Russia's War on the West

The rating above answers one question: is Russia behind these attacks? It moves on the strongest evidence anywhere in the campaign. The evidence is not equally strong everywhere, and this section shows where it stands on each front. Each one links to its details below.

New reporting from major outlets and official sources, listed as it appears. Our monitoring adds headlines from major outlets automatically. "Checked" means our software fetched the full report and confirmed it supports its headline. "Reviewed" means an editor checked it against its source. "Auto" items have not been checked yet. Tap a label for our note. None of this is an endorsement. Our assessment is the rating above.

No recent reports on this front. All sources →

• 7 Nov, 7:33 AMWider campaign
  reviewed ▾

  Our note: Italy’s foreign minister says his personal data was leaked on the dark web; the prime minister blamed pro-Russian hackers, naming no group.An editor checked this report against its source. (2026-11-07)
  Pro-Russian hackers leak Italian foreign minister’s data on dark web (Al Jazeera)
• 5 Nov, 10:17 PMSabotage
  reviewed ▾

  An editor checked this report against its source. (2026-11-07)
  Finnish court jails captain and crew member for 'aggravated criminal damage' over Baltic cable sabotage (DW.com)
• 5 Nov, 2:14 PMWider campaign
  reviewed ▾

  An editor checked this report against its source. (2026-11-05)
  Melania Trump pushes for peace at meeting with Putin envoy and Ukraine officials at White House (The Independent)
• 5 Nov, 1:17 PMBomb hoaxes
  reviewed ▾

  Our note: At least 34 flights were disrupted by hoax bomb threats this week; searches found nothing, and UK investigators said there was no evidence a state actor was behind them.An editor checked this report against its source. (2026-11-06)
  Bomb threats disrupt dozens of flights across Europe, raising hybrid war fears (The Guardian)
• 5 Nov, 12:40 PMWider campaign
  reviewed ▾

  An editor checked this report against its source. (2026-11-05)
  Kremlin Envoy Dmitriev Presents Melania Trump With Painting in Recognition of Oleshky Ceasefire (Kyiv Post)
• 5 Nov, 12:05 PMWider campaign
  reviewed ▾

  An editor checked this report against its source. (2026-11-05)
  Melania Trump hosts Russian and Ukrainian envoys at White House (The Times)
• 5 Nov, 6:20 AMBomb hoaxes
  reviewed ▾

  Our note: Nearly 30 flights were hit on Nov. 5; an email signed by “fighters of the Male State” named flights to Rome, and the movement’s founder denied involvement.An editor checked this report against its source. (2026-11-06)
  Dozens of flights in Europe hit by second wave of hoax bomb threats (Reuters via The Globe and Mail)
• 5 Nov, 5:30 AMBomb hoaxes
  reviewed ▾

  Our note: AP reports more than a dozen flights were targeted with hoax bomb threats on Nov. 5, with no hazardous materials found; the EU transport commissioner said it is too early to say whether the incidents are linked.An editor checked this report against its source. (2026-11-05)
  Multiple flights in Europe diverted because of bomb threats (Associated Press)
• 5 Nov, 4:51 AMSabotage
  reviewed ▾

  Our note: Euronews reports the Helsinki District Court sentenced the Fitburg’s Russian captain to three years and six months, and his Azerbaijani deputy to two years and 10 months, for aggravated criminal damage over the Baltic cable break.An editor checked this report against its source. (2026-11-05)
  Finnish court jails Russian captain over Baltic Sea cable sabotage (Euronews.com)
• 4 Nov, 9:07 PMSabotage
  reviewed ▾

  Our note: A Finnish court jailed the Russian captain and a senior crew member of a freighter on Nov. 5 for sabotaging two undersea cables linking Finland and Estonia.An editor checked this report against its source. (2026-11-06)
  Finnish court jails Russian captain over Baltic Sea cable sabotage (Euronews on MSN)

All 215 sources →

The rating measures how well the claim that Russia is behind these attacks is supported by evidence, not how plausible it seems. It stands at Attributed because five governments have formally blamed Russia and acted on it. Any one of these would move it.

