Incident Reports
Short, tactical breakdowns of single incidents across the TESSOC spectrum - Terrorism, Espionage, Sabotage, Subversion, Organised Crime - as well as Cyber, and aspects of Armed Conflict and potential spillover.
Each report sets out the known facts on a 5WH spine, maps the sequence, weighs the impact, and aims to draw out any lessons or recommendations for decision makers.
Filter by date, region, TESSOC category, shaping activity or actor. Browse the full list below, or switch to the map to see where each incident happened and select from there. Alternatively, select the time view in order to understand patterns and trends of types of incidents over time.
Drag to pan, scroll or pinch to zoom. Coastlines, lakes and borders: Natural Earth 1:110m, public domain.
46 of 112 plotted events appear here. Only those are shown because only those have a time of day stated in the reporting. The remaining 66 have a date but no hour, and are deliberately absent rather than estimated. A report covering more than one incident contributes one point per incident, so this count runs ahead of the number of reports.
Category (fill)
TerrorismEspionageSabotageSubversionOrganised CrimeCyberArmed ConflictAssessed responsible (ring)
RussiaIranDaeshTTPBelarusCriminal groupHouthi (Ansar Allah)North KoreaUnattributedNo attribution madeMarker meaning
Dashed ring: attribution asserted but not establishedDotted outer ring: the stated time is approximateArc: ran over a period, not a momentHover or focus a marker to read the incident.
Ocana: a plot on the president, undone by social media
Colombian police captured a man they describe as a designated sniper of the ELN's Camilo Torres Restrepo front, on warrants for aggravated homicide and firearms offences. Police and President de la Espriella say he was tasked to help plan and carry out an armed action against the president. Investigators fixed his location from videos his partner was posting on social media. No operational detail of the plot has been published.
Read →Romania: seven months of photographs, and no attack to show for it
The Romanian Intelligence Service says it disrupted a sabotage operation coordinated by the Russian Federation. A Russian citizen resident in Romania is alleged to have spent February to July photographing NATO-allied military bases, communications centres, defence headquarters, critical infrastructure and Ukrainian Antonov cargo aircraft on Romanian soil. He is charged with attempted acts of sabotage and held for thirty days.
Read →Budapest: ten expelled, and Moscow loses its easiest EU posting
Hungary ordered ten members of the Russian mission out of the country, saying they had been engaged in activities unacceptable for diplomats under the Vienna Convention. No specifics were published and nobody was named. Hungary was one of the few EU states that did not expel Russian diplomats after the 2022 invasion. Moscow has promised a harsh and painful response.
Read →Moldova: NATO airspace breached, two jets up, nothing stopped
A Russian long-range attack drone crossed Moldova and entered Romanian - NATO - airspace south-east of Iasi, was tracked across five counties, and was not intercepted by the two Spanish F-18s launched against it. Moldova closed its airspace and the aircraft carrying President Zelenskyy took off late. The near-miss claim came from Norway; the crash site was about 160 km from the airport.
Read →Munich: firebombs at a defence firm, arrests on a witness call
Incendiary devices were thrown from a moving car at a construction site at the Rohde & Schwarz headquarters around midnight. One ignited and was put out by the first officers to arrive; at least one failed and was made safe by explosives specialists. Two Bulgarian nationals were detained at a petrol station within minutes. The attack was seen, reported and stopped by a member of the public.
Read →Los Patios: a car bomb blamed on the ELN, which has not claimed it
A car packed with explosives was left outside a police station in the Cucuta metropolitan area and detonated by remote control at a quarter past eleven at night. A young man passing on a motorcycle was killed and eleven were wounded, two of them officers. The vehicle was a grey car stolen in 2024 and dressed up to look like a yellow taxi. The police have named the ELN; the ELN has claimed nothing.
