Russia's Hybrid War

Evidence Is Accumulating

Opened October 21 · Day 2
A white Antonov An-124 cargo plane in Ukrainian blue-and-yellow livery flying against a blue sky.
A Ukrainian Antonov An-124 at Leipzig/Halle Airport (file photo). In August an explosive drone was found at the airport near an aircraft of this type. Photo: MarcelX42 / Wikimedia Commons (CC BY-SA 4.0)

Across the West, attacks on infrastructure that supports Ukraine are piling up, and governments increasingly blame Russia. Since August there has been an explosive drone attack at Leipzig airport, arson at drone factories, and fires at ground stations for SpaceX’s Starlink in Poland, Bulgaria and Lithuania. Germany, Estonia, Poland and Lithuania formally blame Russia. US intelligence has concluded that Vladimir Putin personally ordered a stepped-up sabotage campaign against NATO countries, and CIA Director John Ratcliffe has warned European counterparts about it, the Wall Street Journal reported on Oct. 21 (WSJ; Meduza summary). Riots in France and Italy raised a second question: is Russia stoking unrest too? This page tracks what is confirmed across Europe, the United States and NATO, who is claiming what, and what evidence would settle it.

Strength of the EvidenceUpdated
ATTRIBUTEDFour governments formally blame Russia for sabotage; US intelligence reportedly finds Putin ordered the campaign

Germany, Estonia, Poland and Lithuania have formally blamed Russia for attacks since August: an explosive drone at Leipzig airport, arson at defence plants, and fires at Starlink ground stations. Germany closed Russia’s consulate in Bonn; Poland has four suspects detained in Germany. The Wall Street Journal reports that US intelligence found Putin personally ordered the stepped-up campaign. No court has ruled, and the evidence behind the attributions has not been published. In the riots in France and Italy, Russian online amplification is documented, but there is no evidence that Russia organized or paid for the violence. The rating rises to Proven on charges, released evidence or a court finding that shows Russian services directed the attacks.

AllegedClaims only; no government has named Russia.
SuspectedOfficials suspect Russia; investigations are open.
AttributedGovernments formally blame Russia and act on it: expulsions, closures, prosecutions.
ProvenCharges, released evidence or a court finding show Russian services directed the attacks.

What would change this rating ↓

hybridwar.america2.news

Get America 2.0 in your inbox

Analysis of Russian influence, information warfare and the networks behind them. Free; unsubscribe anytime.

Where the evidence is strong, and where it is thin

The rating above answers one question: is Russia behind these attacks? It moves on the strongest evidence anywhere in the campaign. The evidence is not equally strong everywhere, and this section shows where it stands.

Sabotage and arson

Four governments formally blame Russia; no court has ruled. Germany says police work and intelligence “prove a Russian responsibility” for the Leipzig airport drone, and Estonia says Russian special services commissioned an arson in Tallinn. Polish prosecutors cite “reasonable suspicion” that Russian services ordered the Starlink fire, and four suspects are detained in Germany. Lithuania’s prime minister says the Russian side commissioned the attempt near Vilnius. Bulgaria has charged two German citizens but named no state. None of the evidence tying these attacks to Russia has been published.

The campaign as a whole

US intelligence findings, reported but not released. The Wall Street Journal reports that US intelligence found Putin personally ordered stepped-up sabotage and covert operations against NATO countries, that CIA Director John Ratcliffe has briefed European counterparts, and that a Kremlin official warned a German counterpart that Leipzig would not be the last target. Its sources are unnamed, and no government has released the findings (WSJ; Meduza summary).

Riots in France and Italy

Online amplification documented; no evidence of organizing. Russia’s Matryoshka network has pushed fake reports about the riots, and several French communist groups that helped call the protests have ties to Moscow. But President Macron says there was “no visible foreign interference in the events,” only “foreign manipulation of information in the aftermath” (Bloomberg), and the European Commission says it has no evidence that foreign manipulation is behind the riots (Euronews). This front does not move the rating today.

