TLP:CLEAR · Disclosure is not limited.

Europe Hybrid Threats: Disruption, Attribution and Response

Time window: Last 1 day · Audience: General analyst · Type: Situation report · DTG: 2026-11-14 22:39Z · Overall confidence: HIGH

BLUF

Reporting documents a Russian-linked sabotage network, including a Lithuanian prosecutorial link to the GRU, but does not establish Russian direction of the November bomb threats. European authorities are developing drone-detection options; the EU initiative remains at proposal-gathering stage, not deployment.

Executive summary

European reporting describes a cross-border network of disposable agents active in Lithuania, Poland, the Czech Republic and Romania. Lithuanian prosecutors reportedly linked a sabotage plot to the GRU. Separately, false threats disrupted flights and targeted more than 6,000 Italian schools, as well as RTÉ and Sky, but available reporting does not link that wave to Russia or establish a single coordinated campaign. The European Commission has invited proposals for cellular-based drone detection, while an impersonation call involving OpenAI security staff highlights a separate vulnerability. Attribution of recent disruptions remains the main uncertainty.

Change from previous assessment

Since the 13 November brief, reporting adds the EBU investigation of a disposable-agent network across Lithuania, Poland, the Czech Republic and Romania, plus a Lithuanian prosecutorial link between a sabotage plot and the GRU. The European Commission's cellular drone-detection call and the reported OpenAI impersonation incident are also new developments. The assessment that Russian direction of the November bomb threats is unestablished has not changed, and confidence in that attribution judgment remains low.

Key judgments

1. It is likely that Russian-linked disposable-agent activity has operated across Lithuania, Poland, the Czech Republic and Romania. The EBU Investigative Journalism Network identified Oemis Romagoza Durruthy as a central figure and Alexeis Pecora as another figure in the network; Lithuanian prosecutors reportedly linked a sabotage plot to the GRU. This supports a cross-border network assessment, but does not establish Russian responsibility for every current European disruption. (Confidence: medium · ASSESSED)
   • I&W: CONFIRM: Lithuanian prosecutors or a court publish a filing that identifies GRU tasking and connects it to named network members. (0-3 months)
   • I&W: BREAK: Lithuanian prosecutors publicly withdraw the GRU link, or court findings attribute the plot to actors without Russian direction. (0-6 months)
2. It is very likely that false bomb threats disrupted European aviation in early November. Reporting describes dozens of flights diverted, delayed or subject to emergency procedures during the first week of November, including at least 18 additional flights on 6 November across routes in nine countries. More than 6,000 Italian schools were also targeted, and threats against RTÉ in Ireland and Sky in the UK led to evacuations and broadcasting disruption. The school total rests on a single report, and the full incident count remains unsettled. (Confidence: medium · REPORTED)
   • I&W: CONFIRM: European aviation authorities or national police publish incident totals that substantiate flight diversions or emergency procedures during the first week of November. (0-14 days)
   • I&W: BREAK: Authorities revise the flight or school figures down after identifying duplicate reports or confirming that reported threats caused no operational disruption. (0-30 days)
3. It is unlikely that available public reporting establishes Russian direction of the November bomb threats or proves that they formed one operation with the Microsoft 365 outage and the US aviation disruption. The threats were attributed to unknown perpetrators, and reporting states that no verified evidence connects the separate disruptions. Russia denies involvement, but that denial does not resolve attribution. (Confidence: low · ASSESSED)
   • I&W: BREAK: Police or cyber authorities publish forensic evidence linking the threat messages to Russian tasking or to the same infrastructure used in another disruption. (0-30 days)
   • I&W: CONFIRM: Investigators identify a sender or infrastructure unrelated to Russian actors and rule out links among the bomb threats, Microsoft 365 outage and US aviation disruption. (0-3 months)
4. The European Commission's drone-detection initiative is at proposal-gathering stage, not deployment. The Commission invited EU Member States and industry partners to submit proposals by 28 February 2027 for cellular-based detection, with airports, critical infrastructure, borders, transport hubs and maritime facilities among the priority locations. The call is not yet a funding programme. (Confidence: medium · REPORTED)
   • I&W: CONFIRM: The Commission publishes submitted proposals or identifies participating authorities and industry partners before the deadline. (0-3 months)
   • I&W: BREAK: The Commission cancels the call or confirms that no proposals will proceed to pilot or deployment planning. (0-6 months)
5. It is likely that Vovan and Lexus impersonated Rustem Umerov to obtain a 17-minute video call with three OpenAI national-security officials; OpenAI confirmed the call was an impersonation. Reporting does not establish Russian state direction or compromise of Ukrainian systems. The identities and call are supported by limited reporting, so the state-link assessment remains low confidence. (Confidence: low · ASSESSED)
   • I&W: CONFIRM: Investigators or the participants release evidence connecting the impersonation to Russian state direction, such as tasking or funding. (0-3 months)
   • I&W: BREAK: OpenAI or Ukrainian officials publish a technical review establishing that sensitive information was transferred or that Ukrainian systems were accessed. (0-30 days)

Outlook & scenarios

Episodic disruption, limited attribution (60%)

The most likely course over the next 1-3 months is continued episodic threats and security incidents, with investigations unable to link the November bomb threats to Russia. EU authorities continue proposal work on cellular drone detection, without immediate deployment.

