Poland, France, Denmark and Lithuania have warned since 17 September that Russia may strike NATO territory and pass the strike off as an accident or a false flag. Estonia's interior ministry, NATO's secretary general and the U.S. ambassador to the alliance have each said they see no sign that an attack is imminent.

Denmark's Defence Intelligence Service rated the risk of a limited Russian military attack on one or more NATO states "low but growing" on 24 September. Prime Minister Donald Tusk had told the Polish parliament a week earlier that Russia was likely to send drones or missiles into allied territory and call them mistakes.

French President Emmanuel Macron called party leaders to the Elysée Palace on 18 September, ordered a plan to protect critical infrastructure and endorsed Tusk's warning. Lithuania's foreign minister said the intelligence behind the Polish warning dated from July. France, the Netherlands, Finland, Lithuania and Switzerland each warned their citizens of heightened Russian threats that weekend.

Germany formally blamed Russian military intelligence on 1 September for an explosives-laden drone that struck a Ukrainian cargo aircraft at Leipzig/Halle airport in August. A second drone, found in mid-September near the air base at Wunstorf that houses Germany's A400M transport fleet, is now with federal prosecutors. A Russian drone hit a Ukrainian train two kilometres from the Polish border on 13 September, minutes after a train carrying former British prime minister Boris Johnson and other European politicians had left the station. Italian jets flying for NATO shot down a Russian Gerbera drone over Lithuania on 15 September. Polish prosecutors opened a sabotage and terrorism inquiry on 25 September into an arson attack on the Starlink ground station that serves Central and Eastern Europe, saying they suspect the perpetrators acted on the instructions of Russian special services.

Macron said on 24 September that the CIA had not warned French services of any Russian drone attack from ships, contradicting a Spanish newspaper report that had spread across Europe the day before. Italy's defence minister called the same report unsubstantiated.

Denmark's assessment

Thomas Ahrenkiel, head of the Danish Defence Intelligence Service, presented the assessment in Copenhagen on 24 September alongside Defence Minister Jeppe Bruus and the chief of defence, General Michael Hyldgaard.

Ahrenkiel said: "Russia is likely to intensify its hybrid attacks on NATO countries in the coming months." He said the aim of any Russian attack would be to split NATO rather than to seize a country.

Ahrenkiel's service said an outright Russian invasion of alliance territory remained highly unlikely but could not be ruled out. It found that "Russia has become more willing to take risks" and that Russia may regard the next few years as a window of opportunity if it doubts the U.S. commitment to defend its European allies.

Danish analysts set out three forms a limited Russian attack could take: isolated strikes with long-range drones or missiles on infrastructure that supports Ukraine, false-flag operations using Ukrainian-made drones, and the deployment of a small number of troops into NATO border areas, possibly under the pretext of protecting Russian minorities.

Earlier Danish assessments tied the risk of a Russian attack on NATO to the end of the war in Ukraine. The September assessment drops that condition and places the risk inside the current war.

Denmark's Agency for Societal Security raised its threat level for destructive cyber attacks from medium to high on the same day. Laila Reenberg, the agency's director, said such attacks could hit critical societal functions, authorities, businesses and citizens. The agency cited a finding by the Danish Security and Intelligence Service that Russian intelligence officers had planned and prepared sabotage in Denmark, including by trying to recruit Danes.

Pro-Russian hackers attacked a Danish waterworks in late 2024 and left 450 households without water, according to the agency. Poland's government said in December 2025 that it had prevented a Russian attack on its energy sector.

A Russian frigate fired two flares towards a Danish Fennec military helicopter photographing it in international waters off Gedser on 14 September. One flare passed close to the aircraft. No one was hurt. Bruus said it was "very unprofessional seamanship." He said: "It is serious. It is an expression of the boundaries having been moved regarding the willingness to take risks from the Russian side."

Foreign Minister Lars Løkke Rasmussen said he would summon the Russian ambassador over the flares. He called the intelligence report a serious warning and said Denmark had to stand firm against Russian attempts to sow discord.

