternative systems like radio navigation, and causing delays or rerouting, though no crashes have occurred so far.[26]

The disruptions are concentrated near conflict zones and Russian enclaves where military systems are deployed against drones and missiles. The most affected areas include:

Baltic Sea Region: Up to 733 daily incidents in Sweden (2025), with hotspots around Kaliningrad, St. Petersburg, and Smolensk; affected flights include those over Latvia (820 cases in 2024 vs. 26 in 2022), Lithuania (1,185 cases in January 2025), and Estonia.

Black Sea and Eastern Europe: High frequency in Poland (2,732 cases in January 2025), Romania, and Bulgaria (e.g., jamming during Ursula von der Leyen’s flight to Plovdiv in September 2025).

Other Hotspots: Finland (2,800 incidents in 2024), Turkey (around the Caspian Sea and eastern Mediterranean), and sporadic cases in the North Sea and over Belarus.[27]

Assessment and outlook

Russian drone attacks have reached a new record in terms of the number launched per night, though many analysts, citing rising production figures, predict with high probability that this is far from the final peak of Russian aerial assaults. Ukraine's countermeasures remain highly effective, particularly through the use of the Flamingo cruise missile to strike sensitive Russian military and energy infrastructure targets; however, the risk persists that Russia could target Ukrainian missile production facilities, as Ukraine lacks the strategic depth that serves as a key protective factor for Russia compared to its own capabilities. Without comprehensive air defences, Russia is likely to gain the upper hand in this domain in the medium term.

Reports of Russian troop concentrations in Donetsk Oblast in preparation for an autumn offensive are causing unease in Ukrainian and Western circles. Similar alerts about buildups in areas like Sumy or Zaporizhzhia have surfaced frequently in recent months without leading to a full-scale Russian offensive. Russia's declared objective, however, is to seize the remaining territories in Donetsk Oblast before the onset of Rasputiza between mid-October and November—a narrow window that underscores the need for substantial Russian force concentrations.

Intelligence cut-off date: 10 September 2025

11 September - 17 September

Executive Summary

Russia-Belarus: The Zapad-2025 military exercise (12–16 September 2025), involving Russia and Belarus with around 107,000 troops, included large-scale manoeuvres with tanks, artillery, drones, and hypersonic weapons, tests of non-strategic nuclear capabilities, and integration of unmanned systems; international observers and media were invited to demonstrate transparency.

Russia-Ukraine: On 13–14 September 2025, Ukraine launched drone and sabotage attacks against Russian oil, chemical, railway, and military infrastructure to weaken logistics and arms production; the strikes indirectly exacerbate Russia’s economic and civilian challenges, though no impact on exports has been reported so far.

Russia-NATO: In September 2025, Russian drones repeatedly entered NATO airspace over Poland and Romania, were intercepted or neutralised, and were seen as a test of NATO’s response capabilities; it remains unclear whether they were military drones or decoy devices intended to engage Ukrainian air defences.

Russia-Belarus: ZAPAD-2025

Who participated?

Main actors: Russia and Belarus, with limited participation of foreign troops such as from India.[28]

Scale: Reported troop numbers vary significantly. The Belarusian Minister of Defence mentioned around 7,000 soldiers, while Russian sources cited approximately 100,000 (compared to 200,000 in 2021). Presumably, these figures refer to the respective Belarusian and Russian contingents, totaling roughly 107,000 Union State troops overall.

Observers and transparency: Belarus invited U.S. military observers to Zapad-2025, along with representatives from about 25 other countries, including two additional NATO members—Turkey and Hungary. Belarus stated that all 56 OSCE member states had been notified months in advance. Over 100 media representatives from 15 different countries were also present, aiming to demonstrate maximum transparency and visibility of military capabilities.[29]

Where did the exercises take place?