• not seenThe bomb hoaxes traced: a government, prosecutor or Europol tying the threat emails to a state service, or charges naming who sent them.
• not seenCharges with evidence: an indictment or court filing in any of these cases (Leipzig, the Starlink fires, the drone-factory arsons, the riots) that names a Russian service, handler or payment, or such details disclosed at the Polish suspects’ extradition hearings in Germany. This would move the rating to Proven.
• not seenA court finding that a Russian service ordered or paid for one of these attacks. This would move the rating to Proven.
• not seenReleased intelligence: the United States, NATO, the EU or a European government publishing or describing on the record the evidence behind the findings the Wall Street Journal reported. Evidence showing Russian services directed the attacks would move the rating to Proven.
• not seenThe Kremlin warning confirmed: the German government confirming on the record that a Russian official warned Berlin after Leipzig.
• not seenOrganized or paid rioting: an official attribution, charges or documented paid recruitment showing a foreign state organized or paid for violence in France or Italy. Online amplification alone does not count.
• not seenEvidence pointing elsewhere: charges or court findings showing that suspects acted for another state, for money with no Russian link, or for their own reasons, or a government withdrawing its attribution. This would move the rating down.
• seenAnother attack on a Starlink or satellite ground station in Europe. On Oct. 18 an attempt to burn satellite antennas and a control unit at a Lithuanian firm storing Starlink equipment was foiled (LRT).
• seenForeign online amplification of the riots: documented for Russia’s Matryoshka network and, by France’s own attribution, Iran’s Foreign Ministry accounts. On its own it does not move the rating.
• The riots have also become a US campaign theme. On election eve, Ohio gubernatorial candidate Vivek Ramaswamy warned a rally the U.S. could become “like France” if Democrats win, blaming immigration; The Washington Post notes that education reform and the cost of living drove young people of all backgrounds into the streets (Washington Post).

Bomb hoaxes: flights and newsrooms

• Two waves in one week. On Nov. 3 at least seven flights and a cruise ship received bomb threats. By the end of Nov. 5 nearly 30 more flights had been hit (Reuters), on routes between 16 countries from Ireland to Greece, and at least 34 over the week. All landed safely, and searches found nothing suspicious (Guardian). Fighter jets escorted or intercepted some planes. In France an Aer Lingus flight from Dublin to Rome was taken to the Évreux air base after its pilot did not cooperate as expected (Reuters).
• Newsrooms, Nov. 6. Identically worded emails reached the Dublin newsrooms of RTÉ, Virgin Media TV, the Irish Independent and Newstalk. Three were evacuated, and police found no devices (POLITICO). RTÉ’s email arrived shortly before 0900 GMT, warned that a bomb would go off within 45 minutes, and claimed to come from the senders of the flight threats. Later that day threats warning “the clock is ticking” reached TV stations elsewhere in Europe; Sky said it was one of a number of media organizations threatened (Reuters, via the Jerusalem Post). In Italy, 279 hoax emails that forced school evacuations this week were signed in the name of Iran’s Revolutionary Guards, a claim not taken as credible (Irish Times).
• The emails. A threat emailed to Rome’s airports under the subject “Threat report,” purportedly from “fighters of the Male State,” claimed bombs were aboard flights from Helsinki and Dublin. Reuters could not confirm who sent it (Reuters). An official at another European airport said its threat also came from a group calling itself anti-feminist and used some of the same language; it was not clear the same group sent both (AP).
• Who the Male State is. Blogger Vladislav Pozdnyakov founded the movement in Russia in 2016. It was designated extremist in October 2021, and since the invasion of Ukraine it has refocused from attacking women to promoting the war. Pozdnyakov is believed to have, or have had, connections with Russian security services (ICCT). He says the group no longer exists and was not involved (Reuters). A signature is not an attribution: anyone can type a name into an email. Anna Kruglova, a terrorism lecturer at the University of Salford who has studied the movement, says the threats did not use its typical language and that the campaign is “probably coming from someone pretending to be a member” of an extremist group. In the choice of name she sees “an intention to attribute it specifically to Russia” (Irish Times).
• No one has been named. No government has named a culprit (Reuters). UK investigators said on Nov. 5 there was “no evidence” the hoaxes were orchestrated by a hostile terror group or a state actor “such as Russia or Iran” (Guardian). The EU’s transport commissioner said it was “too early to draw conclusions on whether the reported incidents are linked” (AP). On Nov. 6 Ireland’s Taoiseach said there is “a general view that all of the increases in hybrid attacks has a Russian connection,” but “we don’t know definitively” and “I just can’t say that specifically today in respect of what happened to RTÉ” (Irish Times).
• Some analysts point to Russia. Fredrik Wesslau of the European Council on Foreign Relations sees “a strong indication that Russia is likely behind it,” citing Moldova, where he says Russia was proven to be behind earlier bomb-threat waves (Ara). Italy’s defense minister Guido Crosetto linked the hoaxes to the week’s supermarket-fridge and French blood-supply incidents: “there’s someone who has an interest in stoking tensions” (Guardian).

The campaign

• US intelligence: Putin ordered it. People familiar with US intelligence findings told the Wall Street Journal that Putin personally ordered an intensified campaign of sabotage and covert operations against NATO countries, after neither fighting nor talks with Washington had moved Ukraine to accept his demands. CIA Director John Ratcliffe, after a trip to Moscow, told European intelligence counterparts and some politicians that Moscow is stepping up sabotage against their countries. The Journal reports that sabotage incidents have risen sharply since Leipzig (WSJ; Meduza summary). The findings have not been released.
• A warning to Berlin. After German authorities uncovered the Leipzig attempt, a Kremlin official contacted a counterpart in the German government and warned that Leipzig would not be Moscow’s last target, the Journal reports, without naming the official (WSJ; Meduza summary). Berlin has not confirmed it on the record.
• Paris had warned of this a month earlier. On Sept. 18 Macron briefed party leaders and presidential candidates in a confidential Élysée meeting on Russia’s hybrid threats; afterwards he said “the threat — particularly the Russian hybrid threat — facing Europeans and France has intensified” (Reuters).

