Summary, 4 November 2026 · Eastern flank

The written assessment: today's news first, then key developments, where sources disagree and the outlook for the next 30 days.

Produced 4 November 2026, 19:44 UTC

Watchcon

Yellow · Significant concern

Moderate confidence · Trend: Rising

Hybrid acts continue on several sectors: ship strikes in the Black Sea, drone incursions into Latvia, Romania and Moldova, and Starlink arson arrests tied to Poland. None is an armed attack on allied territory in the listed reports, and conventional readings sit at level 1, so the Yellow level holds.

Key developments

A Romanian presidential adviser says at least eight vessels were hit, damaged or sunk near the Romanian and Bulgarian coasts on 5 to 28 Oct, and that Romania is already a target of Russian hybrid war. This keeps the Black Sea shipping campaign at the top of the board's hybrid readings. digi24.ro
Romania sent an RO-ALERT extreme alert to northern Tulcea county on 4 Nov over a possible drone incursion, telling people to shelter. The alert shows the Black Sea probe pattern still running; the report does not say a drone entered. radioconstanta.ro
A drone crossed Moldovan airspace at 04:23 on 4 Nov from Odesa region toward Camenca and left two minutes later near Vărăncău. Another violation extends the run of Moldovan incursions. moldpres.md
German police arrested a Turkish national on 3 Nov on suspicion of ordering the 23 Sept arson at the Starlink station in Wola Krobowska, Poland. It ties the Polish sabotage case to a network in Germany. x.com
Polish police, Border Guard and GROM are running a preventive anti-terror operation on the border after signals that saboteurs, mainly from Kaliningrad Oblast, may try to infiltrate. It shows Poland treating the sabotage risk as live in the border area. wiadomosci.wp.pl
Sweden's Security Service warned on 4 Nov that the risk of Russian sabotage against Swedish defence firms supplying Ukraine has risen significantly, and that Russia has been mapping sensitive sites. It widens the sabotage warning to the High North. x.com
Lithuania's State Security Department expelled three Ukrainians for paid tasks for hostile foreign intelligence services, passed through messaging apps, and banned them for five years. It shows recruitment of cheap agents inside a Baltic state. lrt.lt

Where sources disagree

Responsibility for the refrigeration attacks is contested: pro-Russian groups claim them, while one report says Reuters and investigators have not established responsibility and another says no one has claimed.
The Polish border incident is described differently: Russian commentators say Warsaw is massing troops and training GROM to cross into Kaliningrad, while Poland's Border Guard says the only new incident was people with flashlights near the border.
Reports give different counts of countries hit by the refrigeration attacks: eight, at least 10 and almost a dozen.

Outlook

Further drone alerts and airspace violations in Moldova and Romania are almost certain. Watch for a new RO-ALERT for Tulcea or another Moldovan violation; a drone that lands or explodes on allied soil would raise the Black Sea probe reading.
Further drone incursions into Latvian airspace are likely. Watch for a third incursion after those on 1 and 3 Nov, or another orange alert in Krāslava and Ludza; a confirmed Russian origin would raise the Baltic air reading.
Further sabotage cases tied to Poland are likely. Watch the border operation and the days around 11 Nov for new arrests or arson; a series across several states would lift the sabotage reading.
The refrigeration cyber wave will likely spread to more countries. Watch for new hits in Baltic or Nordic states or an attack on water or power systems, which the claiming groups threaten; that would lift the High North cyber reading.

Collection gaps

None filed in this summary.

In short

Romania sent an extreme drone alert to northern Tulcea on 4 Nov. The RO-ALERT told people to hide in cellars or shelters over a possible drone incursion. The report does not say a drone entered Romanian airspace. radioconstanta.ro
A drone crossed Moldova's airspace at 04:23 on 4 Nov. It came from Odesa region toward Camenca and left two minutes later near Vărăncău, heading for Vinnytsia region. The Defence Ministry says it came amid massive Russian attacks on Ukraine. moldpres.md
Finland confirms a cyberattack behind its freezer outages. Its cybersecurity centre says fewer than ten cases are known. Two pro-Russian groups claim a Europe-wide campaign, which is not independently confirmed. is.fi
Poland is running an anti-terror operation on its border. Police, Border Guard and GROM acted after signals that saboteurs, mainly from Kaliningrad Oblast, may try to infiltrate. An analyst says it may last days and repeat. wiadomosci.wp.pl

Analysis

Cyber: The freezer attacks are now confirmed in Finland and claimed by pro-Russian groups across several countries. Investigators have not established responsibility, and one report says they have not. France's blood service says hackers raised temperatures at three contractor-run cold stores, but alarms let technicians act before the products were compromised. Lithuanian retailers say their five largest chains were unaffected.

Sabotage and intelligence: Sweden's Security Service says the risk of Russian sabotage against defence firms arming Ukraine has risen significantly and that Russia has been mapping sensitive sites. Lithuania expelled three Ukrainians accused of paid tasks for hostile intelligence services, passed through messaging apps.