TLP:CLEAR · Disclosure is not limited.

Europe Hybrid Threats: New Attributions, State Direction Unproven

Time window: Last 1 day · Audience: General analyst · Type: Situation report · DTG: 2026-11-08 12:46Z · Overall confidence: HIGH

BLUF

Italian investigators now attribute the publication of Foreign Minister Antonio Tajani’s personal data to NoName057(16), while French prosecutors are probing bomb threats against dozens of commercial flights for possible foreign links. Reporting also describes Russian intelligence recruitment methods and alleged sabotage networks, but does not establish a single Kremlin-directed campaign connecting these cases.

Executive summary

The reporting adds detail on three strands of concern: cyber harassment targeting Tajani, threats against European flights and Irish media, and alleged Russian intelligence recruitment of proxies for sabotage. Italy’s attribution to NoName057(16) is an advance from the prior brief, but the supplied reporting does not show Russian state tasking. France’s inquiry and Ireland’s assessment indicate a possible link between flight and media threats, although the perpetrators remain unidentified. Claims about sabotage networks include official allegations and reported arrests; links between the separate cases are not established.

Change from previous assessment

Since the 7 November brief, Italian investigators are now reported to attribute the Tajani data leak to NoName057(16), advancing beyond the prior description of pro-Russian hackers without a named group. French prosecutors have opened an inquiry into threats against dozens of commercial flights, and Ireland’s government has assessed that threats to media outlets were likely linked to the airline threats. The reporting also adds Ukraine’s account of GRU and FSB recruitment methods, the reported Romagoza warrant and US charges against five RIS Network members, plus Poland’s 5 November arrests. These developments add detail but do not establish Russian state direction or links among the separate cases. The prior assessment that attribution remains unresolved is unchanged; the supplied claims do not update the earlier reporting on the Brenner Base Tunnel or the German threat assessment.

Key judgments

1. Russian intelligence services’ use of social media and job portals to recruit people for sabotage in Europe is likely an active method, but the available reporting does not show that all cited cases share one command structure. Ukraine’s Foreign Intelligence Service said on 6 November that GRU and FSB recruiters use Facebook, Telegram and job portals, escalating tasks from photographing sites or placing stickers to arson, explosions and surveillance. A separate report alleges Oemis Romagoza Durruthy coordinated at least 12 mainly Latin American people for sabotage in Poland, the Czech Republic, Romania and Lithuania between May and September 2024. The Bucharest Court of Appeal issued an international arrest warrant for Romagoza on 2 November 2026, and the US Department of Justice charged five people described as RIS Network members. Poland’s Internal Security Agency also announced on 5 November the arrest of four people suspected of espionage and illegally supplying military components to Russia. The supplied reporting does not establish that the alleged 12-person network is identical to the RIS Network defendants or the Polish suspects. This judgment rests on a Ukrainian intelligence account and secondary reporting of allegations; confidence is medium. (Confidence: medium · ASSESSED)
   • I&W: Polish, Czech, Romanian or Lithuanian investigators publish filings that corroborate shared recruiter accounts, payment channels or instructions linking named suspects to GRU or FSB handlers. (0-3 months)
   • I&W: Authorities revise or withdraw the Russian intelligence link in the Romagoza case, or establish that the Polish suspects had no connection to the reported sabotage activity. (0-3 months)
2. Italian investigators attribute the publication of Antonio Tajani’s personal data on the dark web to NoName057(16), and Tajani said his family was also targeted. Giorgia Meloni described the hackers as pro-Russian, and Reuters-reviewed screenshots showed Tajani on a list of 18 people described as hostile to the Russian Federation. The reporting identifies a pro-Russian group, but does not establish Russian state tasking or a government command chain. ANSA reported the investigators’ attribution; the supplied reporting does not include technical findings supporting it. Confidence is medium. (Confidence: medium · ASSESSED)
   • I&W: Italian investigators release or cite technical evidence linking the leak to infrastructure, accounts or payment channels used by NoName057(16). (0-30 days)
   • I&W: Italian investigators identify a different operator or publicly revise their attribution to NoName057(16). (0-30 days)
3. Ireland’s government assessed that hoax bomb claims sent to Irish media were likely part of a coordinated disruption campaign linked to threats against airlines. On 8 November, French prosecutors said they were investigating threats against dozens of commercial flights over the past week, including possible foreign-power links. No explosives had been found and the authors remained unidentified. Some messages were signed “fighters of the Male State”, but AFP had not confirmed a link, and the group’s founder denied involvement. The coordination assessment is reported from government statements, while perpetrator attribution remains unresolved; confidence is medium. (Confidence: medium · REPORTED)
   • I&W: French or Irish investigators disclose common email metadata, sender infrastructure or other forensic links between airline threats and threats to Irish media. (0-30 days)
   • I&W: Investigators identify separate authors or report that the flight and media threats had no shared infrastructure. (0-30 days)
4. It is unlikely that the supplied reporting establishes a coordinated Russian disinformation operation in Europe during this reporting period. The specific allegation that Russian disinformation aims to stop EU enlargement appears as a social-media-shared headline without examples or evidence of coordination. Giorgia Meloni separately referred to unspecified false images shared by Italian opposition members but did not identify a Russian link. RUSI reported no evidence of Russian autonomous agents managing a coordinated campaign to manipulate NATO response thresholds; that finding addresses this specific mechanism, not disinformation activity generally. Confidence is low because the EU-enlargement allegation is thinly sourced and the reported images are unspecified. (Confidence: low · ASSESSED)
   • I&W: An EU or national authority publishes original examples and documents coordinated amplification by Russian state-linked accounts. (0-3 months)
   • I&W: A review of the original EU-enlargement material finds no coordinated dissemination or Russian-linked accounts behind the claim. (0-3 months)