Sabotage and arson

• Baltic cables: a conviction. On Nov. 5 the Helsinki District Court found the Fitburg’s Russian captain and a senior crew member, an Azerbaijani citizen, guilty of “aggravated criminal damage” for dragging the ship’s anchor about 130 kilometers along the seabed, damaging two cables between Helsinki and Tallinn. They were sentenced to three and a half years and two years and 10 months. Both deny wrongdoing and challenge Finland’s jurisdiction (DW).
• Latvia: a “Black Rus” group at the Belarus border. On the night of Oct. 5–6, armed, masked men tried to bring 20 migrants from Belarus into Latvia, threatened soldiers and later damaged border equipment. A Belarus-based group calling itself «Чёрные русы» (“Black Rus”) claimed it on Telegram and promised more. Latvia’s State Security Service opened a criminal case on Oct. 9 for creating a criminal organization to commit crimes against peace and against Latvia and Ukraine. Jānis Sārts, director of NATO’s Strategic Communications Centre of Excellence in Riga, says no such independent group exists: “What they are doing there now is a pure information operation” (LSM, archived). On Oct. 19 the group’s Telegram channel posted a photo of QR-code stickers bearing its name, captioned “October in Vilnius is especially beautiful” (Telegram, the group’s own post); we have found no report that the stickers were put up.
• Germany: an explosive drone at Leipzig airport. On Aug. 4 an explosive-laden drone was found near a Ukrainian cargo plane at Leipzig/Halle Airport and defused. The Wall Street Journal reports that German officials say three explosive drones flown by Russian military-intelligence agents were involved: one hit an Antonov freighter used to carry military aid to Ukraine but did not explode, one struck another plane and one detonated near the airport perimeter (WSJ). On Sept. 1 Interior Minister Alexander Dobrindt said intelligence points to “people being involved who acted on behalf of Russian state entities,” without naming them: “Taken together, the police investigations, the pattern and intelligence findings prove a Russian responsibility.” Germany ordered Russia’s consulate in Bonn closed. Russia’s Foreign Ministry called the claims a “far-fetched and contrived pretext” (NPR). No arrests or charges in the case have been reported. On Oct. 21 Germany’s defence ministry said the armed forces face “a significant sabotage threat overall,” the second-highest level and the first time it has been set that high; Süddeutsche Zeitung reports the change followed the discovery in September of an explosives-laden drone near the Wunstorf air base, the first time the military itself was targeted (Reuters, via the Kyiv Independent). On Oct. 22 federal prosecutors said a Ukrainian man, identified only as Vadym Y., had been arrested in Brandenburg on suspicion of passing a Russian intelligence agency information from European defense firms on armored-vehicle, ammunition and explosives production and on NATO’s eastern flank (DW).
• Estonia: arson at a military robotics firm. A fire hit a Tallinn building used by Milrem, which makes military robotic vehicles, on the night of Aug. 14–15. Three Latvian citizens were detained and handed to Estonia. After a six-week investigation, the government said “with full confidence” that the arson “was an act of sabotage commissioned by the special services of the Russian Federation” (Defense News).
• Poland: arson at a drone factory. Prime Minister Donald Tusk said there is “no doubt” that an Aug. 31 fire at a drone plant in Skarżysko-Kamienna “was deliberate arson, meaning an act of sabotage,” and called it “a continuation of Russia’s escalatory actions throughout the region” (Notes from Poland). No arrests have been reported.
• Slovakia: a foiled plot. In late August police foiled a planned napalm attack on a factory producing drones for Ukraine. Three foreign nationals were charged with preparing “an especially serious crime of general endangerment, committed as accomplices for hire”; one was arrested in Germany (OCCRP). Slovakia has not attributed the plot to any state.
• Poland: arson at a Starlink ground station. On the evening of September 23 a fire hit the power system and backup generator at a ground station at Wola Krobowska, south of Warsaw, owned by the state telecom operator Exatel and used to carry Starlink traffic, including to Ukraine. The station kept operating (Al Jazeera, The Local). Two days later Poland's National Prosecutor's Office said the fire “was the result of arson” and that there was “reasonable suspicion that the perpetrators acted on the orders of the Russian special services,” aiming to disrupt Starlink in Poland and other Central and Eastern European countries; at that point no one had been charged (PAP).
• Four people detained in Germany. On October 12 Prime Minister Donald Tusk announced that two Turkish citizens had been detained in Germany at Poland's request, calling it “another act of hybrid warfare” (Notes from Poland). Poland's police chief said investigators have records of their movements, recordings, fingerprints and DNA (Notes from Poland). A woman and a man were later detained in Berlin; Polish radio reported that the woman may have driven the two men (The Local). The suspects are expected to face charges of sabotage on behalf of a foreign intelligence service (Al Jazeera).
• Poland's ministers name Russia, but the evidence is not public. “We have no doubt that Russian services are behind this act of sabotage,” said Tomasz Siemoniak, the minister coordinating the special services, adding that Russia increasingly uses “individuals linked to the criminal underworld” (Al Jazeera). No handler, payment or recruitment channel has been published, and no court has ruled.
• Bulgaria: Starlink antennas burned near Sofia. An opposition MP first revealed the fire, saying 11 of 17 Starlink antennas at a site near Sofia had been set alight by two masked men. On October 14 Prime Minister Rumen Radev confirmed an arson investigation, “extremely intensive” and run with partner services, and asked the head of the national security agency not to disclose details. Asked why he would not name Russia, he said: “everything is clear to us, but the investigation must be completed” (Sofia Globe). At a Sofia court hearing on Oct. 19, the court heard that three antennas were destroyed, two partly burned and three damaged, and that the fire risked spreading to the site’s administrative building. The two accused, German citizens born in 2007, entered Bulgaria as tourists at 5:37 a.m. on Oct. 9 and left for Serbia at 11:55 p.m. that night. Defence lawyers said the camera footage shows only silhouettes (Marica; Stolica). The court’s ruling is not final. Both men were detained in Duisburg, Germany, on Oct. 23 on European arrest warrants (Sofia Globe). On Oct. 29 a Düsseldorf court ordered them held pending extradition; they have not agreed to a simplified handover, and their lawyers plan to contest the warrant. Bulgaria’s interior minister says the same pair carried out a similar attack in another EU country on Oct. 18 (Euromaidan Press).
