Suspected arsonists were detained near defense enterprises in Munich. Lithuania is investigating an attempted sabotage at a facility linked to the Starlink satellite system. And in the Black Sea, drones are attacking merchant ships. These incidents are separated by thousands of kilometers, but European authorities suspect that some of them may involve Russian structures.

Journalists from 17 European public broadcasters collected hundreds of such cases and mapped them on an interactive map. The large-scale investigation by the European Broadcasting Union (EBU), published on October 23, covers events from April 1 to October 15, 2026.

The authors studied reports from 17 European countries, verified available evidence, and tried to establish how justified the suspicions of Russian involvement are. However, this connection is far from proven in all cases.

Munich: incendiary devices near defense enterprises

One of the most illustrative episodes took place in early September in the eastern part of Munich.

According to German public broadcaster BR24, two Bulgarian citizens threw incendiary devices from a moving car onto a construction site. Several defense industry enterprises are located nearby.

A witness called the police, and the suspected perpetrators were detained.

Bavarian authorities do not rule out a political motive for the incident. According to German press, investigators are also considering the possible involvement of Russian military intelligence, the GRU.

However, this version has not yet been conclusively proven.

Such cases attract special attention from intelligence services due to the possible use of so-called disposable agents — people recruited for individual tasks without being officially included in an intelligence network.

This scheme allows organizers to distance themselves from direct perpetrators, and investigating authorities often find it difficult to establish the entire chain of those who ordered the acts.

Lithuania: attempted arson at a facility linked to Starlink

Another episode took place in Lithuania. Local authorities are investigating an attempted arson at a company whose premises housed equipment related to the American Starlink satellite communications system.

This technology is of particular importance to Ukraine, as it is used, among other things, to provide military communications.

As reported by Austrian public broadcaster ORF, Lithuanian Prime Minister Mindaugas Sinkevičius called the suspected sabotage part of Russia's hybrid war.

Interestingly, as early as October 2, Ukrainian military intelligence had warned European partners about possible Russian operations against communication facilities, including Starlink infrastructure in Europe.

However, the coincidence in the nature of threats does not prove that the Lithuanian episode is linked to specific plans reported by the GUR. The investigation has yet to establish the circumstances of the incident and possible organizers.

Black Sea: hybrid threats become deadly

The authors of the investigation paid special attention to the Black Sea, where drone attacks on merchant ships near the coasts of Romania and Bulgaria have become more frequent in recent weeks.

According to Eurovision News Spotlight, since early October at least two people have died as a result of such incidents, and at least ten more sailors are listed as missing and presumed dead.

Final data on human casualties are still unknown.

Such incidents show that threats go beyond military targets and affect civilian shipping.

In other parts of Europe, journalists recorded reports of airspace violations, suspicious activity near strategic sites, and attempted sabotage.

For example, Moldovan Defense Minister Anatolie Nosatîi stated in late September that since the beginning of 2026 the country has registered 84 cases of drone intrusion into its airspace.

Hundreds of cases on the map — but not hundreds of proven Russian attacks

The research was carried out by an international team from Eurovision News Spotlight, a network of journalists and fact-checking specialists operating within the European Broadcasting Union.

Project participants collected public reports about incidents, cross-referenced data from various sources, and categorized events.

The interactive map includes cases that security officials, authorities, or media outlets linked to Russia. For each episode, the source and degree of confirmation of the alleged involvement were taken into account.

This is a fundamentally important limitation: the map is not an official list of proven Russian operations.

In addition, a single marker may combine several incidents that occurred in the same area or are interconnected.

The researchers deliberately focused on physical incidents — sabotage, airspace violations, suspicious actions near infrastructure, and the use of recruited perpetrators.

Cyberattacks, information campaigns, and professional intelligence espionage were not included in the database.

The authors also acknowledge that their map does not reflect all possible operations: some events remain unknown to the public, and intelligence services do not disclose information about some investigations.

Russia has repeatedly denied involvement in sabotage and other actions that European authorities characterize as hybrid attacks.

The line between peace and war is becoming increasingly blurred

According to Teija Tiilikainen, Director of the European Centre of Excellence for Countering Hybrid Threats, not only is the scale of such operations growing, but also the variety of means used.

In an interview with EBU journalists, she noted that technologies and methods capable of causing direct physical damage are being used more and more often.

The expert links the increased threats to Russia's war against Ukraine and Moscow's desire to weaken Western support for Kyiv.

At the same time, a difficult question arises: when does sabotage, a border violation, or a drone attack cease to be a hybrid threat and become a full-fledged armed attack?

According to Tiilikainen, there is no universal threshold here. State responses depend on the circumstances, scale of damage, and consequences of each specific incident.

NATO countries also do not seek to publicly define a single threshold after which a specific response would follow. This ambiguity is seen as one of the tools of deterrence.

The map shows the scale of a problem previously seen only in fragments

Before the publication of the investigation, information about suspicious incidents was scattered across local police reports, government statements, and national news.

Now it can be studied on a single map: from Germany and the Baltic states to Moldova and the Black Sea.

At the same time, the collected data does not prove the existence of a single plan uniting all marked events. But it does allow one to see the geography of suspected hybrid threats and understand why European security services are paying them increasing attention.

You can explore the locations of incidents, open individual markers, and learn the details on the Eurovision News Spotlight interactive map.

Based on materials from: European Broadcasting Union, Eurovision News Spotlight, BR24, ORF.