[
 {
  "id": "munich-defence-firms-arson-2026",
  "date": "2026-09-03",
  "country": "Germany",
  "lat": 48.1269,
  "lon": 11.6059,
  "category": "arson",
  "title": "Arson near Rohde & Schwarz and Helsing offices in Munich",
  "summary": "On the night of 2–3 September 2026 incendiary devices were thrown from a passing car at a construction site near the Munich offices of defence firms Rohde & Schwarz and Helsing, causing minor damage and no injuries. Police detained two Bulgarian citizens. According to the Frankfurter Allgemeine Zeitung, German investigators suspect Russian military intelligence (GRU) recruited them.",
  "status": "suspected",
  "established_by": "Frankfurter Allgemeine Zeitung (late Sep 2026), citing unnamed German security sources: suspects may belong to a GRU-linked group operating from Slovakia. No official German attribution or public charges reported.",
  "latest": "Two suspects detained; investigation ongoing as of late Sep 2026.",
  "link_to_ukraine": "Helsing supplies strike drones to Ukraine.",
  "sources": [
   {
    "tier": "C",
    "name": "Meduza: German investigators suspect Russian military intelligence organized an arson attack near defense firms in Munich",
    "date": "2026-09-25",
    "url": "https://meduza.io/en/news/2026/09/25/german-investigators-suspect-russian-military-intelligence-organized-an-arson-attack-near-defense-firms-in-munich"
   },
   {
    "tier": "C",
    "name": "Militarnyi: Arson near Rohde & Schwarz and Helsing in Munich linked to Russian intelligence",
    "date": "2026-09-26",
    "url": "https://militarnyi.com/en/news/arson-rohde-schwarz-helsing-munich-russia/"
   }
  ],
  "group": "sab"
 },
 {
  "id": "estonia-milrem-arson-2026",
  "date": "2026-08-15",
  "country": "Estonia",
  "lat": 59.43,
  "lon": 24.84,
  "category": "arson",
  "title": "Arson at Milrem Robotics building, Tallinn",
  "summary": "On the night of 14–15 August 2026 a fire was set at a Milrem Robotics building in Tallinn's Lasnamäe district; no one was hurt. On 29 September 2026 Estonia's government stated, based on Internal Security Service intelligence, that it was sabotage commissioned by Russian special services.",
  "status": "official",
  "established_by": "Government of Estonia, 29 Sep 2026, based on Internal Security Service intelligence; Russia's chargé d'affaires summoned.",
  "latest": "Three suspects, two of them Latvian citizens, detained on 17–18 Aug 2026 and handed to Estonia on 17–18 Sep 2026; criminal investigation ongoing.",
  "link_to_ukraine": "Milrem supplies THeMIS unmanned ground vehicles to Ukraine.",
  "sources": [
   {
    "tier": "B",
    "name": "Government of Estonia: Russia responsible for arson attack on Milrem",
    "date": "2026-09-29",
    "url": "https://valitsus.ee/en/news/russia-responsible-arson-attack-milrem"
   },
   {
    "tier": "C",
    "name": "Defense News: Estonia blames Russia in arson attack on military robotics firm Milrem",
    "date": "2026-09-29",
    "url": "https://www.defensenews.com/global/europe/2026/09/29/estonia-blames-russia-in-arson-attack-on-military-robotics-firm-milrem/"
   }
  ],
  "group": "sab"
 },
 {
  "id": "warsaw-plot-us-ukrainian-2026",
  "date": "2026-08-07",
  "country": "Poland",
  "lat": 52.2297,
  "lon": 21.0122,
  "category": "plot",
  "title": "Poland: plot to kill a US-Ukrainian citizen attributed to Russia",
  "summary": "Polish services, working with US authorities, detained a Russian man on 7 August 2026 who, according to Prime Minister Donald Tusk, had been recruited by Russian special services to kill a US citizen of Ukrainian origin in Warsaw. Tusk described it as the first case of someone acting on Russia's orders against an American citizen in another NATO country. Details of charges and the target have not been made public.",
  "status": "official",
  "established_by": "PM Donald Tusk, press conference 13 Aug 2026: suspect recruited by Russian special services and ordered to 'carry out an execution'; target 'uncomfortable for the Putin regime'. Minister-coordinator of special services Tomasz Siemoniak: operation conducted with US services. Charges not detailed publicly in sources reviewed.",
  "latest": "Suspect detained (Aug 2026); no public indictment located as of Oct 2026.",
  "link_to_ukraine": "The alleged target is a US citizen of Ukrainian origin.",
  "sources": [
   {
    "tier": "B",
    "name": "PM Tusk statement, as reported by Kyiv Independent",
    "date": "2026-08-13",
    "url": "https://kyivindependent.com/poland-arrests-russian-man-for-alleged-assassination-plot-against-us-ukrainian-national-pm-tusk-says/"
   },
   {
    "tier": "C",
    "name": "PBS NewsHour (AP): Poland says it thwarted Russian plot to kill an American citizen in a NATO country",
    "date": "2026-08-13",
    "url": "https://www.pbs.org/newshour/world/poland-says-it-thwarted-russian-plot-to-kill-an-american-citizen-in-a-nato-country"
   },
   {
    "tier": "C",
    "name": "CNN: Poland says it thwarted Russian plot to kill US citizen in Warsaw",
    "date": "2026-08-14",
    "url": "https://www.cnn.com/2026/08/14/europe/poland-russian-plot-american-intl"
   }
  ],
  "group": "kill"
 },
 {
  "id": "germany-leipzig-airport-explosive-drone-2026",
  "date": "2026-08-04",
  "country": "Germany",
  "lat": 51.432,
  "lon": 12.241,
  "category": "aviation",
  "title": "Explosive-laden drone at Leipzig/Halle airport",
  "summary": "On the evening of 4 August 2026 a drone carrying explosives was found near a Ukrainian cargo aircraft at Leipzig/Halle airport and defused; the airport was closed for hours. On 1 September 2026 the German government formally blamed Russian state entities and closed the Russian consulate general in Bonn and the Russian House in Berlin.",
  "status": "official",
  "established_by": "German Interior Minister Dobrindt and Foreign Minister Wadephul attributed the attempted attack to agents acting on behalf of Russian state entities (1 Sep 2026); the President of the European Council condemned 'Russia's attempted drone attack' the same day.",
  "latest": "Criminal investigation ongoing. Media investigations (Telegraph/Welt, 2 Oct 2026; Spiegel/The Insider, 8 Oct 2026) report GRU involvement and name suspects; no publicly confirmed charges or arrests found as of 15 Oct 2026. Russia denies involvement.",
  "link_to_ukraine": "The drone was found next to a Ukrainian cargo aircraft (An-124).",
  "sources": [
   {
    "tier": "B",
    "name": "European Council President: Attempted drone attack at Leipzig Airport",
    "date": "2026-09-01",
    "url": "https://www.consilium.europa.eu/en/european-council/president/x-posts/2026-09-01-184700/"
   },
   {
    "tier": "C",
    "name": "Al Jazeera: Germany accuses Russia of failed drone attack on Leipzig airport",
    "date": "2026-09-01",
    "url": "https://www.aljazeera.com/news/2026/9/1/germany-accuses-russia-of-drone-attack-on-leipzig-airport"
   },
   {
    "tier": "C",
    "name": "Euronews: Russia behind attempted drone 'attack' at Leipzig airport, Berlin says",
    "date": "2026-09-01",
    "url": "https://www.euronews.com/my-europe/2026/09/01/russia-behind-drone-incident-at-leipzig-airport-berlin-says"
   }
  ],
  "group": "sab"
 },
 {
  "id": "poland-railway-sabotage-mika-2025",
  "date": "2025-11-15",
  "country": "Poland",
  "lat": 51.73,
  "lon": 21.79,
  "category": "sabotage",
  "title": "Railway sabotage on Warsaw–Lublin line (Mika, Gołąb)",
  "summary": "On 15–16 November 2025 an explosive charge damaged tracks near Mika and the overhead catenary was damaged near Gołąb on railway line no. 7 (Warsaw–Dorohusk). Prime Minister Tusk called it an unprecedented act of sabotage; prosecutors say it was committed on behalf of Russian intelligence.",
  "status": "official",
  "established_by": "Polish National Prosecutor's Office charged two Ukrainian citizens (Oleksandr K., Yevhenii I.) on 19 Nov 2025 with sabotage of a terrorist nature on behalf of Russian Federation intelligence; government publicly attributed the attack to Russian services.",
  "latest": "Both direct suspects fled to Belarus; Poland requested extradition. An alleged accomplice (Volodymyr B.) was detained 20 Nov 2025 and charged. No trial reported as of Oct 2026.",
  "link_to_ukraine": "Line no. 7 is a key route for supplies to Ukraine via Dorohusk.",
  "sources": [
   {
    "tier": "B",
    "name": "Prokuratura Krajowa: akty dywersji na linii kolejowej nr 7",
    "date": "2025-11-21",
    "url": "https://www.gov.pl/web/prokuratura-krajowa/dywersja3"
   },
   {
    "tier": "C",
    "name": "Kyiv Independent: Poland charges another Ukrainian over suspected Russian-backed railway sabotage",
    "date": "2025-11-24",
    "url": "https://kyivindependent.com/poland-charges-ukrainian-over-suspected-russian-backed-railway-sabotage/"
   }
  ],
  "group": "sab"
 },
 {
  "id": "gnss-interference-icao-2025",
  "date": "2025-10-03",
  "country": "Baltic Sea region",
  "lat": 58.0,
  "lon": 21.0,
  "category": "gnss",
  "title": "ICAO finds GNSS interference over Baltic originates from Russia",
  "summary": "Six EU states (Estonia, Finland, Latvia, Lithuania, Poland and Sweden) brought evidence of recurring GNSS jamming and spoofing affecting civil aviation to ICAO. In June 2025, the ICAO Council noted 'recurring cases of GNSS interference from the Russian Federation'. On 3 October 2025, the ICAO Assembly condemned the interference as a breach of the Chicago Convention.",
  "status": "official",
  "established_by": "ICAO Council decision (13 June 2025) and ICAO 42nd Assembly (3 Oct 2025), on submissions from six EU member states.",
  "latest": "The Assembly urged Russia to halt the interference, and the European Commission welcomed the condemnation. Interference in the Baltic region continued to be reported in 2026.",
  "link_to_ukraine": "",
  "sources": [
   {
    "tier": "A",
    "name": "ICAO 42nd Assembly – Executive Committee working paper WP/553",
    "date": "2025-09",
    "url": "https://www.icao.int/sites/default/files/Meetings/a42/Documents/WP/wp_553_en.pdf"
   },
   {
    "tier": "B",
    "name": "European Commission (DG MOVE) – EU welcomes UN aviation agency's condemnation of Russia",
    "date": "2025-10-03",
    "url": "https://transport.ec.europa.eu/news-events/news/eu-welcomes-un-aviation-agencys-condemnation-russia-undermining-global-aviation-safety-2025-10-03_en"
   },
   {
    "tier": "B",
    "name": "Estonian Transport Administration – ICAO Council calls on the Russian Federation to adhere to its obligations",
    "date": "2025-07-09",
    "url": "https://transpordiamet.ee/en/news/icao-council-calls-russian-federation-strictly-adhere-its-obligations-and-ensure-gnss-radio"
   }
  ],
  "group": "infra"
 },
 {
  "id": "moldova-parliamentary-2025",
  "date": "2025-09-28",
  "country": "Moldova",
  "lat": 47.02,
  "lon": 28.84,
  "category": "election",
  "title": "Moldova 2025 election hit by hybrid attacks traced to Russia",