• Ukraine warned of exactly this. In early October Ukraine's military intelligence told partners that Russian services planned sabotage in EU and NATO countries and named “Starlink satellite internet receiving stations located in European countries” among potential targets (Liga). A warning of intent, not evidence about either fire.
• Moscow has said it wants Starlink stopped. Former space chief Dmitry Rogozin wrote in July that destroying Starlink would end the war in two to three weeks (Euromaidan Press). In August Tsargrad’s owner, Konstantin Malofeev, relayed Sergey Glazyev’s call to disable the enemy’s communications satellites, “including the notorious Starlink constellation,” and to cut communications on land and under the sea (Tsargrad, archived; our translation). On Oct. 4 Dmitry Medvedev, deputy head of Russia’s Security Council, warned that if Russia’s own Rassvet satellite network were blocked, “their low-orbit Starlink satellites would come tumbling down like ornaments from a dried-up Christmas tree” (Yeni Şafak). A leaked 2023 Russian-Chinese plan escalates from regulatory pressure and jamming to cyberattacks and destroying satellites (The Insider). None of these names ground stations. They record intent, not evidence about the fires.
• Lithuania: a foiled arson attempt. At about 02:00 on October 18, someone tried to burn “satellite antennas and a control unit” at a Lithuanian company storing Starlink equipment, Prime Minister Mindaugas Sinkevičius said. Security services had warned the firm, which had stepped up security, and the attempt failed; incendiary liquids were found in containers of three to 10 litres. He said “it is likely that it is already clear who commissioned it – it is the Russian side,” and tied it to similar incidents in Poland and Bulgaria. A pre-trial investigation is open; no suspects had then been reported detained (LRT). Update, Oct. 29: Lithuanian police say the two men held in Germany over the Bulgarian Starlink fire, both in their early 20s and living in Germany, also carried out the Vilnius attack, and that the arsonists in Poland were connected to them. On Oct. 27 Lithuanian prosecutors named both as suspects in a case of creating and taking part in a terrorist group; investigators say they are examining possible ties to Russia (The Insider). Foreign Minister Kęstutis Budrys said the target was Starlink infrastructure near Vilnius and its purpose “to undermine a capability critical to Ukraine’s defence and civilian communications,” calling it a direct consequence of Russia’s war against Ukraine (X: Budrys). Vilmantas Vitkauskas, head of the National Crisis Management Centre, said it “was not a routine arson attack but an act of sabotage,” linked to earlier arson attacks on Starlink stations in Bulgaria and Poland: “Ukraine is the target” (Reuters). After the National Security Commission met on Oct. 19, Sinkevičius said attackers used incendiary liquids and Molotov cocktails; “the antennas did not catch fire; the control unit was slightly scorched.” SpaceX rents the premises from a Lithuanian company, and the head of the crisis centre said a successful attack would probably have disrupted communications. Lithuania is raising the alert level at more than 15 critical-infrastructure sites and assigning troops to guard them (Delfi/ELTA). On Oct. 29 Lithuania’s Prosecutor General’s Office charged two suspects with terrorism-related offences over the attempt. Both live in Germany, where they had already been detained at Bulgaria’s request in its Starlink arson case; one holds Turkish and German citizenship, the other Serbian and German (Reuters). Lithuanian police said the same two men are suspected in Bulgaria’s Oct. 9 arson, that the attacks in Lithuania, Bulgaria and Poland (Sept. 23) are linked, and that more people tied to the pair have been detained in Poland; prosecutors say they are cooperating with Bulgaria, Poland and Germany (Delfi).
• Russia has not answered. The Russian embassy in Warsaw did not reply to Al Jazeera; Moscow has dismissed similar accusations in the past as baseless (Al Jazeera).
• Supermarket fridges hacked; no one named. In mid-October hackers took over remote refrigeration controls at about 700 French supermarkets, Finance Minister Roland Lescure told parliament. Danfoss, the Danish maker of the control software, said most affected systems were older products that no longer received security updates, and the Paris prosecutor’s cybercrime unit is investigating (AP). No one has claimed the attack. On the night of Nov. 1, Delhaize said an “IT incident” hit refrigeration at about 40 of its Belgian stores, with similar problems at some Spar shops (Bloomberg, citing Belga), and Carrefour said 15 Belgian stores were hit; in Sweden hackers turned freezers up to 55C at seven Coop and at least four Ica stores (FT). Danfoss said no link had been established between the new attacks and its products. On Nov. 2 attackers also pushed up the temperature settings in cold rooms that a contractor runs at three sites of France’s blood service, the EFS, which store plasma; the EFS said its alarms caught it and no blood products were lost (franceinfo). The EU’s food commissioner, Christophe Hansen, called the fridge attacks a “deliberate attempt to disrupt” the EU’s food supply (Al Jazeera). No government has attributed any of these attacks, so none counts as evidence for our rating.
• Italy’s foreign minister doxxed. On Nov. 7 Foreign Minister Antonio Tajani said that “for days now, cybercriminals have been publishing my personal data on the dark web,” that they are also targeting his family, and that Italy’s “position on Ukraine” is why. Prime Minister Giorgia Meloni blamed “pro-Russian hackers.” Neither named a group or said what data was exposed, and no one has tied the attack to the Russian state (Al Jazeera/AFP).