Latest reports

New reporting from major outlets and official sources, listed as it appears. Our monitoring adds headlines from major outlets automatically. "Checked" means our software fetched the full report and confirmed it supports its headline. "Reviewed" means an editor checked it against its source. "Auto" items have not been checked yet. Tap a label for our note. None of this is an endorsement. Our assessment is the rating above.

All 125 sources →

What would change this assessment

The rating measures how well the claim that Russia is behind these attacks is supported by evidence, not how plausible it seems. It stands at Attributed because four governments have formally blamed Russia and acted on it. Any one of these would move it.

  • not seenCharges with evidence: an indictment or court filing in any of these cases (Leipzig, the Starlink fires, the drone-factory arsons, the riots) that names a Russian service, handler or payment, or such details disclosed at the Polish suspects’ extradition hearings in Germany. This would move the rating to Proven.
  • not seenA court finding that a Russian service ordered or paid for one of these attacks. This would move the rating to Proven.
  • not seenReleased intelligence: the United States, NATO, the EU or a European government publishing or describing on the record the evidence behind the findings the Wall Street Journal reported. Evidence showing Russian services directed the attacks would move the rating to Proven.
  • not seenThe Kremlin warning confirmed: the German government confirming on the record that a Russian official warned Berlin after Leipzig.
  • not seenOrganized or paid rioting: an official attribution, charges or documented paid recruitment showing a foreign state organized or paid for violence in France or Italy. Online amplification alone does not count.
  • not seenEvidence pointing elsewhere: charges or court findings showing that suspects acted for another state, for money with no Russian link, or for their own reasons, or a government withdrawing its attribution. This would move the rating down.
  • seenAnother attack on a Starlink or satellite ground station in Europe. On Oct. 18 an attempt to burn satellite antennas and a control unit at a Lithuanian firm storing Starlink equipment was foiled (LRT).
  • seenForeign online amplification of the riots: documented for Russia’s Matryoshka network and, by France’s own attribution, Iran’s Foreign Ministry accounts. On its own it does not move the rating.

What is actually known

The campaign

  • US intelligence: Putin ordered it. People familiar with US intelligence findings told the Wall Street Journal that Putin personally ordered an intensified campaign of sabotage and covert operations against NATO countries, after neither fighting nor talks with Washington had moved Ukraine to accept his demands. CIA Director John Ratcliffe, after a trip to Moscow, told European intelligence counterparts and some politicians that Moscow is stepping up sabotage against their countries. The Journal reports that sabotage incidents have risen sharply since Leipzig (WSJ; Meduza summary). The findings have not been released.
  • A warning to Berlin. After German authorities uncovered the Leipzig attempt, a Kremlin official contacted a counterpart in the German government and warned that Leipzig would not be Moscow’s last target, the Journal reports, without naming the official (WSJ; Meduza summary). Berlin has not confirmed it on the record.
  • Paris had warned of this a month earlier. On Sept. 18 Macron briefed party leaders and presidential candidates in a confidential Élysée meeting on Russia’s hybrid threats; afterwards he said “the threat — particularly the Russian hybrid threat — facing Europeans and France has intensified” (Reuters).