Read →Poland: Lublin and Skarzysko - two drone plants, two fires, one likely hostile entity
A masked man went over the fence at a WB Group plant at Skarzysko-Kamienna and set a store alight with an incendiary charge; prosecutors opened it under the article covering assistance to a foreign intelligence service. Thirty hours earlier a hall at JFG Composites in Lublin burned to the ground, and that fire has no established cause. Officials say there is no basis for joining them. Lublin province has taken a stray missile, drones, rail sabotage and now this since 2022.
Read →Augsburg: blast injures two, false alarm shuts the line
An object detonated at about 03:15 in the passageway of a building opposite Augsburg Hauptbahnhof, hurting two Ukrainian teenagers who were passing. Five hours later a second object inside the station shut a main line hub for ninety minutes; it was harmless. The grenade, the jeweller and the organised-crime line all come from one newspaper, and police have confirmed none of them.
Read →Turnow-Preilack: a substation hit, and no agreement on what with
A double-digit number of improvised devices were found at a Brandenburg substation, with conductive material laid into high-voltage lines in two places and a fireball at about half past seven. One 500-megawatt block shut itself down and the grid held. The operator called the devices modified fireworks, the interior minister called them purpose-built rockets, and the police said they were not rockets at all.
Read →Estonia and Romania: drone spillover on two flanks in one night
About a dozen drones appeared near Estonia's border at two in the morning while Ukraine struck a Russian Baltic port next door. One turned toward Narva and went back; another crossed into the south-east. Turkish F-16s launched and eight counties got a phone warning. Hours later a resident found a drone carrying explosives in a Romanian field. Four countries responded to a war none of them is in.
Read →Mirage Kitten: a fake coding test that told you not to use AI
A recruiter offers a developer a role at a well-known technology company, then sends a timed technical assessment. The project runs, and one of its dependencies installs a remote access tool that works on Windows, Linux and macOS. The instructions tell the candidate not to use AI assistants - and the researchers note that an AI review would have found the malicious package.
Read →Philippines: nuclear records taken through a flaw fixed three years ago
Researchers found an attacker's own server open on the internet and read what was on it - the tools and the loot from intrusions at a nuclear research body and a firm that builds for the Philippine Navy. Reactor components, fuel inventories, radiation safety reports, staff passports and the credential stores. The way in was an authentication flaw published in 2023, in a default configuration.
Read →Niamey: Russia put down a mutiny at the base where it is headquartered
Russia's Africa Corps helped crush an armed revolt inside Niger's own army, and Moscow's ambassador has said so publicly. Hundreds of soldiers attacked Base 101 at Niamey airport before dawn; Russian personnel gave ground and air support to the loyalists who retook it. Base 101 is where Africa Corps has its Niger headquarters. Algeria then sent four fighter jets, a transport and a tanker.
Read →GuardBreaker: malware written to make an AI refuse to read it
A Russia-aligned group put a sentence into the comments of a malicious script asking for help building a nuclear weapon. The code does nothing with it - it is there for the defender's AI to read, and to trip its safety mechanism so it stops before reaching the malicious part. The target is not the analyst but the tool the analyst is increasingly relying on.
Read →Presov: a drone-plant arson plot claimed by a self-styled peace group
Slovak police stopped three foreign nationals before they could set fire to a Ukrainian-owned drone factory. They seized petrol mixed with polystyrene, a camera and a hand-drawn plan of the plant, with about seventy people on site. The three are charged with acting on order, though nobody has said whose - and a previously unknown group calling itself Global Citizens Against War 1984 has claimed the plot as peace activism.
Read →HOOKEDGE: Russian espionage running on a free developer service
A six-month campaign against government, diplomatic and defence manufacturing bodies in Romania, Spain and Turkey, run with a backdoor written as a Windows batch script. No vulnerability was exploited - the victim had to enable macros. Commands, staging and exfiltration all ran through the free tier of a public developer service, with a hidden copy of Edge making the traffic look like ordinary browsing.
