Summary, 28 October 2026 · Eastern flank

The written assessment: today's news first, then key developments, where sources disagree and the outlook for the next 30 days.

Produced 28 October 2026, 19:16 UTC

Watchcon

Yellow · Significant concern

Moderate confidence · Trend: Steady

Sabotage cases and drone strikes on merchant ships in the Black Sea keep pressure high. Conventional posture reads level 1 and no Russian or Belarusian unit build-up appears in the record, so the watch condition is held at the Yellow level.

Key developments

Polish police arrested a Ukrainian, Artem S., in Warsaw on a Romanian European Arrest Warrant. Romania's SRI says a Russia-coordinated network set the September Carfil fire in Brașov, with two Belarusians held in Germany. The sabotage network now spans Romania, Poland and Germany. rmf24.pl
Bulgaria's prime minister said suspects in the 9 Oct arson on Starlink antennas were identified within hours and later arrested in Germany. It is unclear whether they are the Carfil suspects, so a link between the two sabotage cases is not yet shown. x.com
France deployed an Atlantique 2 maritime patrol aircraft to Romania's Mihail Kogălniceanu base for western Black Sea surveillance from 18 Oct to 6 Nov. It adds allied surveillance over the waters where merchant ships are being hit. radioconstanta.ro
A Swedish Visby corvette was tracked about three miles from the Kaliningrad border, though the AIS track may be falsified. It shows allied naval presence near the exclave, unconfirmed. x.com
A Russian military satellite passed within about 200 metres of a Finnish radar satellite that feeds imagery to Ukraine, and three others from the same launch were tracked toward it. It is a close approach in space, with no damage reported. x.com

Where sources disagree

Denmark says the Finnish and Norwegian leaders' call with Putin was not coordinated with allies. Norway insists allies were informed in advance.

Outlook

More Black Sea merchant ship strikes are highly likely. Watch for another strike off Romania or Bulgaria; a repeat would hold the Black Sea flank's hybrid peak at level 4, while weeks without one would ease it.
More sabotage cases against defence sites are likely in allied states. Watch for new arrests or arson at defence or communications sites in Poland, Romania, Bulgaria or Germany; more cases would keep the sabotage reading at level 3 and rising.
More Polish air-threat alerts are almost certainly coming. Watch whether an alert is followed by a confirmed drone landing on Polish soil; that would raise the odds of a deniable strike on the flank.
Another drone incident in Lithuanian airspace has a roughly even chance. Watch for red alerts or airport closures in Lithuania; a repeat would lift the Baltic air and missile reading above level 1.

Collection gaps

None filed in this summary.

In short

Drone strike hits a container ship off Bulgaria. Bulgaria's defence minister confirmed a drone attack on the container ship Contship Jet in Bulgaria's exclusive economic zone on 28 Oct. One report says all 18 crew were rescued. x.com
Poland arrests a Ukrainian over a Romanian arms plant fire. Police detained Artem S. in Warsaw on a European Arrest Warrant. Romania's SRI says a Russia-coordinated network set the Carfil fire in Brașov, and two Belarusians are held in Germany. rmf24.pl
Poland raises air-defence readiness over the Lublin region. Poland's RCB alert warned of a Russian air attack on Ukraine and named nine Lublin counties. A later alert said the attack had ended and there was no threat on Polish territory. x.com
Bulgaria says Starlink arson suspects were caught in Germany. The prime minister said suspects in the 9 Oct arson on Starlink antennas were identified within hours. It is unclear whether they are the same people held over the Romanian plant case. x.com

Analysis

Black Sea: the Contship Jet was reportedly hit by three maritime drones, and more than 20 containers with hazardous cargo fell into the sea while the ship drifted south. A tracker counts nine merchant ships hit since 5 Oct. The listed reports do not say who attacked. Turkey, Bulgaria and Romania condemned the attacks in Sofia, and Turkey's minister warned both Russia and Ukraine to stop hitting civilian vessels.

Sabotage: Romania's SRI says a Russia-coordinated network was behind the Carfil fire, and Polish officers detained a Ukrainian suspect in Warsaw. Two Belarusians are held in Germany, which is also investigating them over plans against targets in Nuremberg. A Romanian TV report says the network had more targets, so the plots reach beyond one plant.

Poland: an RCB alert sent to nine Lublin counties said readiness of the air defence system was raised during a Russian air attack on Ukraine. The follow-up alert said no threat existed on Polish territory. One report says such alerts have returned almost daily for Subcarpathia and the Lublin region.

Kaliningrad and the north: a Swedish Visby corvette was tracked about three miles from the Kaliningrad border, though the AIS track may be falsified. Germany's Lithuania brigade is to use electronic warfare to watch Kaliningrad and Belarus. A Russian satellite came within about 200 metres of a Finnish radar satellite, with no damage reported.