Riots in France and Italy

• France, Oct. 17: a national cost-of-living day drew about 550,000 people by the Interior Ministry’s count (Al Jazeera). Violence followed after dark in Paris, Lyon, Marseille and other cities; the 19th-century town hall in Limoges burned and is “largely lost,” the local prefect said (France 24). The call to protest began on TikTok, after weeks of school blockades over teacher shortages and conditions (Public Sénat).
• Limoges investigation: prosecutors opened an arson investigation for destruction “en bande organisée” (by an organized group), handled by their organized-crime unit; 17 people, including seven minors, are in custody. The prosecutor said the charge may change; no foreign link has been mentioned (Actu.fr).
• Italy, Oct. 16–17: the CGIL union’s cost-of-living march in Rome was peaceful; separate youth groups clashed with police in Milan, Turin and Bologna (LaPresse; Sky TG24). Prime Minister Giorgia Meloni: “Manifestare è un diritto. Mettere a ferro e fuoco le nostre città non lo è” (“Protest is a right. Setting our cities ablaze is not”) (LaPresse).
• Russia’s fake-news network is amplifying the unrest. NewsGuard counted about 20 fake reports about the French protests from the Kremlin-linked Matryoshka network in two days, including a fake AFP story about the Pope and a fake Deutsche Welle story about dead teachers; it reported little traffic so far (Eunews, citing NewsGuard). AntiBot4Navalny logged Matryoshka videos falsely tying the protests to France’s Oct. 6 missile test (The Insider, citing AntiBot4Navalny). Historian David Colon counted 10 more on Oct. 19, pushed by bots, with very little organic reach on X (X). He says he has since identified 27 MAGA influencer accounts tied to Storm-1516, the Russian operation Microsoft has tracked since 2024, that were first to post content targeting France since June; X suspended about a third of them on Oct. 30 (X). A study of 547,471 posts by Alliance4Europe, a European nonprofit that tracks disinformation, attributes with high confidence 639 coordinated posts to Russia’s Doppelganger network. They ran in 22 synchronized waves from Sept. 2 to Oct. 14 in French, German, English and Polish, drew about 7.4 million views, and turned cost-of-living anger against aid to Ukraine (“every euro for Kyiv is a euro stolen”). The network went quiet three days before the Oct. 17 protests. The study found the large amplification clusters and comment sections looked organic: the coordination was Russian and targeted, not a mass operation. After the riots, Russia’s Pravda network published 1,018 articles about them across 28 sites, which the study says fits seeding search engines and AI models rather than reaching readers (Alliance4Europe).
• France has officially blamed Iran, not Russia, for disinformation about the protests. On Oct. 7 it summoned Iran’s ambassador over false content spread by official accounts of Iran’s Foreign Ministry: “These disgraceful provocations must stop” (KUNA, via Kuwait Times). It is the only official attribution to a foreign state so far, and it concerns online content, not organizing violence.
• Most viral fakes were not Russian. NewsGuard traced old protest clips passed off as new to accounts chasing ad revenue and to anti-immigration users (Eunews, citing NewsGuard).
• Russia has paid for unrest in France before, on a small scale. A Paris court sentenced four Bulgarians over the red hands painted on the Holocaust memorial in 2024; court documents described paid proxies sent to “stoke social tensions” (AP). A Serbian court found that Russian intelligence “structures” gave orders and money for pig heads left at Paris mosques in 2025 (Forum 18). France blamed Russia’s Doppelgänger network for amplifying the 2023 Stars of David graffiti (PBS NewsHour). In October 2026 The Insider published what it says is hacked correspondence from the Kremlin-commissioned team behind Doppelgänger: its reports for the Presidential Administration covered the Stars of David campaign, a fake video threatening attacks on Paris Olympics visitors and a scare about bedbugs in Paris (The Insider). Each was a small, paid, symbolic act, not mass unrest.
• Russia’s official line: Foreign Ministry spokeswoman Maria Zakharova has condemned French police for beating schoolchildren (Rosbalt). On Oct. 19 Kremlin spokesman Dmitry Peskov told the Defence Ministry’s Zvezda channel: “Nobody anywhere takes such absurd accusations seriously any more. Even in Europe itself” (Izvestia; The Moscow Times). The same day Zakharova posted a video of riots in France, Italy and Albania that asks “Is it the Russians?” and answers: “No, Europeans attacked the ‘blooming garden’” (RIA Novosti). Linked as the record of the Kremlin’s position, not as evidence.
• Oct. 21: Paris and Rome look for a foreign hand, but have not found one. Macron: “There is no visible foreign interference in the events that took place, but there has been foreign manipulation of information in the aftermath” (Bloomberg). He said foreign leaders “in campaign mode” had been taken in by fake AI-generated videos of the riots, which the BBC read as aimed at President Trump, who blamed mass immigration, and Prime Minister Netanyahu, who called it an “invasion of extremist Islam” (BBC). Prime Minister Meloni has asked to be briefed on what role, if any, foreign provocateurs played (Bloomberg). Italy’s ministers disagree: Defence Minister Guido Crosetto suggested Russia played a role, while Interior Minister Matteo Piantedosi said “we have no grounds to say anything” about Russian direction, though he saw a clear difference between young people’s spontaneity and the “solid and significant” organizing and encouragement of their participation (MilanoToday). An EU official told Euronews the Commission has no confirmation that foreign information manipulation is behind the events (Euronews).