Read →The Burke Institute: a Russian influence operation run with ChatGPT
OpenAI has banned a cluster of accounts it assesses were run from Russia through VPNs, promoting an outfit calling itself the International Burke Institute - a Tel Aviv address, a roster including Fukuyama and Chomsky, and a sovereignty index that ranked Russia well. Of thirty-six articles sampled, thirty-four had been copied from elsewhere. The institute rejects the characterisation and its website remains online.
Read →Florida: a reported Iranian plot against Netanyahu's son
Israeli services learned in December 2025 that Iranian operatives were in the Miami area watching Yair Netanyahu's home and movements. They told the Americans and told him to leave; he went the same day without packing. His father confirmed on 24 August that Iran had tried to kill one of his sons; a single unnamed source named Yair two days later. There have been no arrests.
Read →QUICSilver: a graduation invitation aimed at Myanmar's cyber security department
A campaign against Myanmar government and IT bodies, naming the Information Technology and Cyber Security Department as a target. The lure was a graduation ceremony invitation in Burmese. The backdoor is basic; the effort went into a disk image disguised as a photograph and command traffic tunnelled through the protocol that carries ordinary web browsing.
Read →UAT-10147: a criminal crew running intrusions with an AI doing the paperwork
A Chinese-speaking criminal group compromising exposed web servers at scale, with a target list of around 170,000 addresses found on its own infrastructure. It blinds endpoint security by loading vulnerable signed drivers. The finding that matters is not the malware but the group's own AI-generated exploitation guide and live intrusion log.
Read →The login page was real: Russian clusters abusing authentication itself
Google has disclosed three suspected Russian espionage clusters that compromise accounts without exploiting anything - no vulnerability, no fake login page. The victim signs in on the genuine site and hands over the result, so multi-factor authentication is satisfied rather than defeated. The accounts targeted are usually personal, which means nobody's security team is watching them.
Read →Borgu: worshippers taken from a mosque, and the attackers were not who it first appeared
Armed men raided several villages in Niger State, then surrounded a mosque as Friday prayers ended and took the worshippers into the forest. Residents told Reuters more than sixty were seized. First reported as banditry for ransom; survivors then named Lakurawa, a jihadist group, and described a sectarian motive - a different actor and a different problem.
Read →Gulf of Aden: pirates took a sanctioned tanker running under sanctions
Six armed men boarded the product tanker Sibu 1 and turned her toward Somalia. She was the thirteenth vessel attacked in the region this year, against five in all of 2025, and the sixth hijacked since April. She is under US sanctions as part of Iran's shadow fleet - a trade that keeps a ship away from the authorities who would also protect her.
Read →Uto: a Russian spy plane crossed into Finland for three minutes
A Russian Il-20 signals intelligence aircraft is suspected of entering Finnish airspace south of Uto, penetrating about 8.7 kilometres before leaving. This was not a drone but a crewed aircraft of the Russian air force, which removes the deniability behind almost every other incursion on this flank and changes what a response would mean.
Read →Neptun Deep: a naval drone stopped short of Romania's gas platform
An explosives-laden naval drone was spotted a few hundred metres from the Neptun Deep gas project at 06:28 and destroyed by one of two F-16s. A commercial vessel saw it first. Neptun Deep employs hundreds of workers offshore and is meant to end Romanian dependence on Russian gas from 2027.
Read →Albany: a bomb in a food delivery bag, and five walks round the building
A 35-year-old is charged with plotting to bomb the New York State Capitol and kill state senators. She lived under two miles away and walked round the building five times, photographing it. The plan was to carry the device in a food delivery bag and pass as a courier at a public entrance.
Read →Irpin: a bomb under a car that failed, and an arrest in Warsaw
Poland's Internal Security Agency has arrested a Ukrainian man it says planted an explosive device beneath a car used by a figure in Ukraine's defence industry. It was built to be fired by mobile phone and failed because the mechanism did not work. The European campaign has moved from reconnaissance to a device actually placed.