  "summary": "International observers of Moldova's 28 September 2025 parliamentary elections reported that the campaign was marred by vote-buying, illicit financing, cyberattacks and disinformation. According to the observers, the authorities identified these hybrid attacks as originating from the Russian Federation. A large-scale cyberattack on election day forced authorities to block a platform.",
  "status": "official",
  "established_by": "Moldovan authorities, as reported in the International Election Observation Mission statement (OSCE/ODIHR, OSCE PA, PACE, EP), 29 Sept 2025.",
  "latest": "The observers judged the elections competitive despite the interference.",
  "link_to_ukraine": "",
  "sources": [
   {
    "tier": "A",
    "name": "OSCE PA – International Election Observation Mission, Moldova 2025 parliamentary elections, preliminary statement",
    "date": "2025-09-29",
    "url": "https://www.oscepa.org/en/documents/election-observation/election-observation-statements/moldova/statements-16/5347-2025-parliamentary-eng/file"
   },
   {
    "tier": "A",
    "name": "PACE – Election observation report (Doc. 16296)",
    "date": "2025",
    "url": "https://pace.coe.int/en/files/35722/html"
   }
  ],
  "group": "elect"
 },
 {
  "id": "estonia-mig31-airspace-2025-09",
  "date": "2025-09-19",
  "country": "Estonia",
  "lat": 59.82,
  "lon": 26.36,
  "category": "airspace",
  "title": "Three Russian MiG-31s violate Estonian airspace for over 10 minutes",
  "summary": "On 19 September 2025, three Russian MiG-31 fighter jets entered Estonian airspace over the Gulf of Finland near Vaindloo island and stayed for more than ten minutes. Estonia requested Article 4 consultations, and the North Atlantic Council met on 23 September.",
  "status": "official",
  "established_by": "North Atlantic Council statement, 23 Sept 2025: three Russian aircraft 'violated Estonian airspace for over ten minutes'; 'Russia bears full responsibility for these actions'. Estonian Ministry of Foreign Affairs.",
  "latest": "The UN Security Council met on 22 Sept 2025 at Estonia's request. NATO members delivered a joint statement on the violation at the OSCE Forum for Security Co-operation in October 2025.",
  "link_to_ukraine": "",
  "sources": [
   {
    "tier": "A",
    "name": "NATO – Statement by the North Atlantic Council on recent airspace violations by Russia",
    "date": "2025-09-23",
    "url": "https://www.nato.int/en/about-us/official-texts-and-resources/official-texts/2025/09/23/statement-by-the-north-atlantic-council-on-recent-airspace-violations-by-russia"
   },
   {
    "tier": "A",
    "name": "UN Security Council, 10002nd meeting (press release SC/16177)",
    "date": "2025-09-22",
    "url": "https://press.un.org/en/2025/sc16177.doc.htm"
   },
   {
    "tier": "B",
    "name": "Estonian Ministry of Foreign Affairs – Allies: responsibility for endangering peace and security lies with Russia",
    "date": "2025-09-23",
    "url": "https://vm.ee/en/news/allies-responsibility-endangering-peace-and-security-lies-russia"
   }
  ],
  "group": "air"
 },
 {
  "id": "romania-drone-incursion-2025-09",
  "date": "2025-09-13",
  "country": "Romania",
  "lat": 45.18,
  "lon": 28.8,
  "category": "airspace",
  "title": "Russian drone enters Romanian airspace during strikes on Ukraine",
  "summary": "On 13 September 2025, during a Russian attack on Ukraine, a Russian drone entered Romanian airspace and Romanian F-16s were scrambled to track it. Bucharest summoned the Russian ambassador and called the incursion unacceptable and irresponsible.",
  "status": "official",
  "established_by": "Romanian Ministry of National Defence and Ministry of Foreign Affairs (summoning of Russia's ambassador, Sept 2025). The North Atlantic Council statement of 23 Sept 2025 names Romania among Allies that 'have also recently experienced airspace violations by Russia'.",
  "latest": "Drone incursions and debris falls on Romanian territory have recurred since 2022 during Russian strikes on Ukraine's Danube region.",
  "link_to_ukraine": "The drone crossed into Romania during Russian strikes on Ukraine near the border.",
  "sources": [
   {
    "tier": "A",
    "name": "NATO – Statement by the North Atlantic Council on recent airspace violations by Russia",
    "date": "2025-09-23",
    "url": "https://www.nato.int/en/about-us/official-texts-and-resources/official-texts/2025/09/23/statement-by-the-north-atlantic-council-on-recent-airspace-violations-by-russia"
   },
   {
    "tier": "C",
    "name": "Romania Insider – Romania accuses Russia of 'unacceptable and irresponsible' act over drone incident",
    "date": "2025-09-14",
    "url": "https://www.romania-insider.com/russian-drone-romania-airspace-sept-2025"
   }
  ],
  "group": "air"
 },
 {
  "id": "poland-drone-incursion-2025-09",
  "date": "2025-09-10",
  "country": "Poland",
  "lat": 51.64,
  "lon": 23.37,
  "category": "airspace",
  "title": "Russian drones violate Polish airspace; NATO jets shoot some down",
  "summary": "On the night of 9–10 September 2025, during a Russian strike on Ukraine, 19 Russian drones entered Polish airspace, according to the Polish government. Polish and allied aircraft shot down the drones judged most dangerous. Poland requested Article 4 consultations, and the North Atlantic Council met on 10 September.",
  "status": "official",
  "established_by": "Polish Government (Prime Minister's statement, 10–11 Sept 2025); North Atlantic Council statement of 23 Sept 2025, which refers to a 'large-scale violation of Polish airspace by Russian drones' and says 'Russia bears full responsibility'.",
  "latest": "NATO launched Operation Eastern Sentry on 12 Sept 2025 to reinforce the eastern flank. The UN Security Council held an emergency briefing on 12 Sept 2025. The NAC's attribution stands.",
  "link_to_ukraine": "The drones entered Poland during a large Russian drone and missile attack on western Ukraine.",
  "sources": [
   {
    "tier": "A",
    "name": "NATO – Statement by the North Atlantic Council on recent airspace violations by Russia",
    "date": "2025-09-23",
    "url": "https://www.nato.int/en/about-us/official-texts-and-resources/official-texts/2025/09/23/statement-by-the-north-atlantic-council-on-recent-airspace-violations-by-russia"
   },
   {
    "tier": "A",
    "name": "NATO – NATO launches Eastern Sentry to bolster posture along eastern flank",
    "date": "2025-09-12",
    "url": "https://www.nato.int/en/news-and-events/articles/news/2025/09/12/nato-launches-eastern-sentry-to-bolster-posture-along-eastern-flank"
   },
   {
    "tier": "B",
    "name": "Chancellery of the Prime Minister of Poland – Any attack on Poland will be met with response",
    "date": "2025-09-11",
    "url": "https://www.gov.pl/web/primeminister/any-attack-on-poland-will-be-met-with-response"
   },
   {
    "tier": "C",
    "name": "Security Council Report – Emergency briefing on drone incursion into Poland",
    "date": "2025-09-12",
    "url": "https://www.securitycouncilreport.org/whatsinblue/2025/09/emergency-briefing-on-drone-incursion-into-poland.php"
   }
  ],
  "group": "air"
 },
 {
  "id": "mali-africa-corps-2025",
  "date": "2025-09-04",
  "country": "Mali",
  "lat": 14.49,
  "lon": -4.19,
  "category": "pmc-abuse",
  "title": "Mali: Africa Corps replaces Wagner; UN reports serious violations",
  "summary": "Wagner announced its withdrawal from Mali in June 2025, while Russia's Defence Ministry-controlled 'Africa Corps' remained. On 4 September 2025 OHCHR stated that Malian troops are backed by foreign military personnel from the 'Africa Corps' (formerly 'Wagner Group'), that Malian troops and their foreign backers have committed serious violations against civilians, and that since April 2025 the UN had received credible information of hundreds of extrajudicial executions and other abuses by all parties.",
  "status": "official",
  "established_by": "OHCHR / UN High Commissioner Volker Türk statement, Geneva, 4 September 2025 (general finding; not incident-specific attribution).",
  "latest": "Human Rights Watch (20 Aug 2026) documented the killing of nine civilians, including four children, by Africa Corps-led forces in Bombori (Mopti region) on 10 July 2026 — a C-tier, not yet UN-verified, allegation. No accountability process known.",
  "link_to_ukraine": "Africa Corps is a Russian MoD-controlled structure that absorbed Wagner's Africa operations; the same state apparatus is waging the war against Ukraine.",
  "sources": [
   {
    "tier": "A",
    "name": "OHCHR: Mali – Türk deplores indefinite suspension of elections, deepening crackdown on civil society",
    "date": "2025-09-04",
    "url": "https://www.ohchr.org/en/press-releases/2025/09/mali-turk-deplores-indefinite-suspension-elections-deepening-crackdown-civil"
   },
   {
    "tier": "C",
    "name": "AP via NBC News: Wagner Group leaving Mali after heavy losses but Russia's Africa Corps to remain",
    "date": "2025-06-06",
    "url": "https://www.nbcnews.com/world/africa/wagner-group-leaving-mali-heavy-losses-russia-africa-corps-remain-rcna211591"
   },
   {
    "tier": "C",
    "name": "Human Rights Watch: Mali – Russia's Africa Corps massacres villagers",
    "date": "2026-08-20",
    "url": "https://www.hrw.org/news/2026/08/20/mali-russias-africa-corps-massacres-villagers"
   }
  ],
  "group": "pmc"
 },
 {
  "id": "france-apt28-attribution-2025",
  "date": "2025-04-29",
  "country": "France",
  "lat": 48.857,
  "lon": 2.352,
  "category": "cyber",
  "title": "France formally attributes cyberattacks since 2015 to GRU's APT28",
  "summary": "On 29 April 2025, France for the first time formally attributed a series of cyberattacks on French entities to Russia's GRU, acting through APT28. The cases include the 2015 sabotage of broadcaster TV5Monde and attempts to destabilise the 2017 French elections. The statement also notes APT28 targeting of an organisation involved in the Paris 2024 Olympics.",
  "status": "official",
  "established_by": "French Ministry for Europe and Foreign Affairs statement, 29 April 2025, based on ANSSI technical findings.",
  "latest": "Attribution stands.",
  "link_to_ukraine": "",
  "sources": [
   {
    "tier": "B",
    "name": "France Diplomatie – Russia: Attribution of cyber attacks on France to the Russian military intelligence service (APT28)",
    "date": "2025-04-29",
    "url": "https://www.diplomatie.gouv.fr/en/presse-et-ressources/decouvrir-et-informer/actualites/russie-attribution-de-cyberattaques-contre-la-france-au-service-de-renseignement-militaire-russe"
   },
   {
    "tier": "C",
    "name": "BleepingComputer – France ties Russian APT28 hackers to 12 cyberattacks on French orgs",
    "date": "2025-04-29",
    "url": "https://www.bleepingcomputer.com/news/security/france-ties-russian-apt28-hackers-to-12-cyberattacks-on-french-orgs/?mid=1"
   }
  ],
  "group": "cyber"
 },
 {
  "id": "germany-novapost-gps-parcel-plot-2025",
  "date": "2025-03",
  "country": "Germany",
  "lat": 50.938,
  "lon": 6.96,
  "category": "terror-plot",
  "title": "GPS-tracker test parcels to Ukraine for Russian sabotage plot",
  "summary": "In March 2025 suspects sent parcels with GPS trackers from Germany via Nova Post to Ukraine to scout routes for later incendiary parcels. Three Ukrainian nationals were arrested in Germany and Switzerland in May 2025 on suspicion of acting for Russian intelligence.",