Belarus: In Grodno (western Belarus, 15 km from the Polish border at the tri-border area between Belarus, Lithuania, and Poland), Vitebsk (northeast Belarus, 38 km from the Russian border), and the Minsk region. Russian and Belarusian units of the Joint Regional Group of Forces trained the extensive integration of modern technology. Belarusian forces explicitly rehearsed the use of non-strategic nuclear weapons and the deployment of Oreshnik ballistic missile systems. In addition, drones (UAVs), motorcycles, and robotic platforms—all systems proven in the war in Ukraine—were tested in widespread operational use.[30]

Kaliningrad: In the Kaliningrad Oblast, Russian forces conducted exercises to counter sabotage and reconnaissance units, with a focus on drone reconnaissance and electronic intelligence missions.[31]

Barents Sea / Murmansk: Units of the Russian Northern Fleet practiced defending against a simulated enemy air attack in the Barents Sea. They also carried out an amphibious landing operation on the Sredniy Peninsula (Murmansk Oblast), employing targeted drone support during the manoeuvres.[32]

Source: https://militarnyi.com/en/news/russia-and-belarus-to-hold-zapad-2025-exercises-at-13-training-grounds-eight-of-them-near-the-border-of-ukraine-and-nato/

What was practiced and employed?

General: The exercises included large-scale manoeuvres involving artillery, tanks, drones, helicopters, amphibious vehicles, and hypersonic missiles (Oreshnik), as well as defence against simulated air attacks, landing operations in the Barents Sea, drone-supported manoeuvres on the Sredniy Peninsula (Murmansk Oblast), and mock cruise missile strikes conducted by the Baltic Fleet.[33]

A particular focus was placed on the integration of unmanned systems (UAVs, UGVs) and the use of non-strategic nuclear weapons by Belarusian forces, as well as the employment of drones, motorcycles, and robotic platforms—tactics that have also been used in the war in Ukraine.

Belarus: Deployment of nuclear-capable Oreshnik missiles, drones, electronic warfare systems, and artificial intelligence technologies.

Kaliningrad: Geolocated imagery shows an Iskander-M missile system operating in the Kaliningrad Oblast (on the E28 highway toward Elbląg, about 35 km from the Polish border). Russia has had such systems deployed there since 2018.

Barents Sea: Use of Bal coastal defence missile systems and Uran cruise missiles to engage simulated enemy targets and ships; launch of a Ka-27 naval helicopter from the destroyer Severomorsk (Udaloy-class); Baltic Fleet exercises included emergency rescue operations for surface vessels.[34]

Source: https://kyivindependent.com/us-observers-attend-russia-belarus-zapad-2025-drills/ /

International Reactions

Poland temporarily closed several border crossings, increased troop presence along the border in direct response to the exercises, activated its air defence systems even before the drills began, and scrambled fighter jets following incursions of Russian drones into Polish airspace. Lithuania tightened border security, closed several crossings (together with Latvia), and increased patrol and alert levels.[35] Latvia enhanced airspace and border surveillance, jointly closed certain border checkpoints with Lithuania, and raised the readiness of its armed forces, describing the exercises as an “aggressive show of force.”

Russia-Ukraine: UA Drone Attacks and Sabotage

Drone attacks: On the night of September 13–14, 2025, Ukraine carried out coordinated drone and sabotage strikes against Russian oil, chemical, railway, and military infrastructure. Targets included, among others, the Kirishi refinery (Leningrad Oblast), Russia’s second-largest refinery; the Bashneft-Novoil refinery in Ufa (about 1,400 km from the front); and the Metafrax chemical plant in Perm (1,800 km from the front). All of these facilities are central to supplying the Russian military and defence industry.[36]

Sabotage: Simultaneously, sabotage attacks on railway lines were conducted (Kursk–Oryol and St. Petersburg–Pskov), causing fatalities, significant damage, and delays in military logistics. A communication centre of the Black Sea Fleet in Sevastopol was also damaged. The attacks aimed to directly weaken Russian logistics, armament production, and supply lines.

