Adversary Intelligence — 2026-09-28

ISW Assessment Connects Russian Drone Incursions in Moldova and Romania With Starlink Arson in Poland and Berlin Airport Shutdown Into Single Russian Sabotage Campaign

BLUFFormal attribution of either the Starlink fire or the Berlin airport shutdown to Moscow is unlikely within 30 days, leaving Russia's hybrid sabotage campaign inside the deniability threshold that deters collective NATO response.

The Institute for the Study of War's September 24 campaign assessment attributed a Russian Gerbera-type drone crash near Cernița, Moldova and a second near Solca, Romania to a wave of four drones that overflew Ukraine's Bukovyna region on September 24, three of which Ukrainian forces shot down 12. Polish Prime Minister Donald Tusk said authorities evacuated the Zosin and Dorohusk border crossings for 30 minutes as a precaution during the same night's Russian strikes on Ukraine 1. ISW separately assessed that a September 23 fire at a Starlink ground station in Wola Krobowska, Poland, which Polish Deputy Prime Minister Krzysztof Gawkowski called sabotage aimed at disrupting internet access, and a 45-minute shutdown of Berlin-Brandenburg airport after a drone sighting fit Russia's established pattern of infrastructure sabotage, though German and Polish authorities have not officially attributed either incident to Moscow 13. ISW has not observed evidence that Russia has yet carried out the broader attacks described in recent warnings from Lithuanian, Danish, and US intelligence sources regarding potential drone or cable-sabotage operations against NATO states 12.

Analysis
Formal government attribution of the Wola Krobowska Starlink fire or the Berlin-Brandenburg shutdown to Russia within 30 days of ISW's assessment is unlikely, keeping both inside the deniable hybrid category the Kremlin's campaign depends on. Gawkowski has only linked the fire to Russian doctrine rhetorically, and German police could not verify the drone sighting at all; neither government holds forensic evidence to name Moscow. Moderate confidence reflects this hedged official language alongside months of unattributed sabotage elsewhere in Europe. Sourcing rests entirely on ISW/CTP's single September 24 assessment, with Euromaidan Press and Newsweek amplifying rather than independently corroborating it. The four incidents may instead reflect independent causes: stray Gerbera drones fit an established pattern from strikes on Ukraine, while the Polish and German incidents remain formally unattributed, rather than the coordinated campaign ISW's thematic synthesis asserts. Without attribution, Warsaw and Berlin retain discretion to treat each incident as an isolated national matter, leaving collective NATO infrastructure-protection measures and Article 4 consultations untested.

3 sources

Russian Offensive Campaign Assessment, September 24, 2026 - Institute for the Study of War / Critical Threats Project (AEI)
Map Shows Russian Incursions, Acts of Sabotage Across Europe This Week - Newsweek
ISW connects drone crashes in Moldova and Romania, a Starlink fire in Poland, and a Berlin airport shutdown into one Russian pattern - Euromaidan Press