Sabotage and arson

  • Latvia: a “Black Rus” group at the Belarus border. On the night of Oct. 5–6, armed, masked men tried to bring 20 migrants from Belarus into Latvia, threatened soldiers and later damaged border equipment. A Belarus-based group calling itself «Чёрные русы» (“Black Rus”) claimed it on Telegram and promised more. Latvia’s State Security Service opened a criminal case on Oct. 9 for creating a criminal organization to commit crimes against peace and against Latvia and Ukraine. Jānis Sārts, director of NATO’s Strategic Communications Centre of Excellence in Riga, says no such independent group exists: “What they are doing there now is a pure information operation” (LSM, archived). On Oct. 19 the group’s Telegram channel posted a photo of QR-code stickers bearing its name, captioned “October in Vilnius is especially beautiful” (Telegram, the group’s own post); we have found no report that the stickers were put up.
  • Germany: an explosive drone at Leipzig airport. On Aug. 4 an explosive-laden drone was found near a Ukrainian cargo plane at Leipzig/Halle Airport and defused. The Wall Street Journal reports that German officials say three explosive drones flown by Russian military-intelligence agents were involved: one hit an Antonov freighter used to carry military aid to Ukraine but did not explode, one struck another plane and one detonated near the airport perimeter (WSJ). On Sept. 1 Interior Minister Alexander Dobrindt said intelligence points to “people being involved who acted on behalf of Russian state entities,” without naming them: “Taken together, the police investigations, the pattern and intelligence findings prove a Russian responsibility.” Germany ordered Russia’s consulate in Bonn closed. Russia’s Foreign Ministry called the claims a “far-fetched and contrived pretext” (NPR). No arrests or charges in the case have been reported. On Oct. 21 Germany’s defence ministry said the armed forces face “a significant sabotage threat overall,” the second-highest level and the first time it has been set that high; Süddeutsche Zeitung reports the change followed the discovery in September of an explosives-laden drone near the Wunstorf air base, the first time the military itself was targeted (Reuters, via the Kyiv Independent).
  • Estonia: arson at a military robotics firm. A fire hit a Tallinn building used by Milrem, which makes military robotic vehicles, on the night of Aug. 14–15. Three Latvian citizens were detained and handed to Estonia. After a six-week investigation, the government said “with full confidence” that the arson “was an act of sabotage commissioned by the special services of the Russian Federation” (Defense News).
  • Poland: arson at a drone factory. Prime Minister Donald Tusk said there is “no doubt” that an Aug. 31 fire at a drone plant in Skarżysko-Kamienna “was deliberate arson, meaning an act of sabotage,” and called it “a continuation of Russia’s escalatory actions throughout the region” (Notes from Poland). No arrests have been reported.
  • Slovakia: a foiled plot. In late August police foiled a planned napalm attack on a factory producing drones for Ukraine. Three foreign nationals were charged with preparing “an especially serious crime of general endangerment, committed as accomplices for hire”; one was arrested in Germany (OCCRP). Slovakia has not attributed the plot to any state.
  • Poland: arson at a Starlink ground station. On the evening of September 23 a fire hit the power system and backup generator at a ground station at Wola Krobowska, south of Warsaw, owned by the state telecom operator Exatel and used to carry Starlink traffic, including to Ukraine. The station kept operating (Al Jazeera, The Local). Two days later Poland's National Prosecutor's Office said the fire “was the result of arson” and that there was “reasonable suspicion that the perpetrators acted on the orders of the Russian special services,” aiming to disrupt Starlink in Poland and other Central and Eastern European countries; at that point no one had been charged (PAP).
  • Four people detained in Germany. On October 12 Prime Minister Donald Tusk announced that two Turkish citizens had been detained in Germany at Poland's request, calling it “another act of hybrid warfare” (Notes from Poland). Poland's police chief said investigators have records of their movements, recordings, fingerprints and DNA (Notes from Poland). A woman and a man were later detained in Berlin; Polish radio reported that the woman may have driven the two men (The Local). The suspects are expected to face charges of sabotage on behalf of a foreign intelligence service (Al Jazeera).
