Six NATO members along the alliance’s eastern flank have absorbed a sustained pattern of sabotage, cyberattacks, airspace violations and election interference attributed to Russia, ranging from rail explosions in Poland to drone incursions over Romania, the Congressional Research Service has reported.
Published on 11 August 2026 under the reference R49134, the report examines Poland, the three Baltic states, Romania and Bulgaria as case studies. All six sit along either the Baltic Sea or the Black Sea, have supplied military and other support to Ukraine, and are comparatively more exposed to cross-border tactics because of their proximity to Russia or to Belarus.
One study cited in the report found the number of Russian hybrid attacks in Europe quadrupled between 2023 and 2024, while a separate investigation compiled at least 151 incidents of reported Russian operations between February 2022 and March 2026.
Poland’s Internal Security Agency reported in April 2025 that it had detained 44 people in connection with spying or sabotage on behalf of Russia or Belarus since the 2022 invasion. Those apprehended included Russian, Belarusian, Ukrainian and Polish nationals, accused or convicted of activity that spanned an arson attack on a Warsaw shopping centre, surveillance of sensitive military sites and plans to attack railways carrying supplies bound for Ukraine. Two separate attacks damaged Polish rail lines on 16 November 2025, which Prime Minister Donald Tusk described as “an unprecedented act of sabotage.” Polish authorities suspect two Ukrainian citizens working for the FSB, who reportedly fled into Belarus afterwards.
Ahead of Poland’s 2025 presidential election, officials accused Russia of spreading disinformation online and conducting cyberattacks against critical infrastructure. Deputy Prime Minister and Digital Affairs Minister Krzysztof Gawkowski said in a speech that May, as reported by Polish media, “We are currently witnessing unprecedented Russian interference in the electoral process.” He also asserted that the GU had doubled its information and cyber activity targeting Poland compared with the previous year.
In the Baltic states, influence operations have typically sought to portray the three countries as illegitimate and dysfunctional, NATO and the United States as imperial powers, and Baltic governments as Russophobe regimes oppressing ethnic Russian populations. Distributed denial-of-service attacks and other disruptive cyber operations attributed to pro-Russia hacker groups regularly target critical infrastructure, public service websites, media, and the financial and transport sectors. Authorities have also suspected Russian security services of involvement in vandalism against monuments, memorials and pro-Ukraine symbols. When the chief of staff of the late Russian opposition leader Alexei Navalny was attacked with a hammer outside his home in Vilnius in March 2024, Lithuanian intelligence characterised the incident as probably Russian-organised and implemented.
Romania, which borders Ukraine, has recorded 29 unauthorised incursions of Russian drones into its airspace, alongside numerous cases of drone debris landing on Romanian territory. Its Ministry of National Defence has counted more than 100 Russian attacks on Ukrainian targets near the shared border since 2022. A Russian GERAN-2 drone crashed into a residential building in Galaţi in May 2026, injuring two people, and a Romanian non-governmental organisation subsequently reported that coordinated social media posts appeared to be stoking public fear and casting doubt on official accounts of the incident. Over three days in July 2026, Romanian F-16s shot down drones that had entered national airspace, at least one assessed to be of Russian origin, after which Bucharest summoned the Russian ambassador and expelled a Russian diplomat.
Bulgaria has faced cyberattacks attributed to pro-Russia groups and, according to the report, its defence industry may have been targeted by Russia-linked sabotage operations. A study published in March 2026 warned that the country is one of the EU’s most permissive information environments for non-democratic malign manipulation, citing prolonged political instability and polarisation, an embedded amplification infrastructure rooted in state capture, weak regulatory enforcement and low societal resilience. Bulgarian authorities launched an initiative to counter disinformation and hybrid threats ahead of the April 2026 parliamentary election and sought assistance from the EU.