  "status": "court",
  "established_by": "Federal Prosecutor General ordered arrests on suspicion of agent activity for sabotage purposes (press release 14 May 2025). OLG Stuttgart on 18 Aug 2026 convicted one defendant of espionage for sabotage purposes (1 year 3 months) and acquitted two.",
  "latest": "Verdict of 18 Aug 2026: one conviction, two acquittals; finality not confirmed.",
  "link_to_ukraine": "Parcels routed to Ukraine via Nova Post; planned incendiary parcels could ignite in Germany or Ukraine.",
  "sources": [
   {
    "tier": "B",
    "name": "Generalbundesanwalt: Arrests of three suspected agents for sabotage purposes",
    "date": "2025-05-14",
    "url": "https://www.generalbundesanwalt.de/SharedDocs/Pressemitteilungen/EN/2025/Pressemitteilung-vom-14-05-2025-engl.html"
   },
   {
    "tier": "C",
    "name": "Euronews: Ukrainian national convicted by German court over links to Russian sabotage plot",
    "date": "2026-08-18",
    "url": "https://www.euronews.com/my-europe/2026/08/18/ukrainian-national-convicted-by-german-court-over-links-to-russian-sabotage-plot"
   },
   {
    "tier": "C",
    "name": "ZDFheute: OLG Stuttgart trial of alleged agents for Russia",
    "date": "2026-03-17",
    "url": "https://www.zdfheute.de/panorama/kriminalitaet/russland-sabotage-deutschland-geheimdienst-prozess-100.html"
   }
  ],
  "group": "sab"
 },
 {
  "id": "germany-storm1516-election-2025",
  "date": "2025-02",
  "country": "Germany",
  "lat": 52.52,
  "lon": 13.4,
  "category": "election",
  "title": "Germany attributes 'Storm-1516' election disinformation to Russia",
  "summary": "On 12 December 2025, the German government stated that Russia had tried to influence the February 2025 federal election and German domestic affairs through the 'Storm-1516' disinformation campaign. It named the Moscow-based Center for Geopolitical Expertise and a further network as involved, both supported by the GRU.",
  "status": "official",
  "established_by": "German Foreign Office spokesperson, government press conference, 12 Dec 2025, citing intelligence analysis. The Russian ambassador was summoned.",
  "latest": "Attribution announced in Dec 2025. Germany said not all of the evidence can be made public.",
  "link_to_ukraine": "",
  "sources": [
   {
    "tier": "B",
    "name": "Auswärtiges Amt – Regierungspressekonferenz (12 Dec 2025)",
    "date": "2025-12-12",
    "url": "https://www.auswaertiges-amt.de/de/newsroom/regierungspressekonferenz-2748168"
   },
   {
    "tier": "C",
    "name": "Euronews – Germany summons Russian ambassador over alleged election interference and cyberattacks",
    "date": "2025-12-12",
    "url": "https://www.euronews.com/2025/12/12/germany-summons-russian-ambassador-over-alleged-election-interference-and-cyberattacks"
   }
  ],
  "group": "elect"
 },
 {
  "id": "estonia-slava-ukraini-restaurant-arson-2025",
  "date": "2025-01-31",
  "country": "Estonia",
  "lat": 59.437,
  "lon": 24.745,
  "category": "arson",
  "title": "GRU-ordered arson of Slava Ukraini restaurant, Tallinn",
  "summary": "On the night of 31 January 2025 Moldovan national Ivan Chihaial set fire to the Ukrainian restaurant Slava Ukraini in Tallinn after a trial arson at a store in Osula. The court found he was tasked by Russia's GRU.",
  "status": "court",
  "established_by": "Harju County Court (settlement proceedings) convicted him on 2 July 2025 of arson on behalf of Russian special services (6.5 years); Estonian Prosecutor's Office stated the task came from the GRU.",
  "latest": "Convicted 2 July 2025; accomplice received 2.5 years (mostly suspended).",
  "link_to_ukraine": "Targeted a Ukrainian restaurant, a symbol of support for Ukraine.",
  "sources": [
   {
    "tier": "B",
    "name": "Estonian Prosecutor's Office: Court sentenced Slava Ukraina restaurant arsonist to real imprisonment",
    "date": "2025-07-02",
    "url": "https://www.prokuratuur.ee/en/news/court-sentenced-slava-ukraina-restaurant-arsonist-real-imprisonment"
   },
   {
    "tier": "C",
    "name": "ERR News: Arson attack on Ukrainian restaurant in Estonia ordered by Russian intelligence",
    "date": "2025-07-02",
    "url": "https://news.err.ee/1609735683/arson-attack-on-ukrainian-restaurant-in-estonia-ordered-by-russian-intelligence"
   }
  ],
  "group": "sab"
 },
 {
  "id": "eagle-s-estlink2-2024",
  "date": "2024-12-25",
  "country": "Finland",
  "lat": 59.9,
  "lon": 25.0,
  "category": "undersea",
  "title": "Eagle S tanker anchor damages Estlink 2 and telecom cables",
  "summary": "On 25 December 2024, the anchor of the tanker Eagle S damaged the Estlink 2 power cable and several telecom cables in the Gulf of Finland. Finnish prosecutors charged the captain and two chief officers with aggravated criminal mischief and aggravated interference with telecommunications. Russian state responsibility for the damage has not been established; the link to Russia is the vessel's listing by the EU as part of Russia's 'shadow fleet'.",
  "status": "suspected",
  "established_by": "Finnish police and prosecutors (charges, Aug 2025). The Helsinki District Court dismissed the case for lack of jurisdiction (Oct 2025). The EU Council listed Eagle S under the 17th sanctions package (May 2025) as a shadow-fleet vessel, without attributing the cable damage.",
  "latest": "On 27 Aug 2026, the Helsinki Court of Appeal overturned the dismissal, ruled that Finland has jurisdiction, and returned the case to the District Court. A Supreme Court appeal is possible, but only with leave.",
  "link_to_ukraine": "The EU lists Eagle S as part of the shadow fleet that carries Russian oil and funds the war against Ukraine.",
  "sources": [
   {
    "tier": "A",
    "name": "Helsinki District Court – Eagle S case announcement (EN)",
    "date": "2025-08-21",
    "url": "https://tuomioistuimet.fi/material/sites/oikeus_karajaoikeudet_helsinginkarajaoikeus/tiedotteet/hmvldciiv/eagle_s_english.pdf"
   },
   {
    "tier": "B",
    "name": "Finnish Government – EU's 17th sanctions package cracks down on Russia's shadow fleet",
    "date": "2025-05-20",
    "url": "https://valtioneuvosto.fi/en/-/eu-s-17th-sanctions-package-cracks-down-on-russia-s-shadow-fleet"
   },
   {
    "tier": "C",
    "name": "Kaleva – Helsinki Court of Appeal overturns District Court decision",
    "date": "2026-08-27",
    "url": "https://www.kaleva.fi/helsingin-hovioikeus-kumosi-karajaoikeuden-paatoks/13640137"
   },
   {
    "tier": "C",
    "name": "Courthouse News – Finland dismisses case over Baltic cable cuts",
    "date": "2025-10-03",
    "url": "https://www.courthousenews.com/finland-dismisses-case-over-baltic-cable-cuts/"
   }
  ],
  "group": "infra"
 },
 {
  "id": "romania-election-annulment-2024",
  "date": "2024-12-06",
  "country": "Romania",
  "lat": 44.43,
  "lon": 26.1,
  "category": "election",
  "title": "Romania annuls presidential vote after Russian hybrid-attack findings",
  "summary": "On 4 December 2024, Romania declassified Supreme Council of National Defence (CSAT) documents. They stated that 'Romania is a target for aggressive Russian hybrid actions' and described a coordinated TikTok campaign for candidate Călin Georgescu, along with cyberattacks on election IT systems by a 'state cyber actor'. On 6 December 2024, the Constitutional Court annulled the entire presidential election.",
  "status": "official",
  "established_by": "Romanian Presidency / CSAT declassified notes from the SRI, SIE, MAI and STS (4 Dec 2024). Constitutional Court decision annulling the election (6 Dec 2024). The ECHR declared Georgescu's challenge inadmissible (6 Mar 2025). The court rulings concern electoral irregularities and do not themselves attribute the interference to Russia.",
  "latest": "The election was rerun in May 2025. The European Commission opened DSA proceedings against TikTok on 17 Dec 2024.",
  "link_to_ukraine": "",
  "sources": [
   {
    "tier": "A",
    "name": "European Court of Human Rights – Inadmissibility decision, Georgescu v. Romania",
    "date": "2025-03-06",
    "url": "https://www.echr.coe.int/w/inadmissiblity-decision-concerning-romania-1"
   },
   {
    "tier": "C",
    "name": "AGERPRES – Declassified documents from CSAT: Romania target of Russian hybrid actions",
    "date": "2024-12-04",
    "url": "https://agerpres.ro/2024/12/04/declassified-documents-from-csat-romania---target-of-russian-hybrid-actions-georgescu-s-campaign---f--1398576"
   },
   {
    "tier": "C",
    "name": "Verfassungsblog – The second round that wasn't",
    "date": "2024-12-07",
    "url": "https://verfassungsblog.de/the-second-round-that-wasnt/"
   },
   {
    "tier": "C",
    "name": "Euronews – European Commission opens probe against TikTok over Romanian election",
    "date": "2024-12-17",
    "url": "https://www.euronews.com/my-europe/2024/12/17/european-commission-opens-probe-against-tiktok-over-romanian-election"
   }
  ],
  "group": "elect"
 },
 {
  "id": "moldova-vote-buying-2024",
  "date": "2024-10",
  "country": "Moldova",
  "lat": 47.01,
  "lon": 28.86,
  "category": "election",
  "title": "Russia-linked vote-buying in Moldova's 2024 election and EU referendum",
  "summary": "Moldovan police said a network linked to fugitive oligarch Ilan Shor had moved about USD 39 million from Russia to pay voters ahead of the October 2024 presidential election and EU-accession referendum. In July 2025, the EU Council sanctioned Shor associates for vote-buying in those votes, citing 'persistent destabilising activities by Russia'.",
  "status": "official",
  "established_by": "Moldovan National Police findings (Oct 2024). EU Council listings under the Moldova destabilisation framework (15 July 2025; Shor listed earlier).",
  "latest": "As of July 2025, the EU framework covers 23 individuals and 5 entities.",
  "link_to_ukraine": "",
  "sources": [
   {
    "tier": "A",
    "name": "Council of the EU – Republic of Moldova: Council lists seven individuals and three entities for actions destabilising the country",
    "date": "2025-07-15",
    "url": "https://www.consilium.europa.eu/ro/press/press-releases/2025/07/15/republic-of-moldova-council-lists-seven-individuals-and-three-entities-for-actions-destabilising-the-country/pdf/"
   },
   {
    "tier": "C",
    "name": "RFE/RL – Moldovan police accuse pro-Russian oligarch of $39M vote-buying scheme",
    "date": "2024-10-25",
    "url": "https://www.rferl.org/a/moldova-police-accuse-shor-russia-oligarch-39m-vote-buying/33172951.html"
   }
  ],
  "group": "elect"
 },
 {
  "id": "germany-dfs-cyberattack-2024",
  "date": "2024-08",
  "country": "Germany",
  "lat": 49.99,
  "lon": 8.67,
  "category": "cyber",
  "title": "APT28 cyberattack on German air traffic control provider DFS",
  "summary": "In August 2024, a cyberattack hit Deutsche Flugsicherung (DFS), Germany's air navigation service provider. On 12 December 2025, the German Foreign Office attributed the attack to APT28 ('Fancy Bear') and Russia's military intelligence service, the GRU, and summoned the Russian ambassador.",