  • Poland's ministers name Russia, but the evidence is not public. “We have no doubt that Russian services are behind this act of sabotage,” said Tomasz Siemoniak, the minister coordinating the special services, adding that Russia increasingly uses “individuals linked to the criminal underworld” (Al Jazeera). No handler, payment or recruitment channel has been published, and no court has ruled.
  • Bulgaria: Starlink antennas burned near Sofia. An opposition MP first revealed the fire, saying 11 of 17 Starlink antennas at a site near Sofia had been set alight by two masked men. On October 14 Prime Minister Rumen Radev confirmed an arson investigation, “extremely intensive” and run with partner services, and asked the head of the national security agency not to disclose details. Asked why he would not name Russia, he said: “everything is clear to us, but the investigation must be completed” (Sofia Globe). At a Sofia court hearing on Oct. 19, the court heard that three antennas were destroyed, two partly burned and three damaged, and that the fire risked spreading to the site’s administrative building. The two accused, German citizens born in 2007, entered Bulgaria as tourists at 5:37 a.m. on Oct. 9 and left for Serbia at 11:55 p.m. that night. Defence lawyers said the camera footage shows only silhouettes (Marica; Stolica). The court’s ruling is not final.
  • Ukraine warned of exactly this. In early October Ukraine's military intelligence told partners that Russian services planned sabotage in EU and NATO countries and named “Starlink satellite internet receiving stations located in European countries” among potential targets (Liga). A warning of intent, not evidence about either fire.
  • Moscow has said it wants Starlink stopped. Former space chief Dmitry Rogozin wrote in July that destroying Starlink would end the war in two to three weeks (Euromaidan Press). In August Tsargrad’s owner, Konstantin Malofeev, relayed Sergey Glazyev’s call to disable the enemy’s communications satellites, “including the notorious Starlink constellation,” and to cut communications on land and under the sea (Tsargrad, archived; our translation). On Oct. 4 Dmitry Medvedev, deputy head of Russia’s Security Council, warned that if Russia’s own Rassvet satellite network were blocked, “their low-orbit Starlink satellites would come tumbling down like ornaments from a dried-up Christmas tree” (Yeni Şafak). A leaked 2023 Russian-Chinese plan escalates from regulatory pressure and jamming to cyberattacks and destroying satellites (The Insider). None of these names ground stations. They record intent, not evidence about the fires.
  • Lithuania: a foiled arson attempt. At about 02:00 on October 18, someone tried to burn “satellite antennas and a control unit” at a Lithuanian company storing Starlink equipment, Prime Minister Mindaugas Sinkevičius said. Security services had warned the firm, which had stepped up security, and the attempt failed; incendiary liquids were found in containers of three to 10 litres. He said “it is likely that it is already clear who commissioned it – it is the Russian side,” and tied it to similar incidents in Poland and Bulgaria. A pre-trial investigation is open; no suspects have been reported detained (LRT). Foreign Minister Kęstutis Budrys said the target was Starlink infrastructure near Vilnius and its purpose “to undermine a capability critical to Ukraine’s defence and civilian communications,” calling it a direct consequence of Russia’s war against Ukraine (X: Budrys). Vilmantas Vitkauskas, head of the National Crisis Management Centre, said it “was not a routine arson attack but an act of sabotage,” linked to earlier arson attacks on Starlink stations in Bulgaria and Poland: “Ukraine is the target” (Reuters). After the National Security Commission met on Oct. 19, Sinkevičius said attackers used incendiary liquids and Molotov cocktails; “the antennas did not catch fire; the control unit was slightly scorched.” SpaceX rents the premises from a Lithuanian company, and the head of the crisis centre said a successful attack would probably have disrupted communications. Lithuania is raising the alert level at more than 15 critical-infrastructure sites and assigning troops to guard them (Delfi/ELTA).
  • Russia has not answered. The Russian embassy in Warsaw did not reply to Al Jazeera; Moscow has dismissed similar accusations in the past as baseless (Al Jazeera).

