European investigation examines hundreds of incidents with suspected Russian links

Journalists from 17 European public service broadcasters have examined hundreds of incidents with suspected links to Russia recorded between 1 April and 15 October 2026. The Ukrainian military outlet ArmyInform reports this, citing an investigation by Eurovision News Spotlight. The attacks on merchant ships off Bulgaria and Romania that it mentions are documented and confirmed by the authorities. There is no independent confirmation of the investigation's overall figures or of the alleged links to Russia.

The attacks off Bulgaria and Romania are confirmed; who carried them out is not

In October drones struck five merchant ships in Bulgaria's exclusive economic zone. On 6 October the ship Alfa Watan sank and the grain carrier Able was set ablaze about 70 nautical miles east of Byala. On 13 October HS Dignity sank off Shabla and Chelsea-3 was struck off Byala. On 28 October three naval drones hit the container ship CONTSHIP JET off Cape Kaliakra. The strikes were confirmed by the Ministry of Defence, the Ministry of Transport and Communications and the government.

All the strikes off Bulgaria took place in the exclusive economic zone, not in Bulgarian territorial waters. Crew members of Alfa Watan and HS Dignity are missing; sources differ on their number. In Romanian waters the tankers Yara J and Wine Trader were struck off Sulina, with seven Wine Trader seafarers missing. On 23 October a cargo ship sank off Constanța — according to the Romanian authorities, one crew member died and three are missing.

ArmyInform's totals remain unconfirmed. The outlet reports two dead and at least ten missing but does not say which cases it counts, so the figure cannot be checked against the official data on each incident. Those missing must not be counted as confirmed dead. Flank has found no officially established perpetrator of the attacks; the alleged Russian link is the investigation's assessment, which cannot be checked without its methodology.

Sabotage, airspace violations and reports from Moldova

According to ArmyInform's summary, the investigation covers airspace violations, attempted sabotage, suspicious military activity near borders and the use of recruited operatives without professional intelligence training. The article says the journalists checked the sources for each case and assessed how well founded the alleged link to Russia was.

ArmyInform also quotes Moldova's defence minister, Anatolie Nosatii, who said 84 drone incursions have been recorded in the country in 2026. The outlet also attributes to him the assessment that such Russian actions endanger citizens' lives. This is an official claim relayed by an intermediary, not an independently established figure or proof of each drone's origin.

A combined list does not prove a coordinated campaign

Assessing the alleged Russian link requires the original investigation, its methodology and the evidence for each case. Establishing an incident, a perpetrator and state direction are separate steps. Gathering events in one list does not in itself prove a single command or coordination.

ArmyInform also describes a growing frequency of physical actions. Without comparable data for earlier periods and clear inclusion criteria, however, it is impossible to judge whether activity has really increased or more cases have simply been documented. For Bulgaria, what matters most are the findings of the Bulgarian and Romanian authorities' investigations into the attacks already documented.