Investigations establish a Russian link (25%)

A less likely course is that police or prosecutors release forensic or court evidence connecting a new incident, or the November threats, to Russian tasking. This would strengthen the case for treating the incidents as part of a directed campaign, while leaving the scope of coordination to be established.

High-impact infrastructure sabotage (5%)

A low-probability, high-impact wildcard is a deliberate attack on Baltic Sea cables or a European transport hub that causes sustained service disruption. Existing reporting records damage to undersea infrastructure by unidentified vessels, but does not attribute those incidents to Russia.

Recommendations

1. Maintain separate incident and attribution records for bomb threats, aviation disruption, cyber outages and physical infrastructure damage. Combine cases only when investigators release matching forensic evidence or identify common tasking.
2. Track Lithuanian prosecutorial and court reporting on the GRU-linked plot. Verify whether the EBU-identified network members and activity in Poland, the Czech Republic and Romania appear in official case records.
3. Monitor the European Commission's drone-detection call through its 28 February 2027 deadline. Distinguish submitted proposals, funded pilots and operational deployments in reporting.
4. For the OpenAI impersonation incident, seek a public account of what information was disclosed and whether any systems or accounts were accessed. Recommend that staff verify senior-official requests through a known, separate contact channel.

Confidence & uncertainty

The supplied corroboration scoring assigns high overall confidence. Confidence is strongest in the occurrence of the reported disruptions, the European Commission call and the OpenAI-confirmed impersonation; the sabotage-network reporting also includes a prosecutorial GRU attribution. Confidence is lower on whether Russia directed the November bomb threats, whether the separate disruptions were coordinated, and whether the OpenAI incident had any state tasking. Those attribution uncertainties are reflected in the lower confidence levels of the relevant judgments.

Intelligence gaps

• [EEI 1.2 · PARTIAL] Observed reconnaissance activity around critical sites indicative of attack planning (unauthorised drone flights, repeated surveillance visits, loitering vehicles, mapping/photography of assets). Recommended collection: open-source/media
• [EEI 1.3 · UNCOVERED] Law-enforcement or customs seizures, arrests or interdictions of persons or shipments carrying explosives, sabotage tools, specialty cutting/electrical equipment, or covert comms gear destined for/near critical infrastructure. Recommended collection: law enforcement
• [EEI 2.1 · UNCOVERED] Emergence or amplification of coordinated social-media networks (sets of accounts, pages, channels) pushing identical narratives or hashtags across multiple platforms, including bot-like activity metrics and origin IP/common management indicators. Recommended collection: social-media/OSINT
• [EEI 2.2 · UNCOVERED] Publication or internal guidance from state-run media, proxy outlets, or identified influence platforms distributing talking points, pre-scripted messaging, or translated content targeted at specific EU countries/communities. Recommended collection: open-source/media
• [EEI 2.3 · UNCOVERED] Distribution of manipulated multimedia (deepfakes), targeted phishing/whaling campaigns, or localized false narratives timed to political events (elections, protests, court rulings) with tracked reach and engagement metrics. Recommended collection: cyber/forensic
• [EEI 3.1 · UNCOVERED] Unusual financial transactions: wire transfers, crypto conversions, or payments to shell companies, NGOs or individuals exceeding typical baselines that link to known proxies or front organisations. Recommended collection: financial
• [EEI 3.2 · UNCOVERED] Travel and movement indicators for suspected operatives: repeated border crossings, chartered/irregular flights, booking patterns or mobile/location data placing identified individuals in staging areas shortly before incidents. Recommended collection: border/immigration
• [EEI 3.3 · UNCOVERED] Cargo, freight or maritime movements with discrepancies (concealed/dual-use equipment, false manifests, unusual routing) detected at ports, rail hubs or via AIS that correspond to deliveries of material used in sabotage or influence operations. Recommended collection: customs/ports
• [EEI 3.4 · UNCOVERED] Intercepted or otherwise-obtained communications showing tasking, coordination, or payment instructions between Russian agencies/handlers and proxy groups, including identified command-and-control servers or encrypted group identifiers. Recommended collection: signals-intel/SIGINT

Red cell review: CONCUR

TLP:CLEAR