Several communist groups helped build the Oct. 17 mobilization or marched in it, by their own accounts, and some have documented ties to Moscow. These are relationships, not evidence that Russia directed or paid for the protests or the violence, so they do not move the rating. The map of these ties comes from an investigation by @Restitutor_, “The French Section” (a working draft); we checked each fact below against its primary source.

• Mouvement Lycéen: the network behind the school blockades is published by the Mouvement des Jeunes Communistes de France, the French Communist Party’s youth wing, from the party’s Paris headquarters (legal notice).
• PRCF: the Pôle de Renaissance Communiste en France says its flags were in the Oct. 17 marches, called for a general strike, and ended with a call for “a Communist International” (PRCF). In October 2022 its Moscow representative handed Russia’s Communist Party (KPRF) “a financial contribution” toward aid for Donbas and gave an interview to Russian state TV, the PRCF reports (PRCF).
• URC: the Union pour la Reconstruction Communiste said on the night of Oct. 17 that “popular anger is protean, sometimes violent,” and called for work “to amplify the movement” (URC).
• OCF: the Organisation Communiste de France, founded in January by members who say they were expelled from or left the PRCF (OCF), called workers, students and retirees “to turn out massively” at the Oct. 17 demonstrations (OCF). Its outlet, Jeunesse du Monde, has released an interview recorded in March in occupied Donetsk with Boris Litvinov, the Russian Communist Party’s leader there, co-produced with the French site Le Grand Soir (Jeunesse du Monde).
• A shared platform: the PRCF and both groups that merged to form URC signed the World Anti-Imperialist Platform’s Paris Declaration, as did the KPRF and SOVINTERN (signatory list).
• SOVINTERN: the Moscow-based “International Socialist Network,” whose organizing committee is chaired by Alexander Babakov, a deputy chairman of Russia’s State Duma (SOVINTERN). US prosecutors charged Babakov and two aides in 2022 with running a Russian foreign influence and disinformation network (CNBC). Its Moscow node, headed by Duma deputy Alexander Vorobyov (EADaily), posted on Oct. 12: “The red banner over France. Youth demands justice” (Telegram). The investigation matches him to the Aleksandr Vorobev charged with Babakov.
• Calls for violence from Russia: on Oct. 17 the Telegram channel of the writer and A Just Russia politician Zakhar Prilepin forwarded a post calling for “a real guerrilla war in the cities of France, with killings of French police officers and officials” (Telegram).

The most-shared claims, and what public sources can confirm.