Source: https://x.com/Heroiam_Slava/status/1967671137908772914/photo/1

Impact: In a broader context, Russia’s budget deficit (₽4.2 trillion from January to August 2025, exceeding the annual plan) is being linked to the ongoing war. The Kremlin is reportedly considering raising the value-added tax (VAT) from 20% to 22% to offset the deficit, rather than cutting military spending (6.3% of GDP, approximately ₽13.5 trillion). This would burden the population through higher prices and increase inflation by 0.55–0.7 percentage points, reversing progress against inflation and worsening economic problems such as stagnation, labor and fuel shortages, and demographic challenges.[37]

Source: https://x.com/Wolltigerhueter/status/1772006684673679388/photo/1

Reports of military supply disruptions have not been disclosed. However, based on recent reports of long queues and price increases at fuel stations for civilian users, it can be assumed that the Ukrainian strikes at least partially affect the civilian population. There are no reports of reductions or restrictions in Russian oil and gas exports abroad.

Russia-NATO: Russian Drones Penetrate NATO Airspace

First Incident in Poland: On the night of Tuesday to Wednesday, September 10, 2025, numerous Russian drones entered Polish airspace. Several of them were intercepted and shot down by the Polish air defence in coordination with NATO partners.[38] The incident prompted a strong response from Poland: border security and airspace surveillance were reinforced, and the government approved an additional NATO presence. Internationally, the event was viewed as a serious escalation and a warning signal.

Second Incident in Poland: On September 15, 2025, a drone was detected and neutralised by security forces above the Belweder Palace in Warsaw, the official residence of the Polish President. During the operation, two suspects were arrested—initially reported as Belarusian citizens, later corrected to one Belarusian man and one Ukrainian woman. Authorities emphasised that there were no indications of a large-scale espionage operation, though investigations into motive and background are ongoing. Current findings suggest the drone was civilian in nature, not a stray Russian military drone. Nevertheless, the incident heightened public and governmental sensitivity following the earlier Russian drone violations of Polish airspace.[39]

Romania: On September 13, 2025, at 18:23 local time, a Russian drone entered Romanian airspace, prompting the Romanian Air Force to scramble two F-16 fighter jets from the Fetești base, supported by German Eurofighters on standby under NATO command. The drone left Romanian airspace after about 50 minutes without causing any damage or casualties. Romanian authorities classified the event as another deliberate provocation, noting that since February 2022, there have been 11 such airspace incursions and around 50 drone attacks near the Ukrainian-Romanian border, with debris landing on Romanian territory in thirty cases.[40]

The West interprets the incident—similarly to the one in Poland—as a test by Russia to probe NATO’s defence readiness and reaction speed. In both cases (Poland and Romania), however, it remains unclear what type of drones were intercepted; they may also have been decoy devices used to saturate Ukrainian air defences. Regardless, the intrusion of Russian aerial objects constitutes a clear violation of airspace.[41]

Assessment and outlook

Modern Ukrainian weapons such as the Flamingo, with a maximum range of up to 3,000 km, could strike strategically important targets deep in Russia’s interior — for example the ZapSibNeftekhim complex in Tobolsk (about 2,800 km from Kyiv, 2,450 km from Kharkiv). As Russia’s largest petrochemical complex, an attack could disrupt production of over 2.5 million tonnes of polymers per year and interfere with exports to China, India and Central Asia, with significant economic and strategic consequences for Russia.

The incidents in Poland and Romania highlight the need for cost‑effective air defence among NATO countries, especially those indirectly affected by errant (Russian) drones. Last week’s episode in Poland illustrates the dilemma: of the 19–21 (Russian) drones, the Polish Air Force was able to shoot down only about 3–4, while the cost of the drones is only a fraction of that of interceptor missiles. The Russian provocation has sharpened anti‑Russian rhetoric and increased calls for military strengthening, particularly along NATO’s eastern flank. In recent days the idea of establishing a no‑fly zone over Ukraine, allowing Russian drones to be shot down before they reach NATO airspace, has been raised again; a similar proposal was considered in 2021 but rejected by then‑Secretary of State Blinken, reportedly on cost grounds. Once more, the question arises who would bear the enormous military burden required to enforce a nationwide no‑fly zone — the United States is unlikely to do so alone.