Riots in France and Italy

  • France, Oct. 17: a national cost-of-living day drew about 550,000 people by the Interior Ministry’s count (Al Jazeera). Violence followed after dark in Paris, Lyon, Marseille and other cities; the 19th-century town hall in Limoges burned and is “largely lost,” the local prefect said (France 24). The call to protest began on TikTok, after weeks of school blockades over teacher shortages and conditions (Public Sénat).
  • Limoges investigation: prosecutors opened an arson investigation for destruction “en bande organisée” (by an organized group), handled by their organized-crime unit; 17 people, including seven minors, are in custody. The prosecutor said the charge may change; no foreign link has been mentioned (Actu.fr).
  • Italy, Oct. 16–17: the CGIL union’s cost-of-living march in Rome was peaceful; separate youth groups clashed with police in Milan, Turin and Bologna (LaPresse; Sky TG24). Prime Minister Giorgia Meloni: “Manifestare è un diritto. Mettere a ferro e fuoco le nostre città non lo è” (“Protest is a right. Setting our cities ablaze is not”) (LaPresse).
  • Russia’s fake-news network is amplifying the unrest. NewsGuard counted about 20 fake reports about the French protests from the Kremlin-linked Matryoshka network in two days, including a fake AFP story about the Pope and a fake Deutsche Welle story about dead teachers; it reported little traffic so far (Eunews, citing NewsGuard). AntiBot4Navalny logged Matryoshka videos falsely tying the protests to France’s Oct. 6 missile test (The Insider, citing AntiBot4Navalny). Historian David Colon counted 10 more on Oct. 19, pushed by bots, with very little organic reach on X (X).
  • France has officially blamed Iran, not Russia, for disinformation about the protests. On Oct. 7 it summoned Iran’s ambassador over false content spread by official accounts of Iran’s Foreign Ministry: “These disgraceful provocations must stop” (KUNA, via Kuwait Times). It is the only official attribution to a foreign state so far, and it concerns online content, not organizing violence.
  • Most viral fakes were not Russian. NewsGuard traced old protest clips passed off as new to accounts chasing ad revenue and to anti-immigration users (Eunews, citing NewsGuard).
  • Russia has paid for unrest in France before, on a small scale. A Paris court sentenced four Bulgarians over the red hands painted on the Holocaust memorial in 2024; court documents described paid proxies sent to “stoke social tensions” (AP). A Serbian court found that Russian intelligence “structures” gave orders and money for pig heads left at Paris mosques in 2025 (Forum 18). France blamed Russia’s Doppelgänger network for amplifying the 2023 Stars of David graffiti (PBS NewsHour). Each was a small, paid, symbolic act, not mass unrest.
  • Russia’s official line: Foreign Ministry spokeswoman Maria Zakharova has condemned French police for beating schoolchildren (Rosbalt). On Oct. 19 Kremlin spokesman Dmitry Peskov told the Defence Ministry’s Zvezda channel: “Nobody anywhere takes such absurd accusations seriously any more. Even in Europe itself” (Izvestia; The Moscow Times). The same day Zakharova posted a video of riots in France, Italy and Albania that asks “Is it the Russians?” and answers: “No, Europeans attacked the ‘blooming garden’” (RIA Novosti). Linked as the record of the Kremlin’s position, not as evidence.
  • Oct. 21: Paris and Rome look for a foreign hand, but have not found one. Macron: “There is no visible foreign interference in the events that took place, but there has been foreign manipulation of information in the aftermath” (Bloomberg). Prime Minister Meloni has asked to be briefed on what role, if any, foreign provocateurs played (Bloomberg). Italy’s ministers disagree: Defence Minister Guido Crosetto suggested Russia played a role, while Interior Minister Matteo Piantedosi said “we have no grounds to say anything” about Russian direction, though he saw a clear difference between young people’s spontaneity and the “solid and significant” organizing and encouragement of their participation (MilanoToday). An EU official told Euronews the Commission has no confirmation that foreign information manipulation is behind the events (Euronews).

Who called people into the streets in France

Several communist groups helped build the Oct. 17 mobilization or marched in it, by their own accounts, and some have documented ties to Moscow. These are relationships, not evidence that Russia directed or paid for the protests or the violence, so they do not move the rating. The map of these ties comes from an investigation by @Restitutor_, “The French Section” (a working draft); we checked each fact below against its primary source.