• The European Political Community summit in Dublin, which opens Nov. 12. An Irish government official told POLITICO the newsroom threats were “almost certainly linked” to it (POLITICO); MEP Barry Andrews compares them to the threats Denmark faced before it hosted the summit (Irish Times).
• Spain’s general election on Nov. 29. Enrique Arias Gil, a Spanish former professor whom Europol lists as wanted and Spain accuses of “cyberterrorism and espionage” in support of Moscow, says Russia has granted him asylum. He was reportedly behind the Telegram channel Desinformador Ruso (The Record). The security firm Golden Owl says that channel posted Russian Army recruitment ads and asked for information on Spanish officials ahead of the vote, and that Facebook pages posing as Spanish news outlets are run from Vietnam. Its findings have not been independently confirmed (Golden Owl).
• Extradition hearings in Germany and formal charges in Poland, which could make the evidence in the Starlink case public.
• Any German government confirmation of the Kremlin warning the Wall Street Journal reported, or release of the US findings.
• Charges in the Leipzig case and in the drone-factory arsons.
• Whether Germany arrests the two Bulgarian suspects, and arrests or charges in Lithuania.
• A possible Trump–Putin–Xi meeting at the APEC summit in Shenzhen in mid-November. The Kremlin says “work is under way”; China, the host, has not committed, and Germany’s president says Xi told him there are no plans to discuss Ukraine there and that Europeans should be at the table (FT). Watch whether European security or sabotage comes up, and whether Europe is left out.
• Any sabotage incident or armed border violation along Poland’s Kaliningrad border, where police launched a special operation on Nov. 2.
• Further attacks on airports, defence plants or satellite ground stations; casualties; or a request for NATO consultations under Article 4.
• The French and Italian intelligence inquiries into the riots: whether they name a state and describe evidence. Italy’s CGIL has called a general strike for Nov. 20 (LaPresse).
• France’s next nationwide protests on Saturday, Oct. 24: Marseille and Lyon have banned all demonstrations, and elsewhere President Macron says only authorized union marches will be allowed; Paris has extended a partial curfew to Monday, with police deployments up 20% (BBC). Macron met the intelligence services on Oct. 22 (France 24).
• Reports from researchers who measure coordinated accounts (DFRLab, CheckFirst, ISD, NewsGuard), and EU action against platforms under the Digital Services Act.

