Russia may be preparing sabotage operations in Central and Eastern European countries, particularly the Baltic states, to blame Ukraine and weaken support for Kyiv. According to Ukrainian military intelligence estimates, potential sites of provocations could include critical infrastructure facilities, border areas, the Russian Kaliningrad region, and the Suwałki Corridor.
This was reported by the Main Intelligence Directorate of the Ministry of Defense of Ukraine on October 23.
According to the GUR, Moscow is considering the possibility of conducting "false flag" operations. These are incidents that could be organized by Russian special services, but responsibility for them will be shifted to Ukraine.
For this, according to intelligence assessments, the Kremlin may use state propaganda resources and international platforms where Russian representatives will be able to spread accusations against Kyiv.
The GUR believes that the goal of such actions could be to discredit the Ukrainian Defense Forces, intimidate European governments and societies, and create conditions for reducing military and financial support for Ukraine.
Among the potential targets and areas of provocations, the intelligence lists critical infrastructure, territories near the borders with Russia, and the Kaliningrad enclave. The Suwałki Corridor is separately mentioned — a strategically important section on the border of Poland and Lithuania, which provides the Baltic states with land communications with other NATO countries.
Russian special services may also use regions of European countries with a significant proportion of Russian-speaking population, the GUR suggests.
Another possible direction of provocations are facilities under the control or influence of the Kremlin. In particular, Ukrainian intelligence mentions institutions of the Russian Orthodox Church abroad and historical sites associated with Russia.
At the same time, the GUR does not provide specific dates for possible sabotage and does not report confirmed cases of implementation of these particular scenarios. The disclosed information is an assessment of possible actions of Russian special services.
In early October, Ukrainian intelligence had already warned that Russian special services had been tasked with intensifying their activities in EU and NATO countries. Potential targets then included military facilities, critical infrastructure, communication systems, and European Starlink satellite internet receiving stations.
The relevant information was passed to foreign partners by the GUR. The new message from October 23 specifies the geography of possible operations and for the first time in this context describes in detail the scenario of provocations with subsequent accusations against Ukraine.
Earlier, the Center for Countering Disinformation at the NSDC reported that Lithuanian Defense Minister Robertas Kaunas in August warned of the possible use of captured Ukrainian drones for provocations against critical infrastructure in the Baltic region. Under such a scenario, Moscow could try to shift responsibility for attacks onto Ukraine.
Separately, Ukrainian intelligence had previously warned about Russia's preparation of a large-scale additional mobilization. According to information from the GUR and the Foreign Intelligence Service made public on August 27, the Russian General Staff has developed an option to recruit another 600,000 people into the army during 2026-2027 — 300,000 annually.
At the time, Ukrainian intelligence linked such plans to high losses of Russian troops at the front and a slowdown in contract recruiting. According to its assessment, in January-July 2026, the Russian army lost about 240,000 servicemen, while under contract it recruited less than 232,000 people during the same period.
However, the information about possible mobilization pertained to a separate direction of Russian military policy. In the message dated October 23, the GUR does not directly link these plans to the preparation of provocations on European territory.
Sources: GUR MOU, GUR MOU, Center for Countering Disinformation