  • Mouvement Lycéen: the network behind the school blockades is published by the Mouvement des Jeunes Communistes de France, the French Communist Party’s youth wing, from the party’s Paris headquarters (legal notice).
  • PRCF: the Pôle de Renaissance Communiste en France says its flags were in the Oct. 17 marches, called for a general strike, and ended with a call for “a Communist International” (PRCF). In October 2022 its Moscow representative handed Russia’s Communist Party (KPRF) “a financial contribution” toward aid for Donbas and gave an interview to Russian state TV, the PRCF reports (PRCF).
  • URC: the Union pour la Reconstruction Communiste said on the night of Oct. 17 that “popular anger is protean, sometimes violent,” and called for work “to amplify the movement” (URC).
  • OCF: the Organisation Communiste de France, founded in January by members who say they were expelled from or left the PRCF (OCF), called workers, students and retirees “to turn out massively” at the Oct. 17 demonstrations (OCF). Its outlet, Jeunesse du Monde, has released an interview recorded in March in occupied Donetsk with Boris Litvinov, the Russian Communist Party’s leader there, co-produced with the French site Le Grand Soir (Jeunesse du Monde).
  • A shared platform: the PRCF and both groups that merged to form URC signed the World Anti-Imperialist Platform’s Paris Declaration, as did the KPRF and SOVINTERN (signatory list).
  • SOVINTERN: the Moscow-based “International Socialist Network,” whose organizing committee is chaired by Alexander Babakov, a deputy chairman of Russia’s State Duma (SOVINTERN). US prosecutors charged Babakov and two aides in 2022 with running a Russian foreign influence and disinformation network (CNBC). Its Moscow node, headed by Duma deputy Alexander Vorobyov (EADaily), posted on Oct. 12: “The red banner over France. Youth demands justice” (Telegram). The investigation matches him to the Aleksandr Vorobev charged with Babakov.
  • Calls for violence from Russia: on Oct. 17 the Telegram channel of the writer and A Just Russia politician Zakhar Prilepin forwarded a post calling for “a real guerrilla war in the cities of France, with killings of French police officers and officials” (Telegram).

Claims in circulation

The most-shared claims, and what public sources can confirm.

Partly confirmed

Two men with German passports were arrested for the Sofia fire

Origin. Bulgarian outlets citing unnamed prosecution sources (Sega).

What the evidence shows. No named official has confirmed any arrest. Radev and the security agency have said only that the investigation is under way (Sofia Globe).

Bottom line. Partly confirmed: a Sofia court issued European arrest warrants for two German citizens on Oct. 19; no arrest has been reported (AP; DW).

Mostly true

The Limoges town hall “collapsed”

Origin. Viral posts on X on Oct. 17.

What the evidence shows. The building burned and its spire fell; the prefect said it is “largely lost” (France 24).

Bottom line. Largely accurate: the prefect says the building is largely lost.

Overstated

Italy says Moscow stoked the weekend riots

Origin. A Telegraph headline on Oct. 21.

What the evidence shows. Italy’s defence minister blamed a “hybrid war” waged through social media without naming Russia, and the prime minister has asked intelligence services to brief her on whether Moscow played a role (Telegraph; Bloomberg).

Bottom line. Italy is asking the question; it has not given an answer.

Overstated

French intelligence has confirmed that Russia-linked bot networks are exploiting the riots with fake videos of police violence

Origin. Viral posts on X, Oct. 20.

What the evidence shows. We found no statement from French intelligence. Old footage passed off as France is documented (Eunews, citing NewsGuard; Financial Times), and the European Commission is examining platforms. A senior European intelligence official told the FT there is no concrete evidence that Russian agents directly stoked the violence (Financial Times).

Bottom line. Recycled footage is real; the intelligence “confirmation” is not on the record.

Unconfirmed

“Trump’s turn against Ukraine is the product of a Russian influence operation.”

An unnamed American government source told The Economist the president is “the victim of a successful Russian info-op” and that envoys Steve Witkoff and Jared Kushner are vulnerable to Russian manipulation (The Economist). It is one anonymous source; no official has said so on the record, and no evidence has been published.

Reported, not released

Putin personally ordered a sabotage campaign against NATO countries

Origin. A Wall Street Journal exclusive on Oct. 21, citing people familiar with US intelligence findings.

What the evidence shows. The Journal’s sources are unnamed, and the findings have not been released. CIA Director Ratcliffe has reportedly briefed European services that Moscow is stepping up sabotage (WSJ; Meduza summary). Several governments separately blame Russian services for specific attacks.

Bottom line. A serious report of an intelligence finding, consistent with what governments say about individual attacks. Not yet on the record.

Likely, not shown

Poland has proved Russia ordered the attack

Origin. Headlines on October 12–13 after Polish ministers named Russia.

What the evidence shows. Prosecutors cite “reasonable suspicion,” and ministers say they have “no doubt” (Al Jazeera). Police say they hold movement records, recordings, fingerprints and DNA on the suspects (Notes from Poland), but nothing tying them to a Russian service has been published, and no charges have been filed.

Bottom line. An official attribution, not yet a proven one.