Outlook & scenarios

Persistent low-level disruption (60%)

Continued cyber harassment, doxxing and false threat messages are the likely near-term pattern over the next one to three months. French and Irish investigations remain open, and Italian investigators continue examining the Tajani leak. Attribution to specific groups advances unevenly, while evidence of Russian state direction remains unresolved.

Investigations establish actor-level links (30%)

Within one to three months, Italian investigators or French prosecutors publish technical findings that identify the operators behind the Tajani leak or flight threats. Those findings clarify whether incidents shared infrastructure or actors, without necessarily establishing Russian government tasking.

Physical sabotage causes serious disruption (10%)

A low-probability, high-impact outcome is a recruited operative causing a disabling fire or explosion at a European defence-industry, transport or energy site. The reported fires at Milrem Robotics in Estonia and facilities near CARFIL SA in Romania show the types of sites already cited in sabotage reporting, but the supplied claims do not establish a continuing plan to attack them.

Recommendations

1. For the French flight-threat inquiry, track prosecutor statements and court filings on email headers, sender infrastructure and overlap with messages sent to Irish media. Keep foreign-state attribution open until investigators disclose supporting evidence.
2. For the Tajani case, compare Italian investigators’ public findings with preserved dark-web posts and NoName057(16) claims. Record group attribution separately from any evidence of Russian state direction.
3. Cross-check the Ukrainian Foreign Intelligence Service account against Polish, Romanian, Czech and Lithuanian case records and the US Department of Justice filings. Do not treat the alleged 12-person network, RIS Network defendants and Polish suspects as one group unless reporting establishes the link.
4. Do not repeat the EU-enlargement disinformation allegation as established fact without the original content, publication dates and evidence of coordinated distribution. Record the source and its limitations.

Confidence & uncertainty

Overall confidence is high for the occurrence of the reported incidents and the positions attributed to named officials. Major-media reporting and official statements support the Tajani disclosure, the Italian investigators’ attribution and the French inquiry; Ireland’s government has also publicly assessed a link between media and airline threats. Some coverage repeats the same official statements, and technical attribution, links among the alleged networks and Russian state direction remain unresolved. High confidence applies to the reported situation, not to a single Kremlin-directed campaign.

Intelligence gaps

• [EEI 1.2 · UNCOVERED] Observed reconnaissance activity around critical sites indicative of attack planning (unauthorised drone flights, repeated surveillance visits, loitering vehicles, mapping/photography of assets). Recommended collection: open-source/media
• [EEI 1.3 · UNCOVERED] Law-enforcement or customs seizures, arrests or interdictions of persons or shipments carrying explosives, sabotage tools, specialty cutting/electrical equipment, or covert comms gear destined for/near critical infrastructure. Recommended collection: law enforcement
• [EEI 2.1 · UNCOVERED] Emergence or amplification of coordinated social-media networks (sets of accounts, pages, channels) pushing identical narratives or hashtags across multiple platforms, including bot-like activity metrics and origin IP/common management indicators. Recommended collection: social-media/OSINT
• [EEI 2.2 · UNCOVERED] Publication or internal guidance from state-run media, proxy outlets, or identified influence platforms distributing talking points, pre-scripted messaging, or translated content targeted at specific EU countries/communities. Recommended collection: open-source/media
• [EEI 2.3 · PARTIAL] Distribution of manipulated multimedia (deepfakes), targeted phishing/whaling campaigns, or localized false narratives timed to political events (elections, protests, court rulings) with tracked reach and engagement metrics. Recommended collection: cyber/forensic
• [EEI 3.1 · PARTIAL] Unusual financial transactions: wire transfers, crypto conversions, or payments to shell companies, NGOs or individuals exceeding typical baselines that link to known proxies or front organisations. Recommended collection: financial
• [EEI 3.2 · UNCOVERED] Travel and movement indicators for suspected operatives: repeated border crossings, chartered/irregular flights, booking patterns or mobile/location data placing identified individuals in staging areas shortly before incidents. Recommended collection: border/immigration
• [EEI 3.3 · UNCOVERED] Cargo, freight or maritime movements with discrepancies (concealed/dual-use equipment, false manifests, unusual routing) detected at ports, rail hubs or via AIS that correspond to deliveries of material used in sabotage or influence operations. Recommended collection: customs/ports
• [EEI 3.4 · PARTIAL] Intercepted or otherwise-obtained communications showing tasking, coordination, or payment instructions between Russian agencies/handlers and proxy groups, including identified command-and-control servers or encrypted group identifiers. Recommended collection: signals-intel/SIGINT

Red cell review: CONCUR

TLP:CLEAR