Read →Williamtown: drones over Australia's F-35 base, and the blinds came down
Multiple drones entered restricted airspace over RAAF Base Williamtown across several nights in July, and again in early August. None was intercepted, identified or recovered. Personnel were reportedly told to close the window blinds, the matter went to the state police, and as of 20 August nobody has been arrested or charged.
Read →SilkParasite: government networks in five Central Asian states and Georgia
Bitdefender has published a campaign running against government bodies in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Kazakhstan and Georgia since late 2025. Seven families of remote access software, five newly named, lures impersonating specific ministries - and a macro that checks whether Kaspersky is running before it acts.
Read →CameraSwarm: 14,500 cameras taken over, most of them in Ukraine
Over thirty-five days one operator compromised more than fourteen thousand Dahua cameras, door intercoms and recorders, installed permanent backdoor accounts and sent the captured images out through Telegram. The firm that found it assesses, at moderate confidence, that the access was being built to hand to somebody else.
Read →Mabna: 322 universities robbed to order for the IRGC
Seventeen Iranians are charged with breaking into 144 American and 178 foreign universities, more than fifty companies, five US government agencies and two international organisations. Over 100,000 professors targeted, about 8,000 accounts taken, 31.5 terabytes of research removed - and the contractor sold the proceeds on at home.
Read →Cologne: GPS trackers in parcels, mapping a route for arson
Two parcels were posted from Cologne to Ukraine in March 2025 carrying GPS trackers hidden among car spare parts, reporting their position the whole way. Nothing burned - the packages were sent to learn the route so a later consignment could be built to ignite along it. A Stuttgart court convicted one man on 18 August 2026 and acquitted two; the sentence was already served in pre-trial detention.
Read →Galati: a Spanish jet shot down a drone that came in over Moldova
Romanian surveillance detected an aircraft entering national airspace at 04:44; seventeen minutes later a Spanish F-18 on NATO air policing destroyed it over farmland north of Galati. It is the fourth drone Romania has shot down this year - and it did not come from Ukraine. It came in over Moldova, which is not in NATO, fields no fighter aircraft and has no allied air policing arrangement.
Read →Tulcea: radar never saw the drone, a resident reported it
A drone crossed into Romania, flew to a wood five kilometres from the Ukrainian border, crashed and exploded. The defence ministry learned about it when a member of the public rang the emergency number - the aircraft was never on radar, because it was flying too low to be seen. The same day, NATO fighters tracked and destroyed a drone over Latvia.
Read →Operation Klonen: a supplier's bad update, thirty million euros, four days
A payment processor pushed a faulty software update, and the defect sat in the booking process German online banking customers relied on. Over four days a criminal network took about thirty million euros out through it. Nobody attacked the bank. Nearly three years later, four were arrested in Brazil and three charged in Spain and Bulgaria.
Read →Latvia: four fighter jets for one drone nobody could identify
A drone crossed into Latvia before dawn. Air raid sirens sounded across four municipalities, two Italian Eurofighters launched from Lithuania and two Turkish F-16s from Estonia, and one Italian jet destroyed it over forest and bog. It worked - and NATO could not say whether the aircraft was Russian or Ukrainian.
Read →Faizabad: a second Badakhshan official killed in three weeks
The mayor of Faizabad was killed by a bomb targeting his vehicle, reportedly planted near the municipal offices where he worked. The first killing was claimed by Daesh-Khorasan; this one has been claimed by the National Resistance Front - a different organisation with different aims, and a direct demonstration that pattern-based attribution fails where several actors share a target set.
Read →Warsaw: the first known Russian plot against an American on NATO soil
Polish services arrested a Russian national said to have been recruited by Russian intelligence to kill a Ukrainian-American in Warsaw. The prime minister calls it the first time anyone acting on Russian orders has been tasked to attack a US citizen on another NATO member's territory. Ten weeks earlier, a Russian artist critical of Putin was shot dead in a Polish town.
