TLP:CLEAR · Disclosure is not limited.

Ukraine: Massed Airstrikes and Reciprocal Escalation, 4 September 2026

Time window: Last 1 day · Audience: General analyst · Type: Situation report · DTG: 2026-09-04 18:40Z · Overall confidence: HIGH

BLUF

Russia is very likely to sustain a high-volume air campaign against Ukraine after launching 121 strike drones and one Kh-31P missile in the latest wave, with impacts at 15 locations and a strike on the Security Service of Ukraine headquarters in Kyiv. Civilian harm and infrastructure disruption are likely to remain elevated, while planned US diplomacy has not yet produced a mutual operational pause.

Executive summary

Russia conducted a massed overnight attack beginning on 3 September, using Shahed, Gerbera, Parody and S8000 Banderol drones from several launch areas, alongside a Kh-31P missile from the Black Sea. Ukrainian air defence reported 103 drones destroyed or suppressed, but strikes hit 15 locations and caused casualties and damage in Kyiv, Odesa, Kyiv region and other areas. Ukraine is also sustaining pressure on Russian civil aviation, with airport closures, flight cancellations and diversions reported. US envoy travel to Moscow and Kyiv is planned but remains subject to conflicting dates, safety arrangements and questions over the Kyiv leg.

Change from previous assessment

Since the 3 September brief, the assessment adds a new massed Russian attack beginning on 3 September and continuing into 4 September, a strike on the SBU headquarters in central Kyiv, fresh Odesa casualties and power outages in four Ukrainian regions. Evidence of disruption to Russian civil aviation has expanded from airport suspensions to reported average daily cancellations, diversions and wider airport closures. Confidence in the broad air campaign remains high, while confidence in casualty totals, the organisation of Ukraine's airport operation and the envoy travel schedule remains medium because of conflicting or single-source reporting. The retaliation judgment is new.

Key judgments

1. Russia is very likely sustaining an expanded long-range air campaign against Ukraine. The attack beginning on the evening of 3 September involved one Kh-31P guided missile and 121 strike drones, including Shahed, Gerbera, Parody and S8000 Banderol types launched from Millerovo, Oryol, Kursk, occupied Donetsk and Hvardiiske in Crimea. Ukrainian air defence reported 103 drones destroyed or suppressed by 09:30, while impacts were recorded at 15 locations and debris at six. Russian airstrikes on Kyiv have now extended into a 10th consecutive day. (Confidence: high · ASSESSED)

• I&W: Confirmation: the Ukrainian Air Force reports another package of roughly 100 or more Russian drones, a missile launch, and impacts across multiple named Ukrainian regions. (0-14 days)
• I&W: Break: seven consecutive days pass without a massed Russian drone or missile attack and without impacts beyond isolated incidents. (0-14 days)

2. Civilian harm and essential-service disruption in Ukraine are very likely to remain elevated over the next 14 days. The 4 September attack killed one person and injured at least five others, including a child, in Odesa; a Russian drone strike on the SBU headquarters in central Kyiv wounded 12 people; and Russian shelling killed two police officers in Pavlohrad district. Power outages were reported in four Ukrainian regions. Confidence is reduced because Odesa casualty reporting changed from three initially reported injured to at least five injured, and separate reports describe additional overnight casualties in other locations. (Confidence: medium · ASSESSED)

• I&W: Confirmation: Ukrainian authorities report new strikes causing casualties in Kyiv or Odesa and power outages in additional regions. (0-14 days)
• I&W: Break: Ukrainian authorities report no new civilian casualties or regional power outages for seven consecutive days despite continued Russian launches. (0-14 days)

3. Ukraine is likely to sustain pressure on Russian civil aviation over the next 14 days, but a complete halt to civil flights in European Russia is unlikely. Vnukovo suspended operations on 3 September, Sheremetyevo and Domodedovo imposed restrictions, Flightradar24 recorded an average of 86 cancellations per day from 1 September, and flights from Uzbekistan to Moscow were diverted or returned. Russian officials reported 548 Ukrainian drones directed towards Moscow between 2 and 3 September, while other reporting recorded 32 Russian airports temporarily closed per day on average in August. The assessment of a single, centrally organised airport-blocking operation rests partly on medium-confidence and source-attributed reporting, including competing references to the Kover and M&Ms operations. (Confidence: medium · ASSESSED)

• I&W: Confirmation: Vnukovo, Sheremetyevo or Domodedovo report repeated closures, while Flightradar24 records daily cancellations or diversions above the 3 September disruption level. (0-14 days)
• I&W: Break: all three Moscow airports operate without restrictions for seven consecutive days and reported cancellations return to normal levels. (0-14 days)