Intelligence cut-off date: 17 September 2025

18 September - 28 September

Executive Summary

Russia-Ukraine: Ukrainian forces launched a localized counterattack in Donetsk Oblast in September 2025, recapturing 160 km² and seven settlements, though experts view it as a defensive move due to limited artillery, air support, and personnel shortages.

Russia-Ukraine: Ukraine conducted drone strikes on a Russian oil refinery in Bashkortostan, a gas plant in Astrakhan, a sanatorium and airfield in Crimea, and Moscow in September 2025, causing disruptions, while unveiling a new underwater drone potentially targeting the Kerch Bridge.

Russia-Ukraine: Since July 2025, Russia has built a strategic reserve of over 290,000 recruits, enabled by reduced frontline losses, with recruits receiving extended training and potentially preparing for long-term goals or NATO escalation.

Russia-NATO: On September 19, 2025, three Russian MiG-31 jets violated Estonian airspace for 12 minutes, prompting NATO interception and condemnation, seen as a deliberate test of NATO’s eastern flank readiness. The Russian airspace violation in Estonia has sparked debates about potential NATO responses, including shooting down Russian aircraft, broader military escalations, or Russian hybrid warfare, with the 1944 Chicago Convention reinforcing the illegality of such actions.

Denmark-Norway: On September 22, 2025, large drones caused hours-long flight disruptions at Copenhagen and Oslo airports, with Denmark labeling it an attack on critical infrastructure and Norway arresting two foreign nationals, though no clear link to other incidents has been confirmed.

Germany: On September 19, 2025, a ransomware attack on Collins Aerospace’s MUSE system disrupted passenger processing at several European airports, exposing vulnerabilities in outdated software and raising concerns about critical infrastructure security.

Russia-Ukraine: UA Counteroffensive?

In September 2025, Ukrainian forces launched a localized counterattack in the Donetsk Oblast, specifically northwest of Pokrovsk near Dobropillia, where they reportedly recaptured about 160 km² and seven settlements. Military experts assess this operation as more of a defensive counterattack rather than a large-scale offensive, citing a lack of comprehensive artillery and air preparation or support, as well as Ukraine's persistent personnel shortages, which make significant troop replenishment nearly impossible. Ukraine did not provide specific figures on the number of soldiers involved, but some expert estimates suggest around 3,000–5,000 troops. The fighters primarily come from rotations of existing units and (forced) mobilization waves.[42]

Source: https://x.com/TheStudyofWar

Russia-Ukraine: UA Attacks on Oil Refinery, Crimea, and Moscow

On the night of September 17–18, 2025, a Ukrainian long-range drone struck the Salavat oil refinery in Bashkortostan, located over 1,300 km from the Ukrainian border. The refinery produces more than 10 million tons of oil products annually. In another attack on September 22, 2025, Ukraine landed a significant hit on a gas processing plant in Astrakhan, approximately 850 km from the Donetsk front line, near the Caspian Sea. Production at the facility, which has an annual capacity of 3 million tons, was halted two days later due to fire damage.[43]

On the night of September 21–22, 2025, Ukraine conducted targeted strikes on Crimea, hitting a sanatorium in Foros (32 km southeast of Sevastopol), resulting in two deaths and 15 injuries. It is suspected that high-ranking Russian officials, possibly including military personnel, were present during the attack. Simultaneously, a Russian military airfield in Kacha (17 km north of Sevastopol) was struck, with the targets confirmed by Ukrainian intelligence.[44]

Source: https://x.com/Tendar/status/1968583650498289815

At a recent arms exhibition in Lviv, Ukraine showcased the TLK-1000 underwater drone (Toloka), which can reportedly be equipped with a warhead of up to five tons and is primarily designed to target critical infrastructure like the Kerch Bridge. It remains unclear whether the drone is operational or to what extent it could actually damage the bridge.[45]