• Aug 4An explosive drone is found near a Ukrainian cargo plane at Leipzig/Halle Airport (NPR).
• Aug 15Arson at a building used by the Estonian military robotics firm Milrem in Tallinn; three Latvians are detained (Defense News).
• Late AugSlovak police foil a planned arson attack on a factory producing drones for Ukraine; three foreign nationals are charged (OCCRP).
• Aug 31Fire at a drone plant in Skarżysko-Kamienna, Poland; Tusk calls it sabotage (Notes from Poland).
• Sep 1Germany says Russia was responsible for the Leipzig attempt and orders Russia’s Bonn consulate closed (NPR).
• Sep 18Macron briefs party leaders on Russia’s hybrid threat, saying it has intensified (Reuters).
• Sep 23Fire at the Starlink ground station at Wola Krobowska, Poland (The Local).
• Sep 25Polish prosecutors open a sabotage investigation and cite “reasonable suspicion” of Russian orders (PAP).
• Late SepSchool blockades over teacher shortages and conditions spread in France (Public Sénat).
• Sep 29Estonia says Russian special services commissioned the Milrem arson (Defense News).
• Early OctUkraine's military intelligence warns that Starlink ground stations in Europe are potential Russian targets (Liga).
• Oct 6Armed, masked men push 20 migrants across the Belarus border into Latvia; a group calling itself “Black Rus” claims it (LSM, archived).
• Oct 7France summons Iran’s ambassador over disinformation about the protests (KUNA, via Kuwait Times).
• Oct 7NewsGuard reports about 20 Matryoshka fakes about the protests in two days (Eunews, citing NewsGuard).
• Oct 9Starlink antennas burned at the Plana teleport near Sofia (Sofia Globe).
• Oct 9Latvia’s State Security Service opens a criminal case against the “Black Rus” group (LSM, archived).
• Oct 12Tusk announces two Turkish citizens detained in Germany; Siemoniak: “no doubt” Russia is behind it (Al Jazeera).
• Oct 12Hackers drive up fridge temperatures at hundreds of French supermarkets; the government later puts the count at about 700 (AP).
• Oct 13Two more people detained in Berlin (The Local).
• Oct 14Radev confirms the Bulgarian arson investigation (Sofia Globe).
• Oct 16Der Spiegel, citing sources in several countries, reports the two Turkish suspects may belong to, or have been hired by, the Turkish crime gang known as the Daltons, which it says Russian intelligence may have commissioned; a court in Stuttgart will decide on extradition to Poland (Meduza, Euronews).
• Oct 16Student marches across Italy; stones thrown in Turin (Sky TG24).
• Oct 17About 550,000 march in France; violence in Paris, Lyon, Marseille; Limoges town hall burns (Al Jazeera; France 24). Clashes in Milan, Turin and Bologna (Sky TG24).
• Oct 18An arson attempt at a Lithuanian firm storing Starlink equipment is foiled; the prime minister blames Russia (LRT).
• Oct 18Limoges prosecutors open an organized-group arson investigation; 17 in custody, seven of them minors (Actu.fr).
• Oct 19A Sofia court approves European arrest warrants for two German citizens charged in absentia; they left Bulgaria the night of the fire (AP; Marica).
• Oct 19Lithuania raises security at more than 15 critical-infrastructure sites after the National Security Commission meets (Delfi/ELTA).
• Oct 19Historian David Colon counts 10 more Matryoshka fakes about the protests, pushed by bots, with very little organic reach on X (X).
• Oct 20Italy’s defence minister calls the Milan riots part of a “hybrid war”; he names no country (The Independent).
• Oct 21Germany’s defence ministry raises the military’s sabotage-threat rating to “significant,” its second-highest level (Reuters).
• Oct 21The Wall Street Journal reports US intelligence found Putin personally ordered stepped-up sabotage against NATO countries; Macron says there was “no visible foreign interference” in France’s riots (WSJ; Meduza summary; Bloomberg).
• Oct 26Romanian prosecutors (DIICOT) and intelligence say a Sept. 14 fire in Brașov near CARFIL, a unit of state arms maker ROMARM, was set by a Russia-coordinated network; two Belarusians and a Ukrainian are suspected, two arrested (Kyiv Independent, Al Jazeera).
• Oct 27Romania summons Russia’s ambassador and presents evidence on the Brașov arson; President Nicușor Dan calls it a “grave violation” of Romania’s sovereignty and part of Russia’s “hybrid war.” Russia’s embassy calls the accusations “baseless” (AP).
• Oct 28Munich prosecutors say two Belarusian men, in custody since Oct. 7, are suspected of planning an arson attack in the Nuremberg area on behalf of a foreign government and for payment; Der Spiegel reports they worked for Russia, and Romania is investigating them over the Brașov fire (Reuters).
• Oct 28Turkey detains 85 suspected members of the Daltons gang in a 30-province operation; the gang was earlier reported to be under investigation over the Starlink station arson in Poland (The Insider, citing T24).
• Nov 1Delhaize reports a refrigeration “IT incident” at about 40 Belgian stores; Swedish supermarkets report similar problems (Bloomberg).
• Nov 2Hackers push up temperature settings in plasma cold rooms at three French blood-service (EFS) sites; no blood products lost (franceinfo).
• Nov 2Polish police launch a special operation, including counter-terrorism units, along the border with Russia’s Kaliningrad exclave after a warning of possible sabotage “in the coming days.” National police chief Marek Boroń said the move rests on information “from external security services”; broadcaster RMF, citing unnamed sources, reports that military intelligence and allied agencies warned of possible border violations by armed groups (Notes from Poland).
• Nov 5A Finnish court convicts the Fitburg’s captain and a crew member over damage to two Baltic Sea cables (DW).
• Nov 6Emailed bomb threats evacuate RTÉ, Newstalk and the Irish Independent in Dublin; Sky and other European broadcasters also receive threats. No devices are found (POLITICO; Reuters, via the Jerusalem Post).
• Nov 8Polish prosecutors classify the Kraków shooting as a terrorist offence; no official links the gunman to Russia (WNP; NBC News).

• PAP via xyz.pl: National Prosecutor's Office statement, September 25
• Al Jazeera: Poland says two Turks arrested over Russia-linked Starlink station fire
• Notes from Poland: Germany detains Turks suspected of sabotaging Starlink station
• The Local: Germany detains fourth person over Polish Starlink blaze
• Sofia Globe: Bulgarian PM says investigation into arson of Starlink antennas underway
• Liga: Ukraine's military intelligence warns of Russian plans against Starlink stations
• Eunews, citing NewsGuard: Matryoshka fakes about the French protests (Oct. 7)
• The Insider, citing AntiBot4Navalny (Oct. 8)
• AP: red-hands sentences (Nov. 2025)
• France 24: Limoges town hall fire (Oct. 17)
• Sky TG24: Italy clashes (Oct. 18)
• Wall Street Journal: Airfield attack marked opening shot in Putin’s stepped-up sabotage campaign (Oct. 21)
• NPR: Germany blames Russia for attempted drone attack at Leipzig airport (Sept. 2)
• Defense News: Estonia blames Russia in arson attack on military robotics firm Milrem (Sept. 29)
• Meduza, citing the Wall Street Journal: Kremlin warned Germany after Leipzig airport sabotage (Oct. 21)
• Bloomberg: Macron accuses foreign leaders of exploiting France’s riots (Oct. 21)
• Euronews: France and Italy blame foreign powers for riots, but where’s the evidence? (Oct. 21)