4. A mutual operational pause is unlikely over the next 14 days, although diplomatic contact is likely to continue. Russia conducted a massed attack while plans for visits by Steve Witkoff and Jared Kushner were under discussion. Volodymyr Zelensky said Ukraine would refrain from airstrikes during negotiations and called on Russia to halt its airstrikes, but the reporting records no reciprocal Russian commitment. The envoys' travel remains planned rather than finalised because the reported dates range from 5 and 6 September to the weekend and early following week, and unnamed-source reporting disputes whether the Kyiv leg will proceed. (Confidence: medium · ASSESSED)

• I&W: Confirmation: the envoys travel to Moscow and Kyiv and both governments announce a time-limited suspension of air operations during the meetings. (0-14 days)
• I&W: Break: Russia conducts another massed attack during or immediately after the planned meetings, or the Kyiv leg is cancelled without a replacement date. (0-14 days)

5. Ukraine is likely to conduct a tangible retaliatory strike after the Russian drone attack on the SBU headquarters in Kyiv, raising the risk of reciprocal targeting of high-value sites. Zelensky said the drone was aimed at the head of the SBU's office and ordered an appropriate response that would mirror the strike where possible. The forecast rests on stated intent rather than observed preparations, so confidence is medium. (Confidence: medium · ASSESSED)

• I&W: Confirmation: Ukrainian authorities announce or document a strike on an identified Russian military, security or government facility and describe it as a response to the Kyiv SBU attack. (0-14 days)
• I&W: Break: Ukrainian authorities withdraw the retaliation pledge or 14 days pass without a claimed Ukrainian strike linked to the SBU attack. (0-14 days)

Outlook & scenarios

Sustained reciprocal strike cycle (65%)

Russia continues launching packages of roughly 100 or more drones and missiles against Kyiv, Odesa and other Ukrainian regions. Ukraine maintains drone pressure on Moscow-area airports and Russian sites such as the Sochi oil depot. Civilian casualties, power outages and flight disruption remain recurring effects.

Diplomatic contact without a durable pause (45%)

Steve Witkoff and Jared Kushner travel to Moscow and Kyiv over the weekend or early the following week after safety arrangements are agreed. Ukraine observes a limited restraint during the meetings, but Russia continues selected air operations, preventing a mutual operational pause.

Short-lived negotiation-linked restraint (25%)

Both sides accept a narrowly defined pause covering the envoys' movements and meetings. The pause lasts days rather than weeks, with no wider ceasefire mechanism and renewed strikes after the diplomatic contact ends.

Retaliatory escalation wildcard (20%)

Ukraine follows through on Zelensky's order for a response mirroring the SBU headquarters strike. Russia answers with another high-profile attack on Kyiv or other Ukrainian government and security infrastructure, narrowing the space for the planned diplomatic visits.

Recommendations

1. Maintain a 0-14 day strike tracker covering Russian launch volumes, missile types, drone types, Ukrainian interception figures, impact locations and damage in Kyiv, Odesa, Kyiv region and the four regions reporting power outages.
2. Reconcile casualty reporting before publication by separating the 4 September Odesa attack from other overnight incidents, and record the time of each official update so initial and revised figures are not treated as competing events.
3. Track official US, Russian and Ukrainian statements on the movements of Steve Witkoff and Jared Kushner. Treat 5 and 6 September as provisional until travel, safety commitments and the Kyiv leg are independently confirmed.
4. Build a daily aviation disruption baseline for Vnukovo, Sheremetyevo and Domodedovo using airport notices, airline updates and Flightradar24. Record cancellations, delays, diversions and the duration of each restriction.
5. Keep the Kover and M&Ms labels separate in assessments. Attribute operational intent and drone numbers only when supported by direct official statements or additional independent reporting.
6. Monitor Ukrainian statements and Russian incident reporting for a strike explicitly framed as retaliation for the SBU headquarters attack. Escalate analytic attention if a Russian or Ukrainian strike targets a named government or security facility.

Confidence & uncertainty

Overall confidence is high because the core developments are corroborated by Ukrainian official reporting, wire services, major media and operational data from Flightradar24. Multiple high-confidence claims support the Russian massed attack, the strike on the SBU headquarters, the Odesa casualties and the Moscow-area aviation disruption. The main uncertainties concern changing casualty totals, the scale and attribution of Ukraine's airport pressure campaign, and the exact timing and status of the planned US envoy visits.