Read →Jewelbug: government mailboxes by day, fake crypto exchanges by night
Symantec has published the inside of a Chinese operation running two businesses from one control panel: stealing from government mailboxes across Asia and the Middle East, and running hundreds of fake cryptocurrency exchange sites aimed at Chinese speakers. One compromise of a shared webmail platform reached fifteen government tenants at once.
Read →Leipzig/Halle: a bomb on the apron and something on the approach
A drone carrying an explosive charge and a detonator was found metres from a Ukrainian Antonov An-124 at a major DHL and NATO freight hub. A robot made it safe. Meanwhile a freighter that had broken off its approach struck something in the air six kilometres out. Officially unattributed.
Read →Rome: a cut-out, and a hole in the wall
Two former Italian intelligence officers accused of running a GRU-tasked cell, paying serving insiders - four of six from the Defence Ministry's cyber sector - for allied air-defence secrets, passed by dead drop on microSD cards. Charged, not convicted. Two Russian attachés expelled.
Read →Exchange OWA: access that survives the rebuild
A Russian state group is exploiting an Exchange webmail zero-day (CVE-2026-42897) to plant a backdoor that steals OAuth tokens and rewrites mailbox permissions. Government and aerospace mail exposed - and the access outlives both a password reset and a server rebuild.
Read →The Great Yarmouth spy factory
Six Bulgarians ran surveillance for Russia across the UK and Europe for two and a half years, targeting journalists, exiles, an embassy and a US base. Police found 221 phones, 495 SIM cards, 11 drones and 75 identity documents in a former Norfolk guesthouse. All six convicted; none was a Russian officer.
Read →Synnovis: the supplier that stopped the blood
A criminal ransomware group encrypted an NHS pathology provider. Hospitals lost blood matching, fell back on O-negative and drained the national supply. Over 10,000 appointments and 1,710 operations cancelled, 170 patients harmed, and a death to which the attack contributed.
Read →Lakenheath: swarms over Suffolk
Small drones over four bases used by the US Air Force in England across several nights, with up to twenty reported at a time. British troops deployed, counter-drone systems used, F-15s launched - and more than a year on, no operator identified and no attribution made.
Read →Papperger: the executive as a target
US intelligence discovered a Russian plan to kill the chief executive of Rheinmetall, Europe's largest producer of artillery ammunition, and warned Berlin in time for German services to disrupt it. NATO later confirmed the threat. The campaign moved from property to people.
Read →The case that could not call China an enemy
A prosecution over alleged spying for China collapsed weeks before trial. The Official Secrets Act 1911 requires information useful to "an enemy", and the DPP said a senior official could not say China had been classed as one. Charges dropped; both men deny the allegations and no findings were made.
Read →Wimbledon: a presenter, and a flight to Geneva
A presenter for the Persian-language channel Iran International was stabbed outside his London home. His attackers were at Heathrow within hours. Two Romanian nationals were convicted and jailed; prosecutors said they acted as proxies for Iran, motivated by money. Iran denies any link.
Read →Baltic GNSS: harm without an incident
Satellite navigation interference persistent enough that Finnair suspended an international route for a month after two flights turned back. Estonian controllers logged 600+ pilot reports in April alone. An RAF aircraft carrying the UK Defence Secretary was affected. No single incident to investigate.
Read →Kabal: the gate held, the crowd did not
A suicide bomber was challenged by an officer at the gate of a Swat police station and detonated where he stood. He never got inside. Seventeen died anyway, ten of them civilians at a peace rally nearby. The TTP claimed the attack. The access control worked exactly as designed, and that is the uncomfortable part.
Read →Mechernich: six passes over the only Patriot workshop in Europe
Six drone overflights in seven hours above a Bundeswehr site that repairs Patriot air defence systems and sits on a bunker 130 metres down. Police watched one of them. It circled above them. Officially unattributed.