On the same night of September 21–22, 2025, Ukraine launched air attacks on Moscow with approximately 20 drones, targeting the Russian capital and causing impacts in the Moscow metropolitan area, including Ryutov. These attacks significantly disrupted civilian air traffic: cargo planes were forced to attempt landings in low-altitude manoeuvres due to an unsafe airspace, and airports were temporarily shut down, causing substantial economic damage. Russian air defences are overwhelmed, lacking sufficient systems to effectively protect the vast territory. In some cases, Russia has resorted to using sports aircraft and man-portable firearms against Ukraine’s relatively slow-moving drones. On September 22, 2025, Ukrainian special forces destroyed an S-400 air defence system radar and a launch unit in the Kaluga region, an action seen as direct preparation for the drone attack on Moscow.[46]

Russia-Ukraine: Russian Strategic Reserves

Since July 2025, Russia has been building a strategic reserve of new recruits, with over 290,000 contract agreements signed by mid-September. This development was made possible by reduced frontline losses, as the number of casualties in August and September fell below the recruitment rate for the first time. Recruits are no longer sent immediately to the front but are undergoing more comprehensive training and are partially held back. Tactically, Russia is increasingly relying on smaller assault groups and infiltration rather than costly mass attacks. The formation of reserves suggests long-term planning, with Russia aiming to pursue its war objectives and possibly preparing for an escalation with NATO. However, these strategic reserves could also be deployed domestically, such as to secure military transport and supply routes or to protect Russian energy infrastructure.[47]

Russia-NATO: Provocations in NATO Airspace

On September 19, 2025, three Russian MiG-31 fighter jets, armed with Kinzhal missiles, entered Estonian airspace for approximately 12 minutes, penetrating about 10 km deep and covering nearly 100 km, coming within 5 km of the capital, Tallinn. They were intercepted by NATO jets (Italian F-35s under Baltic Air Policing). Estonia presented radar screenshots as evidence in the UN Security Council. NATO and the EU sharply condemned the incident, while Russia denies the allegations.[48]

Key Facts of the Incident:

Date/Location: September 19, 2025, airspace over the Baltic Sea near the Estonian coast (Vaindloo/Gulf of Finland).

What Happened: Three armed Russian MiG-31 jets entered Estonian airspace without identifiable transponder signals or communication, remaining for about 12 minutes, penetrating up to 10 km deep and covering nearly 100 km within Estonian airspace.[49]

On-Site Response: NATO jets, including Italian F-35s under Baltic Air Policing, scrambled and escorted the Russian aircraft out of Estonian airspace. Estonia reported that the Russian jets ignored warning signals.

Evidence: Estonia presented radar screenshots and flight path data to the UN Security Council as proof. Such incidents can be verified through military radar records and civilian tracking data.[50]

Context: The incident is seen as a deliberate provocation of NATO’s eastern flank and a test of the alliance’s crisis communication and readiness. It is part of a series of recent incidents, including drone activities over Poland and Romania.

Source: https://x.com/MoD_Estonia/status/1969335755769069613/photo/1

Future Scenarios Regarding Russian Airspace Violations in NATO Territory

The incident involving Russian MiG-31 jets entering Estonian airspace on September 19, 2025, has sparked widespread debate about potential future escalation scenarios. Based on current reports and expert analyses, discussions primarily focus on military, propaganda, and political consequences. The shooting down of Russian military aircraft is considered a central scenario, alongside broader risks such as hybrid warfare or divisions within NATO. Below is an overview of the key debates and scenarios.[51]

Shooting Down Russian Military Aircraft as an "Ultima Ratio": A direct shootdown would be considered a legitimate and immediate defence measure under the 1944 Chicago Convention on International Civil Aviation. Several NATO countries have signalled readiness: Poland has explicitly threatened to shoot down intruders, Sweden emphasises "airspace defence" and would shoot down Russian fighter jets, and U.S. President Trump has openly stated, "NATO countries should shoot down Russian aircraft if they enter." Discussions reference precedents like the 2015 Turkish shootdown of a Russian jet, which caused temporary tensions but no major escalation.[52]

Broader Military Escalation and NATO Reinforcements: Beyond a shootdown, a Russian "drone wall" could prompt immediate countermeasures, including Russian exercises or incursions near Baltic or Finnish borders. In an extreme case, this could lead to full mobilisation of NATO’s eastern flank, with Article 4 consultations as a precursor to invoking the NATO mutual defence clause.[53]

Propaganda and Hybrid Escalation by Russia: In the event of a shootdown, Putin could frame the incident as "NATO aggression" to mobilise domestic support. This could lead to intensified hybrid attacks, such as drone or cyber operations on NATO territory. While a direct Russian kinetic war against NATO is currently seen as unlikely, it should not be entirely ruled out.