Unconfirmed

The Polish and Bulgarian attacks were carried out by the same network

Origin. Media reports that investigators are examining a possible link.

What the evidence shows. No Polish or Bulgarian official has said the cases are connected.

Bottom line. Possible, not established.

Officials’ stated aim

The attacks aim to degrade the Starlink service Ukraine depends on

Origin. Polish, Lithuanian and Bulgarian officials.

What the evidence shows. Polish prosecutors say the aim was to disrupt Starlink in Poland and other Central and Eastern European countries (PAP). Lithuania’s foreign minister says the purpose was “to undermine a capability critical to Ukraine’s defence” (X: Budrys); its crisis chief says “Ukraine is the target” (Reuters). So far the damage is small: the Polish station kept operating (The Local), the Lithuanian antennas did not catch fire, and the crisis chief noted that other such stations exist (Delfi/ELTA). Low-cost physical attacks using hired criminals fit the wider pattern of Russia-linked sabotage in Europe (Al Jazeera).

Bottom line. The stated aim of the officials naming Russia. The effect on service so far appears limited.

Plausible, unproven

The attacks are meant as leverage over Elon Musk and SpaceX

Origin. Posts on X after the Lithuanian attempt (X), and the logic of Russia’s own public statements.

What the evidence shows. Prominent Russian voices have treated Musk, not Washington, as the person who decides what Starlink does. In August Konstantin Malofeev, the owner of Tsargrad, wrote that “it is not hard to put pressure on Musk.” He quoted the Russian official Sergey Glazyev calling for cutting communications “on land and on the seabed” as well as disabling Starlink’s satellites, and he described SpaceX’s investors as backers of the war against Russia (Tsargrad, archived; our translation). In September the Kremlin’s spokesman called letting Ukraine use Musk’s systems for deep strikes “very harmful, potentially dangerous and reckless” (Interfax). Musk says the US government controls Ukraine’s military service, but the Wall Street Journal, citing US officials, reports that Musk himself ordered the October slowdown (WSJ); on Oct. 22 the Journal reported that President Trump had called Musk to ask him to lift it (WSJ); the Telegraph had reported that he proposed it to President Trump (Kyiv Independent). No official has tied the arsons to a demand on SpaceX, and SpaceX has not commented.

Bottom line. If Russia is behind the attacks, pressure on SpaceX is a logical motive. No document shows it yet.

Not shown

Russia organized the riots

Origin. Prominent Kremlin critics after Oct. 17, among them former Estonian President Toomas Hendrik Ilves (“I’m sure this is all completely spontaneous and Russia has nothing to do with this either in France or Italy”) and Garry Kasparov (“You never have to dig deep to find the Russian money”), without citing evidence (X: Ilves; X: Kasparov).

What the evidence shows. Russia’s fake-news network is amplifying the unrest online (Eunews, citing NewsGuard), and Russia has paid proxies for smaller acts in France before (AP). No government, court or researcher has shown Russia organizing or paying for this violence.

Bottom line. Possible, not shown.

False

Video shows Africans joining the student protests at the Gare du Nord

Origin. Anti-immigration accounts.

What the evidence shows. The footage is from a December 2017 demonstration, first broadcast by RT (Eunews, citing NewsGuard).

Bottom line. Old video, false context.

What to watch next

  • Extradition hearings in Germany and formal charges in Poland, which could make the evidence in the Starlink case public.
  • Any German government confirmation of the Kremlin warning the Wall Street Journal reported, or release of the US findings.
  • Charges in the Leipzig case and in the drone-factory arsons.
  • Whether Germany arrests the two Bulgarian suspects, and arrests or charges in Lithuania.
  • Further attacks on airports, defence plants or satellite ground stations; casualties; or a request for NATO consultations under Article 4.
  • The French and Italian intelligence inquiries into the riots: whether they name a state and describe evidence. Italy’s CGIL has called a general strike for Nov. 20 (LaPresse).
  • France’s next nationwide protests on Saturday, Oct. 24: Lyon has banned all demonstrations and Paris has banned protests near key sites, with 20% more police and soldiers deployed; President Macron met the intelligence services on Oct. 22 (France 24).
  • Reports from researchers who measure coordinated accounts (DFRLab, CheckFirst, ISD, NewsGuard), and EU action against platforms under the Digital Services Act.