Poland's warning of staged accidents

Tusk told the Sejm on 17 September that intelligence from NATO, Ukraine and the U.S. showed Russia was preparing hybrid drone and missile strikes against countries that support Ukraine.

Tusk said: "There is a real risk that the territory of one or several NATO countries on the eastern flank may be entered by drones or other types of missiles." The "official narrative will be that this is an accident," he said.

Tusk said the strikes would be meant to paralyse NATO and show that Article 5, the alliance's mutual defence clause, "exists only in theory." He said Polish intelligence had gathered evidence that Russia aims to destroy Ukraine's economy and logistics and to break NATO's resolve through attacks on member states, and warned that the coming winter would be the hardest since the full-scale invasion began in February 2022.

Russia's foreign ministry said the warning was "contrived" and "far-fetched."

U.S. President Donald Trump announced progress towards a permanent U.S. Army base in Poland shortly after Tusk spoke and said it was "a historic step for our Great U.S./Polish Alliance."

Polish soldiers recovered a Russian military drone from the Baltic Sea off the beach at Rusinowo, near Jarosławiec, on 14 September, Defence Minister Władysław Kosiniak-Kamysz said. He said a preliminary inspection had confirmed its Russian military origin and that further analysis was under way.

A civilian drone flew inside the no-fly zone about one kilometre from the U.S. Aegis Ashore missile defence base at Redzikowo in northern Poland on 15 September. Poland's defence ministry said the drone "posed no threat whatsoever" to the base, that air defence systems tracked it throughout and that the military had located its operator and informed the police. The ministry declined to say whether anti-drone or electronic warfare systems at the base were used.

Russian drone and missile strikes on western Ukraine forced Poland to evacuate the Dorohusk and Zosin border crossings for about 30 minutes around noon on 24 September. Polish military aircraft flew over eastern Poland during the attack, and the Government Security Centre sent alerts to residents of the Lublin and Podkarpackie regions. Russian drones hit targets in the Volyn, Rivne, Khmelnytskyi, Zhytomyr and Vinnytsia regions, and a residential building in Khmelnytskyi was struck.

Radar tracked a drone crossing from Ukraine into Romania the same morning before it crashed near the town of Solca in Suceava county. Romania's Ministry of National Defence said two F-16s were sent to monitor it and that it caused no casualties or damage. Residents received an emergency alert at 06:26.

Czech fighter jets flew a combat air patrol over Poland on the night of 23 to 24 September.

Lithuanian Foreign Minister Kęstutis Budrys said the intelligence behind the Polish warning included possible false-flag operations. He said the public statements by European leaders were a "coordinated campaign to warn Russia."

Polish Foreign Minister Radosław Sikorski told a panel at the UN General Assembly on 25 September that Russia was "cooking up something big this year." He gave no detail. Sikorski had said on 9 July that Poland had credible information that Russia was planning something again.

Lithuania's Gerbera

Italian fighter jets based at NATO's air policing station at Šiauliai shot down a drone over central Lithuania on 15 September after it crossed the border from Belarus. Residents of the Vilnius and Kaunas regions received air threat alerts as it crossed the country. It was the first drone shot down over Lithuanian territory since Russia's full-scale invasion of Ukraine.

President Gitanas Nausėda said the drone was a Russian-made Gerbera "intended for Ukraine that was diverted from its course by Ukrainian electronic warfare measures and entered our territory." He said it was "most likely not a deliberate attack against Lithuania."

Defence Minister Robertas Kaunas said bomb disposal experts found an explosive device at the crash site and "successfully defused it." Lithuania said it would send a diplomatic note to Belarus.

Leipzig and the Antonov

An FPV drone struck the wing of a Ukrainian Antonov An-124 cargo aircraft near a fuel tank at Leipzig/Halle airport on the evening of 4 August and failed to detonate. The aircraft had flown in from France and was empty when it was hit. Leipzig/Halle is a hub for Ukrainian cargo traffic.