  "status": "official",
  "established_by": "German Foreign Office spokesperson at the government press conference, 12 Dec 2025, citing analysis by German intelligence services.",
  "latest": "Germany summoned Russia's ambassador on 12 Dec 2025. Berlin said not all of the evidence can be made public.",
  "link_to_ukraine": "",
  "sources": [
   {
    "tier": "B",
    "name": "Auswärtiges Amt – Regierungspressekonferenz (12 Dec 2025)",
    "date": "2025-12-12",
    "url": "https://www.auswaertiges-amt.de/de/newsroom/regierungspressekonferenz-2748168"
   },
   {
    "tier": "C",
    "name": "France 24 – Germany summons Russian ambassador over cyberattacks on air traffic control, general election",
    "date": "2025-12-12",
    "url": "https://www.france24.com/en/europe/20251212-germany-summons-russian-ambassador-over-cyberattacks-on-air-traffic-control-general-election"
   }
  ],
  "group": "cyber"
 },
 {
  "id": "dhl-dpd-incendiary-parcels-2024",
  "date": "2024-07",
  "country": "Germany",
  "lat": 51.42,
  "lon": 12.24,
  "category": "sabotage",
  "title": "Self-igniting parcels: fires at DHL Leipzig hub, UK and Poland",
  "summary": "In July 2024 parcels containing incendiary devices hidden in neck massagers, sent from Lithuania via DHL and DPD, ignited at the DHL hub at Leipzig airport shortly before loading, at a warehouse in the UK and in a truck in Poland. Test parcels were sent to the US and Canada. A Eurojust-supported joint investigation team identified 22 suspects who are suspected of working on behalf of Russia's military intelligence service.",
  "status": "official",
  "established_by": "Eurojust-supported joint investigation team (Germany, Lithuania, Netherlands, Poland, UK) announced on 6 Mar 2026 that suspects are believed to have worked for Russia's military intelligence service; Lithuanian prosecutors allege the operation was organised by GRU-linked individuals.",
  "latest": "Trial of five defendants on terrorism charges opened at Vilnius Regional Court on 17 Apr 2026 and was ongoing in May 2026; a parallel case is before Polish courts; international warrants out for others. No verdict found as of Oct 2026.",
  "link_to_ukraine": "",
  "sources": [
   {
    "tier": "B",
    "name": "Eurojust: Joint investigation team disrupts group using self-igniting parcels for terrorist attacks",
    "date": "2026-03-06",
    "url": "https://www.eurojust.europa.eu/news/joint-investigation-team-disrupts-group-using-self-igniting-parcels-terrorist-attacks"
   },
   {
    "tier": "C",
    "name": "Euronews/AP: Trial of five men accused of sending exploding parcels for Russia starts in Lithuania",
    "date": "2026-04-17",
    "url": "https://www.euronews.com/my-europe/2026/04/17/trial-of-five-men-accused-of-sending-exploding-parcels-for-russia-starts-in-lithuania"
   },
   {
    "tier": "C",
    "name": "The Baltic Times: Vilnius court continues hearing in terrorism trial",
    "date": "2026-05-08",
    "url": "https://www.baltictimes.com/vilnius_court_continues_hearing_in_terrorism_trial_over_incendiary_device_shipments/"
   }
  ],
  "group": "sab"
 },
 {
  "id": "rheinmetall-papperger-plot-2024",
  "date": "2024-07",
  "country": "Germany",
  "lat": 51.2277,
  "lon": 6.7735,
  "category": "plot",
  "title": "Reported Russian plot to assassinate Rheinmetall CEO Armin Papperger",
  "summary": "CNN reported in July 2024 that US intelligence had uncovered a Russian government plan to assassinate Armin Papperger, CEO of Rheinmetall, a major arms supplier to Ukraine, and had alerted Germany, which provided him protection. German authorities declined to comment on the specific report. No charges have been made public.",
  "status": "suspected",
  "established_by": "CNN, 11 Jul 2024, citing five unnamed US and Western officials. German interior ministry declined to comment directly, saying the government 'takes the threats from the Russian regime very seriously'. NATO official James Appathurai later told the European Parliament that Russia's campaign included 'threats to assassinate industry leaders, such as Rheinmetall's CEO'.",
  "latest": "No public indictment or official German attribution as of Oct 2026.",
  "link_to_ukraine": "Rheinmetall is a leading supplier of ammunition and armour to Ukraine.",
  "sources": [
   {
    "tier": "C",
    "name": "The Defense Post: Russian Planned Assassination of Rheinmetall CEO: CNN",
    "date": "2024-07-11",
    "url": "https://www.thedefensepost.com/2024/07/11/rheinmetall-ceo-assassination-plot"
   },
   {
    "tier": "C",
    "name": "NV: Russia's plot to kill Rheinmetall CEO exposed by NATO (Appathurai remarks, citing Reuters)",
    "date": "2025-01-28",
    "url": "https://english.nv.ua/amp/nato-reveals-russia-s-assassination-plot-targeting-rheinmetall-ceo-50485344.html"
   }
  ],
  "group": "kill"
 },
 {
  "id": "prague-bus-depot-arson-2024",
  "date": "2024-06-06",
  "country": "Czechia",
  "lat": 50.1094,
  "lon": 14.507,
  "category": "arson",
  "title": "Attempted arson of buses at Prague Klíčov depot",
  "summary": "A Colombian man attempted to set fire to public buses at the Klíčov depot in Prague and was arrested. In June 2025 a Prague court sentenced him to eight years after he pleaded guilty; he had received orders via Telegram with a promise of payment. Prime Minister Petr Fiala said the attack was likely organised and financed by Russia; the court did not rule on a Russian link.",
  "status": "suspected",
  "established_by": "Czech PM Petr Fiala, June 2024: attack likely organised and financed by Russia as part of 'hybrid war'. Prague court, 9 Jun 2025: Andrés Alfonso de la Hoz de la Cruz convicted and sentenced to 8 years (guilty plea); verdict did not attribute the commission to Russia. Kremlin denied involvement.",
  "latest": "Perpetrator convicted (June 2025); Russian sponsorship remains a government assessment, not a court finding.",
  "link_to_ukraine": "",
  "sources": [
   {
    "tier": "C",
    "name": "Expats.cz: Czech PM blames Prague arson attack on Russia, claims 'hybrid war'",
    "date": "2024-06-11",
    "url": "https://expats.cz/czech-news/article/czech-pm-blames-czech-arson-attack-on-russia-claims-hybrid-war"
   },
   {
    "tier": "C",
    "name": "Euronews: Czech court sentences Colombian to eight years for Russia-linked arson attack",
    "date": "2025-06-09",
    "url": "https://www.euronews.com/2025/06/09/czech-court-sentences-colombian-to-eight-years-in-prison-for-russia-linked-arson-attack"
   }
  ],
  "group": "sab"
 },
 {
  "id": "poland-marywilska-fire-2024",
  "date": "2024-05-12",
  "country": "Poland",
  "lat": 52.317,
  "lon": 20.98,
  "category": "arson",
  "title": "Marywilska 44 shopping centre fire, Warsaw",
  "summary": "A fire on 12 May 2024 destroyed the Marywilska 44 shopping centre in Warsaw, the city's largest. Polish authorities concluded it was arson instructed by Russian secret services and organised by a person residing in Russia.",
  "status": "official",
  "established_by": "Joint statement of Poland's Minister of Justice–Prosecutor General and Minister of Interior–Coordinator of Special Services, 11 May 2025; Poland ordered closure of the Russian consulate in Kraków.",
  "latest": "Direct perpetrators not yet identified per the March 2026 indictment; one defendant (Daniil B.) is accused of filming the fire for a Russian contact. Related trial opened at Warsaw-Praga District Court on 12 Oct 2026.",
  "link_to_ukraine": "",
  "sources": [
   {
    "tier": "B",
    "name": "Gov.pl: Joint statement by the Minister of Justice–Prosecutor General and the Minister of Internal Affairs",
    "date": "2025-05-11",
    "url": "https://www.gov.pl/web/justice/joint-statement-by-the-minister-of-justice---prosecutor-general-and-the-minister-of-internal-affairs-and-administration-coordinator-of-secret-services"
   },
   {
    "tier": "B",
    "name": "Prokuratura Krajowa: indictment on arson attacks for Russian intelligence",
    "date": "2026-04-02",
    "url": "https://www.gov.pl/web/prokuratura-krajowa/akt-oskarzenia-w-sprawie-podpalen-obiektow-wielkopowierzchniowych-na-rzecz-wywiadu-federacji-rosyjskiej"
   },
   {
    "tier": "C",
    "name": "Notes from Poland: Four go on trial in Warsaw over arson attacks carried out on Russian orders",
    "date": "2026-10-12",
    "url": "https://notesfrompoland.com/2026/10/12/four-go-on-trial-in-warsaw-over-arson-attacks-carried-out-on-russian-orders/"
   }
  ],
  "group": "sab"
 },
 {
  "id": "lithuania-ikea-vilnius-arson-2024",
  "date": "2024-05-09",
  "country": "Lithuania",
  "lat": 54.687,
  "lon": 25.28,
  "category": "arson",
  "title": "IKEA Vilnius arson",
  "summary": "A timed incendiary device set off a fire at the IKEA store in Vilnius on the night of 8–9 May 2024; no one was injured. Lithuanian and Polish prosecutors say the attack was ordered by Russian intelligence as part of a wider arson campaign that included an OBI store in Warsaw and a planned attack on IKEA in Riga.",
  "status": "court",
  "established_by": "Lithuanian prosecutors attributed the attack to Russian military intelligence (GRU) in March 2025. Vilnius District Court convicted Ukrainian national Daniil Bardadim of an act of terror on 24 Nov 2025 (3 years 4 months). Polish National Prosecutor's indictment (25 Mar 2026) states the attacks were carried out for Russian intelligence.",
  "latest": "Bardadim convicted in Lithuania (Nov 2025). Trial of co-defendants for the IKEA, OBI and planned Riga attacks opened at Warsaw-Praga District Court on 12 Oct 2026; alleged coordinators remain wanted.",
  "link_to_ukraine": "",
  "sources": [
   {
    "tier": "B",
    "name": "Prokuratura Krajowa: Akt oskarżenia w sprawie podpaleń obiektów wielkopowierzchniowych na rzecz wywiadu Federacji Rosyjskiej",
    "date": "2026-04-02",
    "url": "https://www.gov.pl/web/prokuratura-krajowa/akt-oskarzenia-w-sprawie-podpalen-obiektow-wielkopowierzchniowych-na-rzecz-wywiadu-federacji-rosyjskiej"
   },
   {
    "tier": "C",
    "name": "LRT: Man sentenced in Lithuania over attack on behalf of Russian intelligence",
    "date": "2025-11-24",
    "url": "https://www.lrt.lt/en/news-in-english/19/2755273/man-sentenced-in-lithuania-over-attack-on-behalf-of-russian-intelligence"
   },
   {
    "tier": "C",
    "name": "The Defense Post: Lithuania says Russian military intelligence behind IKEA store arson",
    "date": "2025-03-18",
    "url": "https://thedefensepost.com/2025/03/18/lithuania-russian-arson/"
   }
  ],
  "group": "sab"
 },
 {
  "id": "apt28-spd-czechia-2024",
  "date": "2024-05-03",
  "country": "Germany",
  "lat": 52.499,
  "lon": 13.385,
  "category": "cyber",
  "title": "Germany and Czechia attribute APT28 campaign incl. SPD hack to GRU",
  "summary": "On 3 May 2024, Germany and Czechia attributed to GRU-linked APT28 a cyber campaign that exploited an Outlook vulnerability. In Germany, the campaign hit the SPD party headquarters from late December 2022, along with defence, logistics, aerospace and IT firms. Czech state institutions were also targeted. The EU and NATO issued supporting statements.",