Background: The 1944 Chicago Convention establishes that every country has absolute sovereignty over its airspace, making Russia’s action a clear violation of international law. In the context of the Russian MiG-31 jets entering Estonian (NATO) airspace for 12 minutes on September 19, 2025, without a flight plan, radio contact, or identification, this incident underscores a fundamental breach of Estonian sovereignty. Although the convention is primarily civilian in scope, it serves as the legal basis for NATO’s condemnation and attribution of blame, as military incidents like this violate airspace integrity principles and carry escalation risks.[54]

Denmark-Norway: Drone Sightings at Copenhagen and Oslo Airports

On the evening of September 22, 2025, multiple large drones were sighted at Copenhagen's Kastrup Airport (Denmark) and Oslo's Gardermoen Airport (Norway), leading to hours-long shutdowns of flight operations. These incidents caused major disruptions, including flight cancellations, diversions, and delays, affecting thousands of passengers.[55]

Copenhagen Airport: The incident began around 8:30 p.m. local time on September 22, 2025, with sightings of two to three large drones near the airport that did not appear intended for private use. According to reports, the drones switched their lights on and off and disappeared after several hours. Flight operations were suspended for about four hours (until around 12:20 a.m. on September 23, 2025). Approximately 100 flights were canceled, including connections to Germany, affecting about 20,000 passengers. Airspace was closed, flights were diverted (e.g., to Gothenburg and Malmö), and further delays were expected the following day. Danish police launched an investigation, and the Danish intelligence service PET was informed. The drones were not shot down due to the risk posed by their proximity to the airport. Danish Prime Minister Mette Frederiksen described the incident as "the most serious attack so far on Danish critical infrastructure." Copenhagen Police Chief Jens Jespersen referred to a "capable actor" with the skills, intent, and resources to carry out such an event, possibly for training purposes. No connection to Russia has been confirmed or ruled out.[56]

Source: https://x.com/mikko/status/1970377108653293858

Oslo Airport: The incident in Oslo also started on September 22, 2025, but slightly later, around 9:00 p.m. local time, with sightings of multiple drones over the military grounds of Akershus Fortress, near the airport. Flight operations were halted for about three and a half hours (until around 3:22 a.m. on September 23, 2025). Twelve flights were diverted, and delays occurred. Two foreign nationals were arrested on suspicion of operating drones in a restricted area. Norwegian police initiated an investigation to determine the drones' origin and any links to the Copenhagen incidents. The airport was reopened, but with ongoing disruptions.[57]

Germany: Ransomware Attack on Collins Aerospace

On the evening of September 19, 2025, Collins Aerospace, a key provider of check-in and boarding systems for the aviation industry, was hit by a ransomware attack. This caused significant disruptions at several European airports. The attack targeted the MUSE software (Multi-User System Environment) used for passenger processing, leading to widespread delays, flight cancellations, and long queues. Affected airports had to switch to manual check-in and boarding processes to maintain operations. The EU cybersecurity agency ENISA confirmed the incident as a ransomware attack, though the exact perpetrators and motives remain unclear.[58]

Affected European Airports:

Berlin-Brandenburg (BER), Germany
Brussels (BRU), Belgium
Cork (ORK), Ireland
Dublin (DUB), Ireland
London Heathrow (LHR), United Kingdom
Münster/Osnabrück (FMO), Germany (briefly affected but switched to internal IT systems within 30 minutes)