Timeline

  • Aug 4An explosive drone is found near a Ukrainian cargo plane at Leipzig/Halle Airport (NPR).
  • Aug 15Arson at a building used by the Estonian military robotics firm Milrem in Tallinn; three Latvians are detained (Defense News).
  • Late AugSlovak police foil a planned arson attack on a factory producing drones for Ukraine; three foreign nationals are charged (OCCRP).
  • Aug 31Fire at a drone plant in Skarżysko-Kamienna, Poland; Tusk calls it sabotage (Notes from Poland).
  • Sep 1Germany says Russia was responsible for the Leipzig attempt and orders Russia’s Bonn consulate closed (NPR).
  • Sep 18Macron briefs party leaders on Russia’s hybrid threat, saying it has intensified (Reuters).
  • Sep 23Fire at the Starlink ground station at Wola Krobowska, Poland (The Local).
  • Sep 25Polish prosecutors open a sabotage investigation and cite “reasonable suspicion” of Russian orders (PAP).
  • Late SepSchool blockades over teacher shortages and conditions spread in France (Public Sénat).
  • Sep 29Estonia says Russian special services commissioned the Milrem arson (Defense News).
  • Early OctUkraine's military intelligence warns that Starlink ground stations in Europe are potential Russian targets (Liga).
  • Oct 6Armed, masked men push 20 migrants across the Belarus border into Latvia; a group calling itself “Black Rus” claims it (LSM, archived).
  • Oct 7France summons Iran’s ambassador over disinformation about the protests (KUNA, via Kuwait Times).
  • Oct 7NewsGuard reports about 20 Matryoshka fakes about the protests in two days (Eunews, citing NewsGuard).
  • Oct 9Starlink antennas burned at the Plana teleport near Sofia (Sofia Globe).
  • Oct 9Latvia’s State Security Service opens a criminal case against the “Black Rus” group (LSM, archived).
  • Oct 12Tusk announces two Turkish citizens detained in Germany; Siemoniak: “no doubt” Russia is behind it (Al Jazeera).
  • Oct 13Two more people detained in Berlin (The Local).
  • Oct 14Radev confirms the Bulgarian arson investigation (Sofia Globe).
  • Oct 16Der Spiegel, citing sources in several countries, reports the two Turkish suspects may belong to, or have been hired by, the Turkish crime gang known as the Daltons, which it says Russian intelligence may have commissioned; a court in Stuttgart will decide on extradition to Poland (Meduza, Euronews).
  • Oct 16Student marches across Italy; stones thrown in Turin (Sky TG24).
  • Oct 17About 550,000 march in France; violence in Paris, Lyon, Marseille; Limoges town hall burns (Al Jazeera; France 24). Clashes in Milan, Turin and Bologna (Sky TG24).
  • Oct 18An arson attempt at a Lithuanian firm storing Starlink equipment is foiled; the prime minister blames Russia (LRT).
  • Oct 18Limoges prosecutors open an organized-group arson investigation; 17 in custody, seven of them minors (Actu.fr).
  • Oct 19A Sofia court approves European arrest warrants for two German citizens charged in absentia; they left Bulgaria the night of the fire (AP; Marica).
  • Oct 19Lithuania raises security at more than 15 critical-infrastructure sites after the National Security Commission meets (Delfi/ELTA).
  • Oct 19Historian David Colon counts 10 more Matryoshka fakes about the protests, pushed by bots, with very little organic reach on X (X).
  • Oct 20Italy’s defence minister calls the Milan riots part of a “hybrid war”; he names no country (The Independent).
  • Oct 21Germany’s defence ministry raises the military’s sabotage-threat rating to “significant,” its second-highest level (Reuters).
  • Oct 21The Wall Street Journal reports US intelligence found Putin personally ordered stepped-up sabotage against NATO countries; Macron says there was “no visible foreign interference” in France’s riots (WSJ; Meduza summary; Bloomberg).

Key sources