  "status": "official",
  "established_by": "German Federal Government / Federal Ministry of the Interior (3 May 2024); Czech Ministry of Foreign Affairs (3 May 2024); EU High Representative and NATO statements the same day.",
  "latest": "Germany has since attributed further APT28 operations, including the August 2024 attack on air traffic control provider DFS (Dec 2025).",
  "link_to_ukraine": "The German government links the timing of the campaign to its support for Ukraine (start of 2023).",
  "sources": [
   {
    "tier": "B",
    "name": "German Federal Ministry of the Interior – Cyber attacks traced to Russian military intelligence agency",
    "date": "2024-05-03",
    "url": "https://bmi.bund.de/SharedDocs/kurzmeldungen/EN/2024/05/schutzmassnahmen-cyberangriffe-en.html"
   },
   {
    "tier": "B",
    "name": "Czech Ministry of Foreign Affairs – Statement of the MFA on the cyberattacks",
    "date": "2024-05-03",
    "url": "https://mzv.gov.cz/jnp/en/issues_and_press/press_releases/statement_of_the_mfa_on_the_cyberattacks.html"
   },
   {
    "tier": "C",
    "name": "Security Affairs – NATO and the EU formally condemned Russia-linked APT28 cyber espionage",
    "date": "2024-05-03",
    "url": "https://securityaffairs.com/162759/apt/nato-eu-condemned-apt28-espionage.html"
   }
  ],
  "group": "cyber"
 },
 {
  "id": "frankfurt-ukrainian-veteran-plot-2024",
  "date": "2024-05",
  "country": "Germany",
  "lat": 50.1109,
  "lon": 8.6821,
  "category": "plot",
  "title": "Alleged Russian intelligence plot targeting Ukrainian veteran in Frankfurt",
  "summary": "German federal prosecutors charged three men (an Armenian, a Ukrainian and a Russian national) with acting for a Russian intelligence service by trying to lure a Ukrainian army veteran living in Germany to a Frankfurt café in 2024 to identify and surveil him. Prosecutors said the operation was presumably preparation for further intelligence operations, 'possibly even leading to killing'. The men were arrested in June 2024; trial began in December 2025.",
  "status": "charged",
  "established_by": "German Federal Prosecutor, indictment of 16 May 2025 (announced 28 May 2025): Vardges I. allegedly received the order from a Russian intelligence service in early May 2024 and recruited Robert A. and Arman S. Trial opened 9 Dec 2025.",
  "latest": "Trial under way since December 2025; no verdict located as of Oct 2026.",
  "link_to_ukraine": "The target had fought in Ukraine's armed forces after February 2022.",
  "sources": [
   {
    "tier": "B",
    "name": "German Federal Prosecutor's charges, as reported by Euronews",
    "date": "2025-05-28",
    "url": "https://www.euronews.com/my-europe/2025/05/28/germany-charges-three-with-spying-for-russia-with-possible-intent-to-kill-prosecutor-says"
   },
   {
    "tier": "C",
    "name": "The Local Germany: Three suspected Russian spies face trial in Germany",
    "date": "2025-12-09",
    "url": "https://www.thelocal.de/20251209/three-suspected-russian-spies-face-trial-in-germany"
   }
  ],
  "group": "kill"
 },
 {
  "id": "zelensky-rzeszow-plot-2024",
  "date": "2024-04",
  "country": "Poland",
  "lat": 50.11,
  "lon": 22.019,
  "category": "plot",
  "title": "Polish man convicted of offering Rzeszów airport intel to Russian GRU",
  "summary": "Polish national Paweł K. was arrested in April 2024 for offering Russian military intelligence security information about Rzeszów-Jasionka airport, the main hub for Western aid to Ukraine. Prosecutors said the information could have been used by Russian services in planning a possible attack on President Volodymyr Zelensky; no attack took place.",
  "status": "court",
  "established_by": "On 29 January 2026 the Zamość District Court convicted him of espionage on behalf of Russian intelligence and illegal weapons possession; the assassination-planning link is the prosecution's allegation, not a court finding that a plot existed.",
  "latest": "Sentenced to 3 years 6 months; the verdict was not final as of the National Prosecutor's Office announcement of 3 February 2026.",
  "link_to_ukraine": "The alleged target was President Zelensky and the scouted site is the principal logistics hub for military aid to Ukraine.",
  "sources": [
   {
    "tier": "B",
    "name": "Polish National Prosecutor's Office – conviction of Paweł K. to 3 years 6 months for espionage for Russia",
    "date": "2026-02-03",
    "url": "https://www.gov.pl/web/prokuratura-krajowa/wyrok-skazujacy-pawla-k-na-kare-3-lat-i-6-miesiecy-za-szpiegostwo-wobec-rosji"
   },
   {
    "tier": "C",
    "name": "Euromaidan Press – Poland convicts man who scouted Zelenskyy's route for Russian assassins",
    "date": "2026-02-04",
    "url": "https://euromaidanpress.com/2026/02/04/poland-convicts-man-zelenskyy-assassination-plot/"
   }
  ],
  "group": "kill"
 },
 {
  "id": "germany-dieter-s-sabotage-plot-2024",
  "date": "2024-04",
  "country": "Germany",
  "lat": 49.948,
  "lon": 11.578,
  "category": "terror-plot",
  "title": "Bayreuth sabotage plot (Dieter S.) for Russian intelligence",
  "summary": "German-Russian national Dieter S., arrested in Bayreuth in April 2024, scouted US military facilities, a rail loading station and an arms-related manufacturer in Bavaria and discussed explosive and arson attacks for a Russian intelligence service. Two accomplices assisted him.",
  "status": "court",
  "established_by": "Federal Prosecutor General indicted three defendants on 9 Dec 2024 (press release 30 Dec 2024); Munich Higher Regional Court (OLG München) sentenced Dieter S. to six years on 30 Oct 2025; accomplices received suspended sentences.",
  "latest": "First-instance verdict of 30 Oct 2025; finality/appeal status not confirmed in available sources.",
  "link_to_ukraine": "Prosecutors said the planned attacks aimed to undermine German military support for Ukraine.",
  "sources": [
   {
    "tier": "B",
    "name": "Generalbundesanwalt: Indictment for espionage and sabotage on behalf of Russian intelligence",
    "date": "2024-12-30",
    "url": "https://www.generalbundesanwalt.de/SharedDocs/Pressemitteilungen/EN/2024/Pressemitteilung-vom-30-12-2024-engl.html"
   },
   {
    "tier": "C",
    "name": "The Local: German-Russian jailed for six years in Munich sabotage trial",
    "date": "2025-10-30",
    "url": "https://www.thelocal.de/20251030/german-russian-jailed-for-six-years-in-munich-sabotage-trial"
   }
  ],
  "group": "sab"
 },
 {
  "id": "tartu-gps-jamming-2024",
  "date": "2024-04",
  "country": "Estonia",
  "lat": 58.307,
  "lon": 26.69,
  "category": "gnss",
  "title": "GPS jamming forces Finnair to suspend Helsinki–Tartu flights",
  "summary": "In late April 2024, two Finnair flights had to abort approaches to Tartu after GPS interference. Finnair then suspended the route for a month. On 8 May 2024, Estonia summoned Russia's chargé d'affaires, and its foreign minister called the jamming 'an element of Russia's hybrid activities'.",
  "status": "official",
  "established_by": "Estonian Ministry of Foreign Affairs, 8 May 2024 (summoning of Russian chargé d'affaires); joint Baltic foreign ministers' warnings (Apr 2024).",
  "latest": "The wider issue was taken to ICAO, which in 2025 found recurring GNSS interference originating from Russia.",
  "link_to_ukraine": "",
  "sources": [
   {
    "tier": "B",
    "name": "Estonian MFA – Foreign Ministry summons Russia's chargé d'affaires over GPS signal interference",
    "date": "2024-05-08",
    "url": "https://vm.ee/en/news/foreign-ministry-summons-russias-charge-daffaires-over-gps-signal-interference"
   },
   {
    "tier": "C",
    "name": "ERR News – Finnair suspends flights to Tartu for 1 month to seek GPS jamming solution",
    "date": "2024-04-29",
    "url": "https://news.err.ee/1609328058/finnair-suspends-flights-to-tartu-for-1-month-to-seek-gps-jamming-solution"
   }
  ],
  "group": "infra"
 },
 {
  "id": "uk-leyton-warehouse-arson-2024",
  "date": "2024-03-20",
  "country": "United Kingdom",
  "lat": 51.565,
  "lon": -0.012,
  "category": "arson",
  "title": "Leyton warehouse arson on Wagner Group orders",
  "summary": "Two units of a Ukrainian-owned business in Leyton, east London, holding supplies for Ukraine, were set alight on 20 March 2024, causing about £1 million in damage. Organiser Dylan Earl had been in contact with the Wagner Group, acting on behalf of the Russian state.",
  "status": "court",
  "established_by": "Central Criminal Court (Old Bailey): convictions in 2025 including the first under the National Security Act 2023 (Earl, Reeves); sentencing of six men on 24 Oct 2025 announced by Counter Terrorism Policing.",
  "latest": "Six defendants sentenced on 24 Oct 2025 (Earl 23 years total, 17 in custody).",
  "link_to_ukraine": "Targeted a Ukrainian-owned business storing aid and supplies for Ukraine.",
  "sources": [
   {
    "tier": "B",
    "name": "Counter Terrorism Policing: Men who organised Russia-backed arson at London warehouse jailed",
    "date": "2025-10-24",
    "url": "https://www.counterterrorism.police.uk/?p=31558"
   },
   {
    "tier": "C",
    "name": "Al Jazeera: UK court convicts 3 men of arson in attack linked to Russia's Wagner Group",
    "date": "2025-07-09",
    "url": "https://www.aljazeera.com/news/2025/7/9/uk-court-convicts-3-men-of-arson-in-attack-linked-to-russias-wagner-group"
   }
  ],
  "group": "sab"
 },
 {
  "id": "kuzminov-villajoyosa-2024",
  "date": "2024-02-13",
  "country": "Spain",
  "lat": 38.5075,
  "lon": -0.2333,
  "category": "assassination",
  "title": "Russian defector pilot Maksim Kuzminov shot dead in Spain",
  "summary": "Maksim Kuzminov, a Russian military helicopter pilot who defected to Ukraine in 2023, was shot several times and killed in a residential complex in Villajoyosa (Alicante) on 13 February 2024.",
  "status": "suspected",
  "established_by": "No court or government has formally attributed the killing; Russian state involvement has been alleged by unnamed Spanish intelligence sources (El País) and Western intelligence sources (Wall Street Journal, June 2024).",
  "latest": "A Villajoyosa investigating judge provisionally closed the case for lack of an identified perpetrator (order of September 2025, made public 9 December 2025); the case can be reopened if new evidence emerges.",
  "link_to_ukraine": "Kuzminov flew a Mi-8 helicopter to Ukraine in August 2023 in a defection operation organised by Ukrainian military intelligence (HUR).",
  "sources": [
   {
    "tier": "A",
    "name": "Spanish General Council of the Judiciary (CGPJ) – judge orders provisional dismissal for lack of known perpetrator",
    "date": "2025-12-09",
    "url": "https://www.poderjudicial.es/cgpj/es/Poder-Judicial/Noticias-Judiciales/La-juez-decreta-el-sobreseimiento-provisional-por-falta-de-autor-conocido-de-la-causa-en-la-que-se-investiga-el-asesinato-del-piloto-que-deserto-del-Ejercito-ruso"
   },
   {
    "tier": "C",
    "name": "Yevropeiska Pravda – Spain suspends investigation into murder of defector pilot",
    "date": "2025-12-10",
    "url": "https://www.eurointegration.com.ua/rus/news/2025/12/10/7226817/"