Investigators found in September that the drone carried about 1.8 kilograms of Semtex hidden in a vegetable tin, more than twice the 800 grams first reported in August, and that the detonator failed because a wire snapped. The Semtex had been smuggled through Bulgaria and Serbia in hidden compartments of commercial lorries and buried in caches near the airport.

A Boeing 757 operated by European Air Transport Leipzig struck a second drone at about 400 metres while going around during the airport's closure the same night, then diverted to Hanover with minor damage to its nose. Investigators found a third drone in a field at Kabelsketal on 14 August with 50 grams of explosive. An antenna fixed to a nearby tree appears to have been used to boost the control signal.

German Interior Minister Alexander Dobrindt said on 5 August that the attack marked "a new level of danger" and had been carried out by professionals probably acting for a foreign power. The German government formally attributed the attack to Russian military intelligence on 1 September, ordered Russia's consulate-general in Bonn closed, expelling about 60 staff, and shut the Russian House cultural centre in Berlin.

German investigators have identified two suspects, a Russian citizen identified only as Oleg L. and a Belarusian identified only as Andrei K. Oleg L. is suspected of organising the logistics for the GRU. He entered Germany through Berlin Brandenburg Airport from Turkey, left for Serbia and is now in Russia. German security officials knew of his GRU links when he entered and did not put him under surveillance. Andrei K. is suspected of flying the drone. His DNA was found on glove fragments on the antenna mast, and matched records in Finland and Lithuania, where he had come to police attention for theft and other offences. Polish investigators have linked him to a fire at a DIY store in Łódź in 2024 that is being investigated as Russian-directed sabotage. Neither man is in German custody.

Sergey Nechayev, Russia's ambassador to Germany, said the accusations were "unsubstantiated, absurd, and irrational." Russia closed Germany's consulate-general in St Petersburg, and Foreign Minister Sergei Lavrov announced the closure of Goethe-Institut centres in Moscow, St Petersburg and Yekaterinburg.

A farmer found a crashed drone about one kilometre from the Wunstorf air base in Lower Saxony in mid-September. Police later found suspected explosives a few metres from the wreckage. At least one component was made with a 3D printer, and investigators believe the drone may have lain in the field for up to two years. Germany's Federal Prosecutor's Office and the Federal Criminal Police Office have taken over the case and are checking for links to Leipzig. Forensic tests on the suspected explosives had not been completed by 22 September.

A fire at a transformer substation in Berlin on 7 September renewed concern in Germany about sabotage against the power grid. No attribution for that fire has been published.

The train at Yahodyn

A Russian drone struck a passenger train at Yahodyn station in Ukraine's Volyn region, two kilometres from the Polish border, on 13 September. The train was evacuated as the drone approached and no one was hurt.

Johnson, former Swedish prime minister Carl Bildt and a group of other European politicians had left the station minutes earlier on a separate train. "This wasn't our train, but the one just minutes after us," Bildt wrote. Johnson said the strike was "random and senseless."

Ukrainian Railways said: "It is entirely possible that the Russian drone's intended target was the diplomatic train."

Russia's Ministry of Defence said it had targeted "infrastructure facilitating military cargoes from Europe" in western Ukraine. It did not address the diplomatic train. Sikorski called the strikes near NATO territory an escalation.

Fire broke out at about 21:00 on 23 September at a Starlink ground station in the village of Wola Krobowska, south of Warsaw. The station is owned by the Polish state telecommunications operator Exatel. It links Starlink satellites to terrestrial networks and, with a facility in Lithuania, serves all of Central and Eastern Europe, including the terminals Ukraine's armed forces use for battlefield communications.

Krzysztof Gawkowski, deputy prime minister and digital affairs minister, said "the modus operandi in this case is clearly Russian," and later said it was impossible to say definitively that Russia was responsible. Jacek Dobrzyński, spokesman for the minister coordinating the security services, said "everything points to arson." Justice Minister Waldemar Żurek said the fire could be an act of sabotage.