Other major German airports, including Frankfurt, Munich, Düsseldorf, Hamburg, Hannover, Dresden, Leipzig/Halle, Bremen, and Cologne/Bonn, reported no direct impacts. The disruptions lasted from the evening of September 19, 2025, until at least September 23, 2025, with the severity decreasing from September 22 onward. Full system restoration was not confirmed by September 23.[59]

Airports such as Berlin, Brussels, and Dublin resorted to manual processes, handling passenger data with paper lists and pens. London Heathrow implemented contingency plans for manual processing, mitigating some impacts. Berlin and Münster/Osnabrück disconnected from Collins Aerospace’s compromised systems to prevent further damage. Münster/Osnabrück transitioned to its own IT systems within 30 minutes, avoiding passenger disruptions. Collins Aerospace worked on software updates to restore MUSE system functionality, reporting near completion by Monday, September 22, 2025. The attack specifically targeted the ARINC Multi-User System Environment. The attacker gained access to the ARINC system, which remains active in the network during ongoing repairs. Screenshots indicate the system uses highly outdated software, specifically Oracle GlassFish Server 3.1.2.9, with the base version 3.1.2 dating back to 2012 and the patch level from around 2014 or 2015. The current version is 7.0.25. The reason for relying on such outdated software remains unclear.[60]

Background: On September 16, 2025, Collins Aerospace, a division of RTX, announced it had secured a contract from the NATO Communications and Information Agency (NCIA) to deliver the Electronic Warfare Planning and Battle Management (EWPBM) system. This integrated software tool aims to enhance NATO’s electromagnetic warfare capabilities. The project received significant media attention, highlighting Collins Aerospace’s role as a strategic NATO partner.

Assessment and outlook

The renewed violation of NATO airspace represents an unprecedented provocation of sovereignty, intensifying debates about appropriate defence measures to demonstrate the alliance’s credibility and resilience. Russia’s attempt to maintain plausible deniability in the context of other hybrid actions lacks evidential basis, significantly escalating the current situation. NATO is now under pressure to communicate proportionate but non-escalatory responses internally and demonstrate them externally. To the Kremlin’s advantage, this has already sparked significant discussions within NATO, with countries like Hungary publicly advocating for a diplomatic shift to avoid war with Russia. These divisions within NATO, a tactical-strategic secondary goal of Russian warfare, are visibly bearing fruit. Regardless of the severity of transatlantic countermeasures, an increase in Russian hybrid attacks is expected, necessitating urgent preventive measures focused on protecting critical infrastructure both digitally and physically.

The ransomware attack on Collins Aerospace on September 19, 2025, exploited vulnerabilities in outdated MUSE platform software, disrupting multiple European airports and highlighting the aviation industry’s cybersecurity weaknesses. The attack’s timing, shortly after Collins Aerospace’s NATO project announcement on September 16, 2025, raises speculation about a possible connection, though it is currently classified as a financially motivated ransomware incident with no confirmed geopolitical link. A Thales report notes a 600% surge in aviation cyberattacks from 2024 to 2025, underscoring the urgent need for the EU’s NIS-2 Directive to enforce stricter cybersecurity standards for critical infrastructure. Ongoing investigations may yet reveal new insights into the attack’s motives and perpetrators.

The Danish government and Prime Minister Mette Frederiksen explicitly classified the incident as an "attack." The drones, larger than those typically used for private purposes and operated by a "skilled pilot," suggest a coordinated operation, with the timing and impact on one of Northern Europe's busiest airports indicating a deliberate disruption of critical infrastructure, though the exact motivation (state-sponsored, criminal, or private) remains unclear as no perpetrator has been identified. Drones were sighted over the sensitive military site of Akershus Fortress, and the arrest of two foreign nationals points to possible illegal activity directed by a foreign actor, beyond recreational use. Evidence for an attack in Oslo is weaker than in Copenhagen, and its classification as an attack is not definitive; there is no concrete evidence linking the drone sightings to the Collins Aerospace cyberattack, with differing attack methods (cyber vs. physical) and lack of evidence for shared actors arguing against a direct connection.