   }
  ],
  "group": "kill"
 },
 {
  "id": "estonia-interior-minister-car-attack-2023",
  "date": "2023-12",
  "country": "Estonia",
  "lat": 59.437,
  "lon": 24.745,
  "category": "sabotage",
  "title": "GRU-ordered attack on Estonian interior minister's car",
  "summary": "In December 2023 the car of Estonia's Minister of the Interior and a journalist's car were vandalised in Tallinn. Prosecutors established that organiser Allan Hantsom acted at the request and under instruction of Russia's GRU, alongside memorial vandalism attacks.",
  "status": "court",
  "established_by": "Harju County Court convicted Hantsom and co-defendants of intelligence activities against Estonia in 2024; Estonian Prosecutor's Office (5 Dec 2024) stated he acted on GRU instructions.",
  "latest": "Seven people convicted; Hantsom sentenced to 6.5 years per ERR; two GRU-linked organisers in Russia declared internationally wanted.",
  "link_to_ukraine": "",
  "sources": [
   {
    "tier": "B",
    "name": "Estonian Prosecutor's Office: Allan Hantsom organised the vandalising of the Ministry of the Interior's and a journalist's car at the request of GRU",
    "date": "2024-12-05",
    "url": "https://www.prokuratuur.ee/en/news/allan-hantsom-organised-vandalising-ministry-interiors-and-journalists-car-request-gru"
   },
   {
    "tier": "C",
    "name": "ERR News: Pro-Russian activist handed 6.5 year prison sentence",
    "date": "2024",
    "url": "https://news.err.ee/1609542394/pro-russian-activist-handed-6-5-year-prison-sentence-for-vandalizing-minister-s-car"
   }
  ],
  "group": "sab"
 },
 {
  "id": "uk-wagner-proscription-africa-corps",
  "date": "2023-09-15",
  "country": "Several countries",
  "lat": 51.5,
  "lon": -0.13,
  "category": "sanctions",
  "title": "UK proscribes Wagner (2023) and sanctions Africa Corps (2024)",
  "summary": "Wagner was proscribed as a terrorist organisation in the UK with effect from 15 September 2023; the Home Office cited its operations in Ukraine, Syria, CAR, Sudan, Libya, Mozambique and Mali and involvement in 'looting, torture and barbarous murders'. On 7 November 2024 the UK became the first G7 country to sanction Africa Corps, stating it has direct links to the Kremlin, threatens peace in Libya, Mali and CAR and has committed widespread human rights abuses; it also sanctioned Wagner-linked Officers Union for International Security.",
  "status": "official",
  "established_by": "UK Home Office proscription order (in force 15 September 2023); FCDO sanctions designations under the Libya (Sanctions) (EU Exit) Regulations 2020 and CAR regime (7 November 2024).",
  "latest": "In force. In 2024 a UK court sentenced Piotr Kucharski to two years and six months' custody for professing membership of the proscribed Wagner Group (CPS, 1 November 2024).",
  "link_to_ukraine": "The Home Office cited Wagner's operations in Ukraine as a threat to global security.",
  "sources": [
   {
    "tier": "B",
    "name": "GOV.UK: Russian Wagner Group declared terrorists",
    "date": "2023-09-06",
    "url": "https://www.gov.uk/government/news/russian-wagner-group-declared-terrorists"
   },
   {
    "tier": "B",
    "name": "GOV.UK: Wagner Group proscribed",
    "date": "2023-09-15",
    "url": "https://www.gov.uk/government/news/wagner-group-proscribed"
   },
   {
    "tier": "B",
    "name": "GOV.UK: UK strikes at heart of Putin's war machine",
    "date": "2024-11-07",
    "url": "https://www.gov.uk/government/news/uk-strikes-at-heart-of-putins-war-machine"
   },
   {
    "tier": "B",
    "name": "Crown Prosecution Service: Wagner Group supporter jailed for terrorist offences",
    "date": "2024-11-01",
    "url": "https://www.cps.gov.uk/cps/news/wagner-group-supporter-jailed-terrorist-offences"
   }
  ],
  "group": "pmc"
 },
 {
  "id": "car-gold-sanctions",
  "date": "2023-06-27",
  "country": "Central African Republic",
  "lat": 4.36,
  "lon": 18.56,
  "category": "sanctions",
  "title": "Wagner's CAR gold and diamond companies sanctioned (US, EU)",
  "summary": "US Treasury designated Midas Ressources (Ndassima gold mine), Diamville, Dubai-based Industrial Resources General Trading and Russia's OOO DM on 27 June 2023, stating the gold dealings funded Wagner 'to sustain and expand its armed forces, including in Ukraine and Africa'. Treasury added timber company Bois Rouge (March 2024) and Mining Industries SARLU (May 2024). The EU listed Lobaye Invest and Diamville on 25 February 2023 for illegal trade in gold and diamonds looted from local traders.",
  "status": "official",
  "established_by": "US Treasury OFAC designations (27 June 2023; 8 March 2024; 30 May 2024); EU Council listing under the Global Human Rights Sanctions Regime (25 February 2023).",
  "latest": "No delisting found as of October 2026.",
  "link_to_ukraine": "Treasury found CAR gold revenues helped fund Wagner forces including in Ukraine.",
  "sources": [
   {
    "tier": "B",
    "name": "US Treasury: Treasury Sanctions Illicit Gold Companies Funding Wagner Forces and Wagner Group Facilitator",
    "date": "2023-06-27",
    "url": "https://home.treasury.gov/news/press-releases/jy1581"
   },
   {
    "tier": "B",
    "name": "US Treasury: Treasury Sanctions Companies and Individuals Advancing Russian Malign Activities in Africa",
    "date": "2024-03-08",
    "url": "https://home.treasury.gov/news/press-releases/jy2164"
   },
   {
    "tier": "B",
    "name": "US Treasury: Treasury Sanctions Wagner Group-linked Companies in the Central African Republic",
    "date": "2024-05-30",
    "url": "https://home.treasury.gov/news/press-releases/jy2384"
   },
   {
    "tier": "A",
    "name": "Council of the EU press release, 25 February 2023",
    "date": "2023-02-25",
    "url": "https://www.consilium.europa.eu/en/press/press-releases/2023/02/25/wagner-group-council-adds-11-individuals-and-7-entities-to-eu-sanctions-lists/"
   }
  ],
  "group": "pmc"
 },
 {
  "id": "putin-wagner-state-funding",
  "date": "2023-06-27",
  "country": "Russia",
  "lat": 55.75,
  "lon": 37.62,
  "category": "state-link",
  "title": "Putin acknowledges Russian state fully funded Wagner",
  "summary": "On 27 June 2023, days after Wagner's mutiny, Vladimir Putin told Defence Ministry servicemen that the maintenance of the entire Wagner Group was fully provided for by the state, stating that from May 2022 to May 2023 it received over 86 billion rubles (about USD 1 billion). The statement contradicts Russia's earlier position that Wagner was a private entity unconnected to the state.",
  "status": "official",
  "established_by": "Public statement by the Russian head of state at a meeting with Defence Ministry servicemen, Kremlin transcript, 27 June 2023.",
  "latest": "After Prigozhin's death (23 August 2023), Wagner's Africa operations were brought under Defence Ministry control as 'Africa Corps', which the UK describes as having direct links to the Kremlin.",
  "link_to_ukraine": "State funding covered the period of Wagner's assault on Bakhmut and other Ukrainian cities.",
  "sources": [
   {
    "tier": "B",
    "name": "President of Russia (kremlin.ru): Meeting with Defence Ministry servicemen",
    "date": "2023-06-27",
    "url": "http://en.kremlin.ru/events/president/news/71535"
   },
   {
    "tier": "C",
    "name": "Lieber Institute (West Point): Putin admits to funding the Wagner Group",
    "date": "2023-06-30",
    "url": "https://lieber.westpoint.edu/?p=21419"
   },
   {
    "tier": "C",
    "name": "Semafor: Wagner Group was funded by Russia, Putin says",
    "date": "2023-06-27",
    "url": "https://semafor.com/article/06/27/2023/wagner-group-was-funded-by-russia-putin-says"
   }
  ],
  "group": "pmc"
 },
 {
  "id": "mali-wagner-sanctions-2023",
  "date": "2023-05-25",
  "country": "Mali",
  "lat": 12.64,
  "lon": -8.0,
  "category": "sanctions",
  "title": "US and EU sanction Wagner's Mali chief and Malian facilitators",
  "summary": "US Treasury designated Ivan Maslov, head of Wagner in Mali, on 25 May 2023, stating Wagner may route purchases of military equipment for use in Ukraine (mines, UAVs, radars, counter-battery systems) through Mali using false paperwork. On 24 July 2023 Treasury designated Mali's Defence Minister Col. Sadio Camara and two air-force officers for materially assisting Wagner, citing a reported 278% rise in civilian casualties after Wagner's arrival in December 2021. The EU listed the head of Wagner in Mali under its Mali regime on 25 February 2023 for violence and human rights abuses including extrajudicial killings.",
  "status": "official",
  "established_by": "US Treasury OFAC designations under E.O. 14024 (25 May and 24 July 2023); EU Council listing under the Mali autonomous sanctions framework (25 February 2023).",
  "latest": "No delisting found as of October 2026.",
  "link_to_ukraine": "Treasury stated Wagner sought to acquire weapons via Mali for use in Russia's war against Ukraine.",
  "sources": [
   {
    "tier": "B",
    "name": "US Treasury: Treasury Sanctions the Head of the Wagner Group in Mali",
    "date": "2023-05-25",
    "url": "https://home.treasury.gov/news/press-releases/jy1502"
   },
   {
    "tier": "B",
    "name": "US Treasury: Treasury Targets Malian Officials Facilitating Wagner Group",
    "date": "2023-07-24",
    "url": "https://home.treasury.gov/news/press-releases/jy1645"
   },
   {
    "tier": "A",
    "name": "Council of the EU: Wagner Group – Council adds 11 individuals and 7 entities to EU sanctions lists",
    "date": "2023-02-25",
    "url": "https://www.consilium.europa.eu/en/press/press-releases/2023/02/25/wagner-group-council-adds-11-individuals-and-7-entities-to-eu-sanctions-lists/"
   }
  ],
  "group": "pmc"
 },
 {
  "id": "poland-spy-ring-rail-derailment-plot-2023",
  "date": "2023-03",
  "country": "Poland",
  "lat": 50.04,
  "lon": 22.0,
  "category": "terror-plot",
  "title": "Polish spy ring plotting to derail Ukraine aid trains",
  "summary": "A network of 16 foreign nationals, detained from March 2023, installed cameras to monitor rail and air hubs including Rzeszów and prepared to derail trains carrying aid to Ukraine. Prosecutors indicted them for espionage on behalf of Russian intelligence; on 19 December 2023 a Lublin court convicted 14 of them (1–6 years), with two tried separately.",
  "status": "court",
  "established_by": "Polish Internal Security Agency (ABW) and prosecutors: indictment of 15 Nov 2023 for espionage on behalf of Russian intelligence and preparations to derail aid trains. Lublin District Court convicted 14 defendants on 19 Dec 2023 (1–6 years).",
  "latest": "14 convicted in Dec 2023 (appealable at the time); two defendants tried separately.",
  "link_to_ukraine": "Targeted rail transport of military and humanitarian aid to Ukraine via the Rzeszów hub.",
  "sources": [
   {
    "tier": "B",
    "name": "ABW: Akt oskarżenia w śledztwie dotyczącym siatki szpiegowskiej",
    "date": "2023-11-15",
    "url": "https://www.abw.gov.pl/pl/aktualnosci/2409,Akt-oskarzenia-w-sledztwie-dotyczacym-siatki-szpiegowskiej-dzialajacej-na-tereni.pdf"
   },
   {
    "tier": "C",