Prosecutors, the Internal Security Agency and the Central Bureau of Police Investigation inspected the site and questioned witnesses on 24 September. The National Prosecutor's Office opened a formal investigation on 25 September under Article 130, paragraph 7, of the Polish Criminal Code, which covers sabotage on behalf of foreign intelligence, and Article 163, which covers causing a public danger by fire. Prosecutors said they suspect the perpetrators acted on the instructions of Russian special services, with the aim of disrupting Starlink communications in Poland and across Central and Eastern Europe. The Radom branches of the Internal Security Agency and the police bureau are handling the case. No one has been charged.

Rail sabotage in the Netherlands

Metal pipes were fastened to railway tracks at more than 35 locations in several Dutch provinces early on 15 September, including Deventer, Veenendaal, Brummen, Barneveld, Twello, Lunteren and Putten. The pipes tripped the signalling system into showing red and halted trains across much of the country. A train hit pipes near Steenwijk in Overijssel. No injuries were reported. Another pipe was found on the line between Apeldoorn and Deventer near Teuge that evening.

Mirjam van Velthuizen, chief executive of the rail infrastructure manager ProRail, said: "There is some camera footage, but unfortunately very little from the specific locations."

The Dutch National Police are leading the investigation with support from the General Intelligence and Security Service. Justice Minister David van Weel said those responsible would be caught. Investigators are examining radical farmers' protest groups, which had discussed direct action for Prinsjesdag, the opening of the parliamentary year, which fell on the same day. Hay bales, tyres and pallets were set alight beside the A2 and A28 motorways that morning, and police arrested seven people near Breukelen over motorway disruption. The Farmers Defence Force and the farming organisation LTO Nederland both distanced themselves from the actions. No arrests have been made over the rail sabotage and no group has claimed it.

Dutch authorities have not attributed the attack to Russia. Bart Schuurman, a terrorism researcher at Leiden University, said a state actor was one possibility among several, including domestic extremists. Deliberately endangering rail traffic carries a maximum sentence of 15 years in the Netherlands.

A train derailment in France reported on 12 September is being investigated as suspected sabotage. French authorities have not published an injury toll or an attribution.

A deleted column on Lithuania

RIA Novosti, Russia's state news agency, published a column at 10:30 on 25 September headlined "Russia Is In for Another SVO. It Will Be Very Short," using the abbreviation for what Russia calls its "special military operation" in Ukraine. The column was deleted within hours.

Alexander Nosovich, the author, is a freelance contributor to the agency, affiliated with the Council on Foreign and Defence Policy in Moscow and editor of the website RuBaltic.Ru. Dossier, a London-based investigative group funded by Mikhail Khodorkovsky, has previously documented links between Nosovich and Russian state security agencies.

Nosovich wrote that Lithuania was "a suicidal country with no brains whatsoever." He wrote that Russia could strike it with missiles carrying the appropriate warhead rather than send ground troops, a reference to nuclear weapons.

RIA Novosti said the column "does not correspond to the editorial board's views," editorial policy or Russian state policy.

Lithuania's parliament voted 99 to 13, with five abstentions, on 22 September to advance a constitutional amendment removing the ban in Article 137 on stationing weapons of mass destruction and foreign military bases on Lithuanian territory. The vote was a first reading and does not authorise any deployment.

Laurynas Kasčiūnas of the Homeland Union said during the debate: "We are the only country in the region that has this restriction." Opposition leader Remigijus Žemaitaitis said the change should go to a referendum.

Dmitry Medvedev, the former president and deputy chair of Russia's Security Council, has repeatedly threatened NATO states with nuclear weapons since 2022.

Southern Europe and the Gerbera

El Mundo reported on 23 September that U.S. intelligence had warned several European governments of a possible Russian operation to launch Gerbera drones, hidden in shipping containers on merchant vessels, at targets in Spain, France or Italy. The report traced the alert to CIA Director John Ratcliffe's visit to Moscow in August.

