Summary, 1 October 2026 · Eastern flank

The written assessment: today's news first, then key developments, where sources disagree and the outlook for the next 30 days.

Produced 1 October 2026, 22:16 UTC

Watchcon

Yellow · Significant concern

Moderate confidence · Trend: Rising

Hybrid activity runs above the standing tempo with effects on allied territory, such as sabotage in Poland and the arson in Tallinn. No armed attack or conventional build-up is observed. The watch condition stays at the Yellow level.

Bottom line up front

Yellow level held; conventional attack on allied territory is highly unlikely. Daily flank events rose from 3 on 18 Sept to 19 on 30 Sept, led by Moldova drone incursions and Baltic sabotage, then fell to 9 on 1 Oct.
Drone incursions into Moldova will almost certainly continue. Moldova logged 12 air probe events on 5 days; the last 7 days 10, the 7 before 2, and a Geran-type drone exploded in Orhei district.
Sabotage and espionage in the Baltic states will likely keep recurring. Baltic states logged 8 sabotage events on 5 days; last 7 days 7, the 7 before 1, including Estonia's attribution of the August Tallinn arson to Russian services.
Russian nuclear warnings over Kaliningrad are likely to continue. Kaliningrad logged 3 nuclear signaling events on 29 Sept, none in the 7 before; a Russian warning cited nuclear arms if NATO isolated the exclave.

Key developments

Moldova summoned Russia's ambassador after three drones entered its airspace in one day, two of which fell and exploded. Authorities said the airspace was breached eight times in the past week. Moldova's probe reading is among the board's highest. moldpres.md
A Geran-type drone exploded near the Ivancea and Brănești route in Orhei district overnight on 30 September to 1 October, leaving craters and no casualties. Police found fragments marked Geran-4. It shows drone debris now detonating on Moldovan ground. digi24.ro
Latvia said it detained two citizens in June on suspicion of spying for Russia's GRU, including aerial photos of the Ādaži base. Investigators suspect support for possible sabotage groups. It adds an espionage case to the Baltic sabotage pattern. eng.lsm.lv
Russian border guards detained the Cyprus-flagged cargo ship Västerbotten in Russian waters in the Gulf of Finland, bound for Sillamäe in Estonia. Estonia confirmed it, and the ship later continued. It bears on shadow-fleet tension in the sector. news.err.ee
Putin said Russia would use every weapon, including nuclear arms, if Kaliningrad came under direct Western attack or blockade. This is a warning, not an act, but it fits the board's raised lawfare indicator on a Kaliningrad blockade line. bbc.co.uk
Sweden's HMS Helsingborg began a Finnish-led patrol in the Gulf of Finland, the first time a Swedish warship has served under Finnish command. It follows repeated drone incidents and airspace violations reported by Finland. svt.se
Danish Defence Command said soldiers fired nine rounds on 25 September at a suspected drone near the Borris training site. No link between a searched vehicle and the drones was established. It adds a drone sighting at a site in Denmark. x.com

Where sources disagree

None filed in this summary.

Outlook

Further Romanian alerts and allied scrambles on the Black Sea flank are likely. Watch for a confirmed airspace intrusion near Isaccea or Izmail; it would raise the Black Sea sector's hybrid reading above its current elevated level.
Sabotage against Baltic defence-industry firms is likely within 30 days. Watch for arson or foiled attacks on firms supplying Ukraine after the Milrem case; a second such case would firm the standing hybrid campaign as the leading scenario.
Another Russian detention of a ship bound for Estonia is roughly even chance. Watch for further stops of vessels heading to Estonian ports after the Västerbotten; repeated detentions would raise the shadow fleet reading in the High North sector.

Collection gaps

None filed in this summary.

In short

Moldova summoned Russia's ambassador over drone incursions. Three drones entered its airspace in one day and two exploded. A Geran-type drone left craters near Brănești in Orhei district, with no casualties. moldpres.md
Latvia announced two arrests for spying for Russia's GRU. The pair were detained in June. One photographed the Ādaži base from a private aircraft, and investigators suspect support for sabotage groups. eng.lsm.lv
Russia detained a cargo ship bound for Estonia. Border guards held the Västerbotten in Russian waters in the Gulf of Finland. It was later released and reached Sillamäe. news.err.ee
Putin warned of nuclear use to defend Kaliningrad. He said Russia would use every weapon if the exclave faced direct attack or blockade. It is a warning, not an act. bbc.co.uk

Analysis

Moldova carried the day's hardest evidence. Drones fell and exploded on its territory, police found Geran-4 fragments, and the airspace was breached eight times in a week. Moldova is not an ally, but the drones come from the same strikes on Ukraine that set off alerts in Poland and Romania.

Kaliningrad produced words rather than acts. Putin and Russian embassies warned of nuclear use, and NATO and Lithuania rejected the threat. The board reads no ground-force build-up, so the watch condition stays at the Yellow level.