    "name": "Notes from Poland: Fourteen members of Russian spy ring sentenced",
    "date": "2023-12-19",
    "url": "https://notesfrompoland.com/2023/12/19/fourteen-members-of-russian-spy-ring-who-planned-to-derail-ukraine-aid-train-sentenced-in-poland/"
   }
  ],
  "group": "sab"
 },
 {
  "id": "us-wagner-tco-2023",
  "date": "2023-01-26",
  "country": "Several countries",
  "lat": 38.9,
  "lon": -77.04,
  "category": "sanctions",
  "title": "US designates Wagner a significant transnational criminal organization",
  "summary": "On 26 January 2023 US Treasury designated PMC Wagner as a significant transnational criminal organization under E.O. 13581, citing an ongoing pattern of serious criminal activity including mass executions, rape, child abductions and physical abuse in CAR and Mali, and redesignated it under E.O. 13667 for conduct in CAR. The same action targeted Wagner-linked entities including Sewa Security Services, Kratol Aviation (aircraft moving personnel between CAR, Libya and Mali) and Valery Zakharov.",
  "status": "official",
  "established_by": "US Treasury OFAC, 26 January 2023 (earlier designations: June 2017 under E.O. 13660; State Dept., November 2022 under E.O. 14024).",
  "latest": "No revocation found as of October 2026.",
  "link_to_ukraine": "Wagner was first sanctioned by the US in 2017 for actions in Ukraine and fought there through 2023.",
  "sources": [
   {
    "tier": "B",
    "name": "US Treasury: Treasury Sanctions Russian Proxy Wagner Group as a Transnational Criminal Organization",
    "date": "2023-01-26",
    "url": "https://home.treasury.gov/news/press-releases/jy1220"
   },
   {
    "tier": "B",
    "name": "OFAC Recent Actions, 26 January 2023",
    "date": "2023-01-26",
    "url": "https://ofac.treasury.gov/recent-actions/20230126"
   }
  ],
  "group": "pmc"
 },
 {
  "id": "mali-moura-2022",
  "date": "2022-03",
  "country": "Mali",
  "lat": 14.183,
  "lon": -4.467,
  "category": "pmc-abuse",
  "title": "Moura massacre: 500+ killed by Malian troops and foreign personnel",
  "summary": "During a five-day operation beginning 27 March 2022 in Moura (central Mali), OHCHR found strong indications that more than 500 people were killed, the vast majority summarily executed, and that at least 58 women and girls were raped or subjected to other sexual violence; it obtained names of at least 238 victims. Witnesses described 'armed white men' speaking an unknown language who operated alongside Malian forces, stayed for the whole operation and at times appeared to supervise; OHCHR did not name their nationality or unit. In January 2023 UN Special Procedures experts, including the Working Group on mercenaries, cited credible reports that Malian forces accompanied by personnel believed to belong to the Wagner Group executed several hundred people at Moura.",
  "status": "official",
  "established_by": "OHCHR fact-finding report on Moura, published 12 May 2023 (Malian authorities denied investigators access to the site); UN Special Procedures joint statement of 31 January 2023 calling for an independent investigation into possible international crimes by Government forces and 'Wagner group'.",
  "latest": "No independent or Malian judicial accountability process known as of 2026; Mali expelled MINUSMA (mandate ended 30 June 2023) and the UN Mali sanctions regime and Panel of Experts ended after Russia's veto on 30 August 2023.",
  "link_to_ukraine": "The Wagner Group deployed in Mali from December 2021 was the same organisation fighting in Ukraine at the time (incl. Bakhmut/Soledar).",
  "sources": [
   {
    "tier": "A",
    "name": "OHCHR press release: Malian troops, foreign military personnel killed over 500 people during military operation in Moura",
    "date": "2023-05-12",
    "url": "https://www.ohchr.org/en/press-releases/2023/05/malian-troops-foreign-military-personnel-killed-over-500-people-during"
   },
   {
    "tier": "A",
    "name": "OHCHR: Mali – UN experts call for independent investigation into possible international crimes committed by Government forces and 'Wagner group'",
    "date": "2023-01-31",
    "url": "https://www.ohchr.org/en/press-releases/2023/01/mali-un-experts-call-independent-investigation-possible-international-crimes"
   },
   {
    "tier": "A",
    "name": "UN News: Moura – Over 500 killed by Malian troops, foreign military personnel",
    "date": "2023-05-12",
    "url": "https://news.un.org/en/story/2023/05/1136607"
   }
  ],
  "group": "pmc"
 },
 {
  "id": "viasat-ka-sat-2022",
  "date": "2022-02-24",
  "country": "Several EU states",
  "lat": 50.5,
  "lon": 10.0,
  "category": "cyber",
  "title": "Russian cyberattack on Viasat KA-SAT network spills into EU",
  "summary": "About an hour before Russia's full-scale invasion of Ukraine on 24 February 2022, a cyberattack disabled terminals on Viasat's KA-SAT satellite network. Outages hit Ukraine and also several EU member states. The EU, UK and US attributed the attack to Russia in May 2022. The map point is a general marker for central Europe.",
  "status": "official",
  "established_by": "Declaration by the EU High Representative on behalf of the EU, 10 May 2022 ('conducted by the Russian Federation'), with parallel UK and US attributions.",
  "latest": "Attribution unchanged. The EU cites the attack as an example of spillover risk from attacks on Ukraine.",
  "link_to_ukraine": "The attack was designed to disrupt Ukrainian command and communications at the start of the invasion.",
  "sources": [
   {
    "tier": "A",
    "name": "EEAS – Russian cyber operations against Ukraine: Declaration by the High Representative on behalf of the EU",
    "date": "2022-05-10",
    "url": "https://www.eeas.europa.eu/delegations/ukraine/russian-cyber-operations-against-ukraine-declaration-high-representative-behalf_en"
   },
   {
    "tier": "B",
    "name": "Polish MFA – Statement condemning Russia for its cyberattacks against Ukraine",
    "date": "2022-05-10",
    "url": "https://www.gov.pl/web/diplomacy/mfa-statement-condemning-russia-for-its-cyberattacks-against-ukraine"
   }
  ],
  "group": "cyber"
 },
 {
  "id": "eu-wagner-sanctions",
  "date": "2021-12-13",
  "country": "Several countries",
  "lat": 50.84,
  "lon": 4.38,
  "category": "sanctions",
  "title": "EU lists Wagner Group for abuses in six countries",
  "summary": "On 13 December 2021 the EU listed the Wagner Group, eight individuals and three entities, finding Wagner responsible for serious human rights abuses including torture and extrajudicial, summary or arbitrary executions and killings in Ukraine, Syria, Libya, the Central African Republic, Sudan and Mozambique. On 25 February 2023 it added 11 individuals and 7 entities linked to Wagner in CAR, Sudan, Mali and Ukraine.",
  "status": "official",
  "established_by": "Council of the EU, Decision (CFSP) 2021/2197 and Regulation (EU) 2021/2194 (13 December 2021) under the Global Human Rights Sanctions Regime; further acts of 25 February 2023.",
  "latest": "Listings renewed; no delisting of Wagner found as of October 2026.",
  "link_to_ukraine": "The EU listing explicitly covers Wagner abuses in Ukraine alongside Africa and Syria.",
  "sources": [
   {
    "tier": "A",
    "name": "Council of the EU: EU imposes restrictive measures against the Wagner Group",
    "date": "2021-12-13",
    "url": "https://www.consilium.europa.eu/en/press/press-releases/2021/12/13/eu-imposes-restrictive-measures-against-the-wagner-group/"
   },
   {
    "tier": "A",
    "name": "EUR-Lex: Council Decision (CFSP) 2021/2197",
    "date": "2021-12-13",
    "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32021D2197"
   },
   {
    "tier": "A",
    "name": "Council of the EU: Wagner Group – Council adds 11 individuals and 7 entities",
    "date": "2023-02-25",
    "url": "https://www.consilium.europa.eu/en/press/press-releases/2023/02/25/wagner-group-council-adds-11-individuals-and-7-entities-to-eu-sanctions-lists/"
   }
  ],
  "group": "pmc"
 },
 {
  "id": "car-panel-of-experts-2021",
  "date": "2021-06-25",
  "country": "Central African Republic",
  "lat": 5.73,
  "lon": 20.06,
  "category": "pmc-abuse",
  "title": "UN Panel: 'Russian instructors' committed IHL violations in CAR",
  "summary": "The UN Panel of Experts on CAR reported that international humanitarian law violations by FACA soldiers and Russian instructors included excessive use of force, indiscriminate killings, occupation of schools and large-scale looting. It documented excessive force in Grimari on 28 December 2020 (3 civilians killed, 15 wounded) and unarmed civilians shot in Ippy, Bodol, Grimari and Kradé, and rejected Russia's claim that its instructors did not take part in operations. The Panel used the term 'Russian instructors' rather than Wagner; their coordinator said they were recruited by the Russian MoD via the Officers Union for International Security.",
  "status": "official",
  "established_by": "Final report of the UN Security Council Panel of Experts on CAR, S/2021/569 (transmitted 25 June 2021).",
  "latest": "Later Panel report S/2024/444 described an attack near Sam Ouandja carried out by Russian instructors alone. The Officers Union for International Security was sanctioned by the UK in November 2024.",
  "link_to_ukraine": "",
  "sources": [
   {
    "tier": "A",
    "name": "UN Panel of Experts on CAR, final report S/2021/569 (via ecoi.net)",
    "date": "2021-06-25",
    "url": "https://www.ecoi.net/en/file/local/2054767/S_2021_569_E.pdf"
   },
   {
    "tier": "C",
    "name": "Armed Groups and International Law: The Wagner Group and UN sanctions – inconsistent reporting?",
    "date": "2025-06-05",
    "url": "https://www.armedgroups-internationallaw.org/2025/06/05/the-wagner-group-and-un-sanctions-inconsistent-reporting/"
   }
  ],
  "group": "pmc"
 },
 {
  "id": "car-un-experts-2021",
  "date": "2021-03-31",
  "country": "Central African Republic",
  "lat": 4.36,
  "lon": 18.56,
  "category": "pmc-abuse",
  "title": "CAR: UN experts link 'Russian trainers'/Wagner to grave abuses",
  "summary": "UN independent experts, including the Working Group on mercenaries, reported in March 2021 mass executions without trial, arbitrary detention, torture during interrogations, enforced disappearances and attacks on humanitarian workers by private military personnel operating alongside CAR forces, naming Sewa Security Services, Lobaye Invest SARLU and the Wagner Group. In October 2021 they said Wagner-linked 'Russian instructors' were violently harassing and intimidating civilians, peacekeepers, journalists and aid workers, with reported rape and sexual violence by Wagner officers, and noted a CAR Special Commission of Inquiry had found violations including by 'Russian instructors'.",
  "status": "official",
  "established_by": "UN Special Procedures (Working Group on mercenaries and others) joint statements of 31 March 2021 and 27 October 2021, after communications to the CAR Government.",
  "latest": "Russian personnel remain in CAR in 2026; the UN CAR arms embargo on the Government was lifted in 2024 (res. 2745). No accountability for these abuses reported.",