Unnamed sources in Lithuania's Ministry of National Defence supplied the specific details in the report. The CIA has not publicly confirmed that any such warning exists, no U.S. official has spoken about it on the record and Spain's government has not commented.

Macron said in a televised interview on 24 September: "The CIA did not inform French services of such an attack." He said Russia was "multiplying hostile and sometimes criminal acts" against European countries and that France could be a target.

Italian Defence Minister Guido Crosetto said the alarm raised by the report was "completely unsubstantiated." He said that with tensions already high, governments should not add "more fuel to the fire."

Spanish television, Belarusian opposition websites and automated news aggregators repeated the claim within hours without adding a new source, and one aggregator labelled it a confirmed event.

Russia's Gerbera is about two metres long and weighs 18 kilograms, with a range of up to 600 kilometres, a speed of about 160 kilometres an hour and a warhead of four to five kilograms. Russia has flown it over Ukraine chiefly as a decoy to exhaust air defences.

A Swedish naval unit detected a drone taking off from a Russian intelligence vessel in the Öresund Strait in February 2026.

Ratcliffe flew to Moscow unannounced on a U.S. military aircraft on 25 August, the day the trip became public. Unnamed sources cited in U.S. television reports said he warned Russian intelligence officials against attacking NATO members and raised Iran, warning of further sanctions if the Strait of Hormuz did not reopen to shipping.

Trump confirmed the trip in a radio interview and said it was "semi-routine." The CIA declined to comment. Dmitry Peskov, Putin's press secretary, said Ratcliffe did not meet Putin, and said of reports of Russian attack plans: "A lot of such scare stories are being published right now."

Keir Giles, a Russia specialist at Chatham House, said Russia would look for "the weakest point in Europe," naming Spain as a country without integrated air defences suited to the threat.

NATO Secretary General Mark Rutte, asked about the report, said the Russian threat to NATO territory was real and long-term. "Let us not fall into Putin's trap," he said. He said Russian President Vladimir Putin wanted to sow panic. Rutte said earlier this year that a Russian missile would take about 10 minutes longer to reach Madrid than to reach Warsaw.

France and the Nordic states

Macron called the leaders of France's political parties, several of them 2027 presidential candidates, to the Elysée Palace on 18 September, the day after Tusk's speech, to brief them on intelligence assessments. He ordered the government to prepare the infrastructure protection plan at the same meeting.

Macron said: "The Russian hybrid threat against Europeans and against France has intensified." He called Tusk's warnings sound and well documented.

Guillaume Lacroix, leader of the Radical Party of the Left, told reporters as he left: "I have rarely felt such vertigo."

Finnish President Alexander Stubb told Finns to prepare mentally for sabotage and drone incidents. At the UN General Assembly the following week he urged leaders to avoid alarmist language, which he said served Russian aims.

Norwegian Prime Minister Jonas Gahr Støre told a Canadian television interviewer on 21 September that the Russian threat to countries bordering Russia, including Canada across the Arctic, was real.

Germany is preparing hospitals for mass-casualty scenarios, Lithuania has updated civilian evacuation plans and German troops have exercised with Swedish forces on Gotland.

The case against imminence

Tarmo Miilits, secretary general of Estonia's Ministry of the Interior, wrote on 24 September that nothing on Russia's side of the border confirmed claims of a planned attack on a NATO country.

Miilits wrote: "Russia currently has no intention of militarily attacking any NATO member state." He dismissed think-tank attack scenarios as detached from the threat assessments that regional intelligence agencies share, while acknowledging Russian sabotage and the Leipzig attack.

Estonia's foreign intelligence service said in February 2026 that Russia had no intention of attacking Estonia or NATO that year.

Rutte told reporters on 24 September that NATO had the means to deal with the sabotage and drone incidents. "All the response options are there, and we will use whatever we need," he said. "Putin is in a bad place. He is not winning the war in Ukraine."