Intelligence gaps

• [EEI 1.1 · PARTIAL] Number of airstrikes and aircraft/UCAV sorties per 24-hour period, broken down by administrative region and timestamped geolocation of each strike/strike cluster. Recommended collection: air defense radar/ADS-B
• [EEI 1.3 · PARTIAL] Airspace access and sortie origin information: airbases, staging areas, tanker/ISR support flights, and routing corridors used in the last 7 days. Recommended collection: airspace/ADS-B; satellite/imagery
• [EEI 1.4 · PARTIAL] Changes in temporal or target-patterns compared to the prior baseline (new target types, time-of-day shifts, concentration on specific infrastructure or front sectors). Recommended collection: open-source media; satellite/imagery
• [EEI 2.2 · UNCOVERED] Functional status reports and capacity of hospitals and emergency services in strike-affected areas (beds available, emergency department functionality, evacuation of patients). Recommended collection: humanitarian organizations/civilian authorities
• [EEI 2.3 · UNCOVERED] Operational outages and damage reports for critical infrastructure (power plants/substations, water treatment, telecommunications, rail junctions, bridges) with geolocated pre/post imagery where feasible. Recommended collection: utility operators; satellite/imagery
• [EEI 2.4 · UNCOVERED] Population displacement metrics: numbers and routes of internally displaced persons, shelter occupancy rates, and evidence of mass evacuations or blocked humanitarian access corridors. Recommended collection: humanitarian organizations; social media
• [EEI 3.1 · PARTIAL] Statements, orders, or internal communications (official or leaked) indicating stated campaign objectives, target prioritization, or changes in rules of engagement. Recommended collection: signals/COMINT; open-source media
• [EEI 3.2 · UNCOVERED] Evidence of munitions and parts resupply rates: documented deliveries to forward depots/airbases, rail/road convoys with munitions manifest, or satellite imagery showing stockpile levels over time. Recommended collection: logistics tracking; satellite/imagery
• [EEI 3.3 · PARTIAL] Indicators of escalatory posture or force employment changes: deployment or activation of long-range strike assets, increased sorties of strategic platforms, or movement/deployment of additional surface-to-air systems. Recommended collection: satellite/imagery; air defense radar
• [EEI 3.4 · UNCOVERED] Foreign involvement or external support evidence: observed deliveries of strike munitions, presence of foreign contractor personnel at bases, or procurement transactions tied to the campaign. Recommended collection: customs/open-source intelligence; satellite/imagery

Cited sources

[1] 24 Канал (24tv.ua) · Россия атаковала Украину с помощью дронов и ракеты: сколько целей сбила ПВО (B) · Fri Sep 04 2026 06:50:00 GMT+0000 (Coordinated Universal Time) · sha256:9e01cfe825e4 [2] Apostrophe (apostrophe.ua) · 103 дроны: силы ПВО сбили и подавили цели во время ночной атаки РФ (D) · sha256:092dd4c96cda [3] Reuters (syndicated via Devdiscourse) · Russian drone strikes Ukraine's security service HQ, escalating air war (A) · sha256:af89e4a66d03 [4] WRAL (republishing Associated Press) · Russian drone strikes Ukraine security service headquarters as US talks on the war are expected (A) · Fri Sep 04 2026 10:33:11 GMT+0000 (Coordinated Universal Time) · sha256:bb6738673f8e [5] Gordon (gordonua.com) · Убиты полицейские и гражданские. За ночь РФ атаковала несколько областей. Фото (D) · Fri Sep 04 2026 00:00:00 GMT+0000 (Coordinated Universal Time) · sha256:7cc3e5eee440 [6] ua.news · Khosro, an Iranian military medic, has come to Ukraine's defense (D) · Fri Sep 04 2026 14:17:43 GMT+0000 (Coordinated Universal Time) · sha256:aea64541ee5b [7] Azattyq Asia (Radio Free Europe/Radio Liberty) · Насколько существенно Украина может нарушить гражданское авиасообщение в России? (A) · Fri Sep 04 2026 06:15:28 GMT+0000 (Coordinated Universal Time) · sha256:15bc16cf63d4 [8] Glavred (glavred.info) · Украина блокирует небо над Россией: сколько авиакомпаний уже сократили рейсы (D) · Fri Sep 04 2026 08:04:00 GMT+0000 (Coordinated Universal Time) · sha256:9c87857d1f17 [9] Deutsche Welle (DW) · Киев начал операцию по блокировке аэропортов Москвы (A) · Thu Sep 03 2026 13:37:04 GMT+0000 (Coordinated Universal Time) · sha256:d10c188341fe [10] UNN (Ukrainian National News) · "Witkoff gets scared": the first trip by Trump's envoys to Kyiv is in question, discussions are ongoing - reports (D) · Fri Sep 04 2026 09:47:28 GMT+0000 (Coordinated Universal Time) · sha256:febc24af42cb [11] Reuters · Russian drone strikes Ukraine's security service HQ, escalating air war (A) · sha256:79521b16a394

Source content hashes were computed at collection time; the cited text is preserved unmodified for the life of this product.

TLP:CLEAR