Read →North Carolina Ports: back to paper at the gate
A cyberattack took down the IT systems of all three North Carolina port facilities. Gates opened late, trucks were processed by hand, and the Coast Guard was called in. Nobody has said who did it, how they got in, or whether anything beyond the office network was touched.
Read →Kardam: the drone came from the friendly side
A drone crossed into Bulgaria from Romania at first light and detonated a kilometre from a Trans-Balkan pipeline compressor station. Neither country detected it. Bulgaria assesses it was a Ukrainian Maya decoy, with no evidence of deliberate action.
Read →Kuwait: a citizen built a drone to attack a national facility
Kuwait's State Security Service arrested a citizen it says was affiliated with Daesh before he could use a drone he had built himself against what the Interior Ministry calls a vital facility. He is said to have been trained in making both explosives and drones. The skills for a stand-off attack on a fixed site have reached a single individual.
Read →Surab: a car bomb went off while it was being built
A vehicle being packed with explosives detonated during preparation in Balochistan, killing eight of the men preparing it. The blast set off more explosives stored at the site, and those secondary detonations killed three civilians nearby. Pakistan's military says ten more were killed in the clearance operation that followed - and every figure in the account is its own.
Read →Hanover: staff could see the drone, the detection system could not
A drone flew around Hanover Airport for roughly two hours in the small hours, closing the runways repeatedly and hovering at one point directly over the apron. Airport workers and police patrols saw it; the federal counter-drone equipment installed to detect exactly this registered nothing. An internal police report says hybrid activity cannot be excluded.
Read →Ukraine: a fake recruiter, a fake interview, a poisoned VPN
Someone reads your CV on a job site, offers you a role, interviews you over video and sends a technical test that needs a network connection. The connection fails, so they helpfully offer their own software instead. Ukraine's national cyber team says the recruiters are Russian military intelligence, and the targets are system administrators.
Read →South Korea: a receiver in a hotel and an insider on the base
A man set up a radio receiver, an antenna and a laptop in a hotel a kilometre from a military airfield and, police say, listened to fighter pilots and air traffic control on several occasions from 2024. He told investigators it was a hobby. A second man is accused of paying an employee inside a United States command. Both are former Chinese military.
Read →Bab el-Mandeb: a cargo ship struck, then the rescue attacked
A small cargo ship carrying food to a Yemeni government-held port was hit by three ballistic missiles at the mouth of the Red Sea, setting her on fire. A fourth then struck the rescue, killing responders. Yemen's coastguard reports six dead in all - four seafarers and two rescue workers - and ten wounded. No official claim has been made.
Read →Leipzig 2024: the parcel that burned on the ground because the flight was late
Four parcels posted from Vilnius. One caught fire in a DHL sorting centre at Leipzig minutes before loading onto an aircraft bound for Britain, another burned near Birmingham and a third exploded in a truck in Poland. Germany's intelligence chief said only fortune kept it off the aeroplane. Investigators concluded it was a rehearsal for cargo flights to North America.
Read →A Polish heating plant was shut down through the phone network
Attackers reached the industrial controls of a plant heating 50,000 people by crossing a private mobile network shared between an electricity distributor and its carrier, starting at a wind farm and ending at a turbine. Poland's national cyber team says it is the first time this route has been seen used in a real attack, and that the flaw enabling it is common.
Read →Cauca: a highway bomb the day after the inauguration
A vehicle packed with explosives was left at a toll plaza on the Pan-American Highway and detonated. The man who parked it left by motorcycle. Two security guards were hurt and families living yards away were thrown from their beds, the morning after a new president was sworn in promising to end negotiation with armed groups.
Read →Kimsuky: North Korea takes its AI offline
A North Korean state hacking group has installed artificial intelligence software on its own servers so it can run the technology entirely offline, with no provider to log what it asks. The capability is early and unverified by anyone but the vendor who found it. The barrier it steps around is one a great deal of policy rests on.