Matthew Whitaker, the U.S. ambassador to NATO, said the number of incidents did not suggest a war was imminent and that allies had to be "very careful" about "overreacting to any sort of hybrid activity."

Senior European security officials, speaking anonymously, said there was "no new intelligence to suggest a Russian attack is coming." A NATO official said the alliance saw no imminent threat of attack but could not be naive or complacent.

Justin Bronk, senior research fellow for airpower at the Royal United Services Institute, said public intelligence briefings showed Russia was planning some form of aggression but had not necessarily decided to act. He said any Russian move would be designed to be "small enough that it still definitively violates NATO territory" while making a military response politically difficult.

Russia's denial

Putin has denied any plan to attack NATO. He told a meeting in Moscow on 18 September that "NATO is swelling up and expanding," and said European leaders were using accusations of Russian aggression to shore up falling ratings and cover their own mistakes.

Putin made the same denials before February 2022, when Russian troops massed on Ukraine's borders while Russian officials said no invasion was planned. He justified the invasion by falsely claiming that NATO was preparing Ukraine as a base to attack Russia.

Mikhail Zygar, a Russian journalist, concluded in his 2023 book War and Punishment that Putin and a small circle of security hardliners took the decision to invade while shutting out the wider Russian establishment. Putin's circle expected Ukraine to capitulate quickly.

U.S. officials estimated in February 2022 that Russia had massed up to 190,000 troops in and around Ukraine. Miilits wrote that nothing comparable was under way on Russia's side of the Estonian border.

Russia's losses and Putin's appetite for risk

Air Chief Marshal Sir Richard Knighton, the British chief of the defence staff, has said more than half a million Russian soldiers have died in Ukraine. Western and Ukrainian estimates of combined Russian dead and wounded are above one million. The figures cannot be independently verified.

Air Chief Marshal Sir John Stringer, NATO's deputy supreme allied commander for Europe, said on 22 September that Putin had become "increasingly cavalier, dangerous and risk accepting." Estonian Prime Minister Kristen Michal said Putin was like a "rat in the corner" who might escalate against Europe to break Western support for Ukraine.

Politics inside the alliance

Germany's far-right Alternative for Germany made further gains in state elections on 20 September, and support for Chancellor Friedrich Merz's Christian Democrats fell. Merz has said he will stay in office after the Social Democrats agreed to remain in coalition. The AfD wants Germany to buy more Russian oil and gas ahead of the winter.

Marine Le Pen, leader of France's National Rally, suggested this week that France could cut financial aid to Ukraine.

Spanish Prime Minister Pedro Sánchez has refused to raise defence spending to the new NATO target and declined to attend Trump's reception at the UN General Assembly in New York.

What Article 5 covers

Article 5 of the North Atlantic Treaty commits members to treat "an armed attack against one or more of them in Europe or North America" as an attack against all, and to take the action each deems necessary, including armed force. The alliance has invoked it once, on 12 September 2001, after the attacks on the U.S.

Article 4 allows any member to call consultations when its territorial integrity or security is threatened. Turkey invoked it in 2012 after Syrian shelling killed Turkish civilians. Poland and Estonia invoked it in September 2025 after Russian drones and fighter jets entered their airspace.

NATO leaders agreed at their 2018 summit in Brussels that a hybrid campaign could lead the North Atlantic Council to invoke Article 5. No member has tested that commitment.

Britain did not seek Article 5 after Russian military intelligence officers poisoned former spy Sergei Skripal and his daughter Yulia with the nerve agent Novichok in Salisbury in March 2018. Dawn Sturgess, a local woman, died after later exposure to the same nerve agent.

Latvian President Edgars Rinkēvičs said: "The real trouble starts when you have to define when Article 5 starts." He said hybrid attacks could trigger Article 5 and that he believed the U.S. and other allies would come to Latvia's defence.

Canada leads NATO's Multinational Brigade Latvia and has committed to station up to 2,200 troops in the country.

Trump has threatened to withdraw from NATO and recommitted to Article 5 at the alliance's summit in Ankara in July.