Read →Al-Makha again: the second salvo is the campaign
Hours after the strikes that killed at least eleven, the Houthis hit the same Red Sea port again that evening. Seven more dead and thirty wounded, most of them civilians, though air defences downed eleven drones. A repeat attack on one target is a different thing from a reprisal, and should be read as one.
Read →Mokha and Jazan: a port and a refinery in one morning
Around twenty drones and ballistic missiles against a Red Sea port held by Yemen's recognised government, killing at least eleven. Hours earlier, a drone started a fire at a Saudi Aramco refinery across the water. Both claimed by the Houthis.
Read →Marib: the ceasefire nobody has formally ended
Yemen has been at war since 2014, and a UN truce in April 2022 largely stopped the big battles without settling anything. Over two days the Houthis put missiles and drones into military camps in Marib and Hadramawt, then into displacement camps and residential streets. The UN envoy called it the greatest risk of renewed war since that truce.
Read →Donaustahl: the recruiter did not need a professional
German investigators disrupted a plot against the chief executive of a Bavarian drone firm supplying Ukraine. Two people photographed his house and his company, and approached his father to find out where the son was. Neither of those charged is Russian, and one is not assessed as a professional. That is the design.
Read →Bolshoy Istok: the car was the way in
A device sited beneath a Mercedes destroyed it outside Yekaterinburg, killing the driver and leaving the director of a Russian drone plant fighting for his life. Fourteen hundred kilometres from the front, and nobody has claimed it. Explosives were not the difficult part; access to the car was.
Read →Kyiv: twenty-four ballistic missiles, none intercepted
Twenty-four ballistic missiles, four hypersonic or supersonic, and about 115 drones over two hours. Seventeen killed, forty-four wounded, and not one of the ballistic missiles shot down. Russia acknowledged the strike and called the targets military logistics; Ukraine called them a brewery, a builders' merchant and a postal sorting office.
Read →Najran: an attack that exists only as a claim
The Houthi movement says it struck a sensitive target at Najran Airport with a drone, precisely. Saudi Arabia has said nothing - no confirmation, no denial, no damage, no casualties. Every fact on the record comes from the party claiming the attack, and the information effect lands whether or not the drone did.
Read →The Khasab corridor: a week of hits on merchant shipping
Four merchant vessels struck or near-missed in five days in one twenty-mile box off Oman - an LNG carrier disabled, a products tanker photographed burning by Iranian state media, and a bulk carrier abandoned with a crewman missing. Unclaimed and unattributed. The corridor being attacked is the one shipping was told to use.
Read →NightLedger: when the victim becomes the relay
Three previously unseen Iranian espionage tools found across six countries. One is a backdoor; two turn infected machines into covert relays, so the attacker's onward traffic leaves the victim's network under the victim's name. Aviation, telecoms, finance and government targeted.
Read →CaptiveCrunch: the hotel Wi-Fi as a collection point
A Russian state cluster takes control of hotel Wi-Fi, forges what the network tells a guest's laptop, and serves a fake update that installs a remote access trojan and steals authentication tokens. The target is the traveller, not the hotel.
Read →Akrotiri: watched from outside the wire
A British man arrested on suspicion of hostile surveillance of RAF Akrotiri for Iran's Revolutionary Guards - no clearance, no insider, only proximity. Accused, not convicted. The first reach of the National Security Act 2023 into an overseas territory, and a reminder that the perimeter is not the boundary of the problem.
Read →Tarnawa-Kolonia: a missile across the line
A missile - highly likely Russian - flew some 100 km into Polish airspace and came down in a field between Tarnawa-Kolonia and Tokary. An F-16 was scrambled to intercept; it was not brought down. No casualties. Detection and scramble both worked, and the munition still arrived.
Read →Damietta: a drone at Europe's gas gateway
A drone struck a US-owned floating LNG terminal at Egypt's main Mediterranean gas port and the fire spread to a second carrier alongside. No casualties. Iranian state television had named Damietta as a target two days earlier; the first attack on Egyptian soil in this conflict. (Attribution unconfirmed.)
Read →Minnesota water: exposed at scale
A coordinated cyberattack degraded the operational technology of 30+ small water utilities at once - one plant offline, controls and communications disrupted. The method was three years old; only the scale was new. The lesson is OT hygiene, and reading a US incident as a direct UK/European warning. (Iran nexus vendor-assessed, unconfirmed.)
Read →The Black Sea flank: three drones in three days
Romania shot down a drone over the Black Sea, the third in three days to violate its airspace, and summoned Russia's ambassador. After years of absorbing incursions without firing, a NATO member on the Danube changed posture. The lesson is the shift from tolerating gray-zone probing to answering it.
Read →Berlin Pride: the gap in the barrier line
A vehicle attack on Berlin's Christopher Street Day (CSD), and a Hostile Vehicle Mitigation (HVM) coverage gap. The threat was foreseeable; the barrier line was not complete.
Read →SHAPE: an intern inside the wire
A Canadian intern of Chinese origin at SHAPE - NATO's operational military HQ - arrested on suspicion of spying for an undisclosed foreign state and membership of a criminal organisation. No operational damage claimed; a clean illustration of the insider threat and the access a temporary posting can carry. (Sponsoring state officially undisclosed.)
Read →Golders Green: a target chosen, not found
A knife attack on two Jewish men in a visibly Jewish north-London neighbourhood, declared a terrorist incident. Target selection - not opportunity - was the signature; the lesson is community-level protective security.
Read →Warsaw-Lublin: a line to Ukraine, cut
An IED destroyed a section of the Warsaw-Lublin railway - a route carrying aid to Ukraine - with a second tampering site nearby. No casualties, and that appears deliberate: calibrated damage below the threshold of a military response. The lesson is protecting critical transport against deniable sabotage.
Read →Vilnius: weaponising a nuisance
Smuggling balloons from Belarus repeatedly closed Vilnius airport - organised crime tolerated by a state and used as a hybrid lever on civil aviation. The lesson is treating gray-zone nuisance as a security problem, and responding without over-reacting.
Read →Évegnée: drones over the arsenal
A European arms maker reported a sharp rise in drones over its Belgian rocket factory at Évegnée - part of a continent-wide wave of overflights. The company can detect but, by law, not jam or down them; the origin is unconfirmed. The lesson is the gap between a known threat to critical infrastructure and the authority to act.
Read →Manchester synagogue: the door that held
A car-and-knife attack on a synagogue on Yom Kippur, stopped at a barricaded door and by armed police within minutes. Two worshippers died - one, tragically, by police fire. The lesson is layered protection of faith venues on high-attendance days.
Read →Polish airspace: nineteen tests of a threshold
~19 Russian drones crossed into Polish airspace in one night, mostly via Belarus; NATO fired for the first time since 2022. A cheap, deniable probe of an expensive threshold - the lesson is cost-exchange and layered, affordable defence.
Read →Osiny: the drone the radar missed
A Russian drone crashed and exploded in a cornfield ~40 km from Warsaw - and Poland's radar initially recorded no airspace violation. Confirmed Russian by the defence minister, it exposed a detection gap on the eastern flank weeks before a mass incursion made the point at scale.
Read →Kentish Town: three fires, one pattern
Three arson attacks in five days on the Prime Minister's wider property footprint, led by counter-terrorism police. The court found a financial motive and recruitment over Telegram by a Russian-speaking handler - the proxy pattern of state-linked sabotage, even where a state hand was not proven.
Read →Leyton: sabotage by proxy
A London warehouse storing Starlink terminals and aid for Ukraine was burned to order - proxies recruited over Telegram by a Wagner cut-out for Russian intelligence. Critical supply nodes on home soil are now targets, and the recruitment happens in the open.
Read →