Applicable law

Article 6 of the North Atlantic Treaty extends Article 5 to attacks on members' territory in Europe and North America and on their forces, vessels and aircraft in the North Atlantic area and the Mediterranean. A drone launched from a merchant ship at a Spanish, French or Italian target would fall inside that area. A strike on a supply hub inside Ukraine would not, even if the goods belonged to a NATO member.

Article 2, paragraph 4, of the UN Charter prohibits the threat or use of force against the territorial integrity of any state. A Russian drone or missile strike on NATO territory, framed as an accident or not, would engage that prohibition and give the target state a right of self-defence under Article 51 of the Charter.

The Leipzig attack falls under the 1988 Protocol to the Montreal Convention, which criminalises violence at airports serving international civil aviation and obliges states to prosecute or extradite suspects.

Aggression is a crime under Article 8 bis of the Rome Statute of the International Criminal Court. Article 15 bis bars the court from exercising jurisdiction over aggression committed by nationals of states that are not parties to the statute unless the UN Security Council refers the situation. Russia withdrew its signature from the statute in 2016 and holds a Security Council veto, which leaves Russian leaders beyond the court's reach for aggression against NATO states. The U.S. is also outside the statute.

Europe's readiness gap

The European Defence Agency's first annual Defence Readiness Report, which became public on 24 September, found that EU members' current plans do not appear on course to close gaps in air and missile defence, ground combat, naval forces, munitions stockpiles and drones by the bloc's 2030 target.

European Defence Agency analysts wrote: "What has been achieved so far, although unprecedented, is not yet enough." It said Europe needed "a decisive change in the scale and pace of defence investment, capability development and industrial capacity."

EU defence spending reached 418 billion EUR in 2025, up 20 per cent on 2024, and is projected at 454 billion EUR in 2026, about 2.4 per cent of the bloc's GDP, according to the report.

Council of Europe Secretary General Alain Berset has said Europe is poorly prepared for hybrid warfare, including cyber attacks and attacks on energy systems and critical infrastructure.

The Lukoil sale

U.S. businessman Todd Boehly has assembled a consortium backed by the U.S. government and Gulf investors with ties to the Trump family to bid for the international assets of Lukoil, Russia's second-largest oil company, the Financial Times reported this week. The consortium includes Boehly's Xtellus venture and the UAE-based Allied Investment Partners.

The U.S. Treasury sanctioned Lukoil in October 2025. The Carlyle Group signed a conditional agreement to buy the overseas assets in January 2026, subject to approval by the Treasury's Office of Foreign Assets Control, and that deal has not been approved. Treasury rejected an earlier Xtellus proposal in late 2025.

Lukoil valued the assets at 20 billion USD when it wrote them off in March. They include oil and gas fields from Central Asia to Mexico, thousands of petrol stations and refineries in Bulgaria and Romania.

What readers can do

The EU adopted a sanctions regime on 8 October 2024 that allows the Council of the EU to list individuals and entities responsible for Russian destabilising activities, including sabotage, cyber attacks and information manipulation. The EU imposed sanctions this week on Fedorova, a former executive at the Russian state broadcaster RT. Citizens in EU states can ask their foreign ministries to propose listings of the officers and intermediaries behind the Leipzig attack and the wider European sabotage campaign.

Canada's Special Economic Measures Act allows the federal government to sanction individuals linked to grave breaches of international peace and security. Canadians can write to Global Affairs Canada and their MPs asking that listings mirror the EU's hybrid-threats designations.

EU defence ministers meet in Brussels on 28 September under Kaja Kallas, the bloc's foreign policy chief, with air defence ammunition for Ukraine, coordinated procurement, hybrid threats and Russia's shadow fleet on the agenda. The European Defence Agency's steering board meets alongside them.

Lithuania's parliament holds the first of two final votes on removing its constitutional ban on nuclear weapons and foreign bases on 6 October, with the second set for 12 January 2027. Each needs at least 94 of the Seimas's 141 votes to pass.