  "link_to_ukraine": "",
  "sources": [
   {
    "tier": "A",
    "name": "OHCHR: CAR – Experts alarmed by government's use of 'Russian trainers', close contacts with UN peacekeepers",
    "date": "2021-03-31",
    "url": "https://www.ohchr.org/en/press-releases/2021/03/car-experts-alarmed-governments-use-russian-trainers-close-contacts-un"
   },
   {
    "tier": "A",
    "name": "OHCHR: CAR – Russian Wagner Group harassing and intimidating civilians – UN experts",
    "date": "2021-10-27",
    "url": "https://www.ohchr.org/en/press-releases/2021/11/car-russian-wagner-group-harassing-and-intimidating-civilians-un-experts"
   }
  ],
  "group": "pmc"
 },
 {
  "id": "libya-wagner-panel-2021",
  "date": "2021-03-08",
  "country": "Libya",
  "lat": 31.13,
  "lon": 16.6,
  "category": "pmc-presence",
  "title": "UN Panel documents ChVK Wagner support to Haftar forces in Libya",
  "summary": "The UN Panel of Experts on Libya's final report S/2021/229 set out in detail the role of ChVK Wagner in support of Haftar-affiliated forces, including its command structure and MiG-29 and Su-24 aircraft operated under Wagner control, in a context it described as non-compliance with the UN arms embargo. Earlier Panel reporting (cited by HRW) estimated 800–1,200 Wagner operatives in Libya and dated their presence to October 2018.",
  "status": "official",
  "established_by": "UN Security Council Panel of Experts on Libya, final report S/2021/229 (8 March 2021).",
  "latest": "Panel report S/2024/914 found 'no substantial changes' in Wagner's activities after Prigozhin's death (Jufrah airbase, Brak al-Shati). No Wagner-linked person has been added to the UN Libya sanctions list; the UK sanctioned Africa Corps under its Libya regime in November 2024.",
  "link_to_ukraine": "",
  "sources": [
   {
    "tier": "A",
    "name": "Security Council Report: S/2021/229 – Final report of the Panel of Experts on Libya",
    "date": "2021-03-08",
    "url": "https://www.securitycouncilreport.org/un-documents/document/s-2021-229.php"
   },
   {
    "tier": "C",
    "name": "Armed Groups and International Law: The Wagner Group and UN sanctions",
    "date": "2025-06-05",
    "url": "https://www.armedgroups-internationallaw.org/2025/06/05/the-wagner-group-and-un-sanctions-inconsistent-reporting/"
   }
  ],
  "group": "pmc"
 },
 {
  "id": "bulgarian-spy-ring-uk-2020-2023",
  "date": "2020-12",
  "country": "United Kingdom",
  "lat": 52.6083,
  "lon": 1.7305,
  "category": "plot",
  "title": "UK-based Bulgarian spy ring targeting Kremlin critics convicted",
  "summary": "A UK-based ring led by Orlin Roussev carried out surveillance operations for Russian intelligence between 2020 and 2023, tracking investigative journalists Christo Grozev and Roman Dobrokhotov and others across Europe. Prosecutors showed the group discussed kidnapping Dobrokhotov and another target and a 'honeytrap' against Grozev; no attack was carried out.",
  "status": "court",
  "established_by": "Six Bulgarian nationals were convicted at the Old Bailey of spying offences (guilty pleas and 2025 jury verdicts); the CPS stated they acted on instructions relayed from Russian intelligence services via fugitive Wirecard executive Jan Marsalek.",
  "latest": "On 12 May 2025 the six were sentenced to terms ranging from about 5 to 10 years 8 months; Marsalek remains at large.",
  "link_to_ukraine": "",
  "sources": [
   {
    "tier": "B",
    "name": "Crown Prosecution Service – How prosecutors brought a Russian spy ring operating in the UK to justice",
    "date": "2025-05-12",
    "url": "https://www.cps.gov.uk/node/26051"
   },
   {
    "tier": "C",
    "name": "Meduza – London court imprisons six Bulgarian nationals for spying for Russia",
    "date": "2025-05-13",
    "url": "https://meduza.io/en/news/2025/05/13/london-court-imprisons-six-bulgarian-nationals-for-spying-for-russia-and-plotting-attacks-on-journalists-roman-dobrokhotov-and-christo-grozev"
   }
  ],
  "group": "kill"
 },
 {
  "id": "sudan-m-invest-gold",
  "date": "2020-07-15",
  "country": "Sudan",
  "lat": 15.5,
  "lon": 32.56,
  "category": "sanctions",
  "title": "Sudan: Prigozhin's M Invest/Meroe Gold sanctioned; Wagner arms to RSF",
  "summary": "US Treasury designated M Invest and its subsidiary Meroe Gold on 15 July 2020, stating M Invest served as a cover for Wagner forces in Sudan, held gold concessions since 2017 and developed plans for Omar al-Bashir to suppress protesters, including disinformation and staged public executions. The EU listed M Invest and Meroe Gold in February 2023. In May 2023 Treasury stated that Wagner has supplied surface-to-air missiles to Sudan's Rapid Support Forces.",
  "status": "official",
  "established_by": "US Treasury OFAC designations (15 July 2020); Treasury statement in Maslov designation (25 May 2023); EU Council listing (25 February 2023).",
  "latest": "Sanctions remain in force (no delisting found).",
  "link_to_ukraine": "Sudanese gold revenue is assessed by Treasury and the EU as a Wagner financing stream during the war against Ukraine.",
  "sources": [
   {
    "tier": "B",
    "name": "US Treasury: Treasury Targets Financier's Illicit Sanctions Evasion Activity",
    "date": "2020-07-15",
    "url": "https://home.treasury.gov/news/press-releases/sm1058"
   },
   {
    "tier": "B",
    "name": "US Treasury: Treasury Sanctions the Head of the Wagner Group in Mali (RSF missiles)",
    "date": "2023-05-25",
    "url": "https://home.treasury.gov/news/press-releases/jy1502"
   },
   {
    "tier": "A",
    "name": "Council of the EU press release, 25 February 2023",
    "date": "2023-02-25",
    "url": "https://www.consilium.europa.eu/en/press/press-releases/2023/02/25/wagner-group-council-adds-11-individuals-and-7-entities-to-eu-sanctions-lists/"
   }
  ],
  "group": "pmc"
 },
 {
  "id": "libya-tripoli-landmines",
  "date": "2020-06",
  "country": "Libya",
  "lat": 32.8,
  "lon": 13.25,
  "category": "pmc-abuse",
  "title": "Landmines and booby traps left in Tripoli suburbs linked to Wagner",
  "summary": "Human Rights Watch found that MON-50, MON-200 and OZM-72 mines, not previously recorded in Libya, were laid at 35 locations in Ain Zara (southern Tripoli) mapped on a tablet attributed to a Wagner operative, in areas where Wagner was present before its June 2020 withdrawal. The Libyan Mine Action Centre recorded 130 killed and 196 injured by mines and other explosive ordnance from May 2020 to March 2022, mostly civilians in Tripoli's southern suburbs. The UN Fact-Finding Mission on Libya (October 2021) said Haftar's forces and Wagner 'may have violated' the principle of proportionality.",
  "status": "suspected",
  "established_by": "Human Rights Watch investigation (31 May 2022) based on BBC-obtained tablet and field verification; UN Independent Fact-Finding Mission on Libya report A/HRC/48/83 (October 2021) on related IHL concerns.",
  "latest": "HRW urged the ICC to investigate; no charges known as of 2026.",
  "link_to_ukraine": "Russia's use of anti-personnel mines and booby traps in Ukrainian territories mirrors this pattern.",
  "sources": [
   {
    "tier": "A",
    "name": "UN Independent Fact-Finding Mission on Libya, report A/HRC/48/83 (via ReliefWeb)",
    "date": "2021-10-01",
    "url": "https://reliefweb.int/attachments/d5da7548-709e-382e-964c-2888ad717551/A-HRC-48-83-AUV-EN.pdf"
   },
   {
    "tier": "C",
    "name": "Human Rights Watch: Libya – Russia's Wagner Group set landmines near Tripoli",
    "date": "2022-05-31",
    "url": "https://www.hrw.org/news/2022/05/31/libya-russias-wagner-group-set-landmines-near-tripoli"
   }
  ],
  "group": "pmc"
 },
 {
  "id": "khangoshvili-berlin-2019",
  "date": "2019-08-23",
  "country": "Germany",
  "lat": 52.5258,
  "lon": 13.342,
  "category": "assassination",
  "title": "Zelimkhan Khangoshvili shot dead in Berlin's Kleiner Tiergarten",
  "summary": "Zelimkhan (Tornike) Khangoshvili, a Georgian citizen of Chechen ethnicity and former Second Chechen War commander, was shot dead in a Berlin park on 23 August 2019 by a gunman on a bicycle. One person was killed.",
  "status": "court",
  "established_by": "The Berlin Higher Regional Court (Kammergericht) on 15 December 2021 sentenced Russian national Vadim Krasikov (alias 'Vadim Sokolov') to life imprisonment, finding he acted on the orders of Russian central state authorities under a false identity prepared by the Russian state.",
  "latest": "Krasikov was released by Germany in the 1 August 2024 multinational prisoner exchange in Ankara; on 2 August 2024 the Kremlin acknowledged he is an FSB officer.",
  "link_to_ukraine": "",
  "sources": [
   {
    "tier": "A",
    "name": "Kammergericht Berlin press release on the 'Tiergarten murder' judgment",
    "date": "2021-12-15",
    "url": "https://www.berlin.de/gerichte/presse/pressemitteilungen-der-ordentlichen-gerichtsbarkeit/2021/pressemitteilung.1157896.php"
   },
   {
    "tier": "C",
    "name": "AP via PBS NewsHour – Russia acknowledges Kremlin operatives among those freed in prisoner swap",
    "date": "2024-08-02",
    "url": "https://www.pbs.org/newshour/world/russia-acknowledges-kremlin-operatives-were-among-citizens-freed-in-prisoner-swap"
   }
  ],
  "group": "kill"
 },
 {
  "id": "sturgess-amesbury-2018",
  "date": "2018-06-30",
  "country": "United Kingdom",
  "lat": 51.1726,
  "lon": -1.7806,
  "category": "poisoning",
  "title": "Dawn Sturgess killed by discarded Novichok in Amesbury",
  "summary": "Dawn Sturgess and Charlie Rowley were exposed in Amesbury in late June 2018 to Novichok concealed in a counterfeit perfume bottle discarded after the Salisbury attack. Sturgess died on 8 July 2018; Rowley survived after serious illness.",
  "status": "court",
  "established_by": "The statutory Dawn Sturgess Inquiry chaired by Lord Hughes (report published 4 December 2025) found a direct causal link between her death and the GRU's attempted assassination of Sergei Skripal, that the Novichok was brought from Russia, and that the operation was authorised by President Putin.",
  "latest": "Inquiry report published 4 December 2025; Counter Terrorism Policing states the investigation into her murder remains ongoing and no one has been charged over her death.",
  "link_to_ukraine": "",
  "sources": [
   {
    "tier": "A",
    "name": "Dawn Sturgess Inquiry (official website, final report)",
    "date": "2025-12-04",
    "url": "https://www.dawnsturgess.independent-inquiry.uk/"
   },
   {
    "tier": "B",
    "name": "UK Government press release on Dawn Sturgess Inquiry findings and GRU sanctions (mirror)",
    "date": "2025-12-04",
    "url": "https://www.globalsecurity.org/intell/library/news/2025/intell-251204-ukgov01.htm"
   },
   {
    "tier": "B",
    "name": "UK Counter Terrorism Policing – Salisbury & Amesbury Investigation",
    "date": "2021-09-21",
    "url": "https://www.counterterrorism.police.uk/?p=1015"
   },
   {
    "tier": "C",
    "name": "Bevan Brittan – Dawn Sturgess Inquiry final report published",
    "date": "2025-12-04",
    "url": "https://www.bevanbrittan.com/insights/articles/2025/dawn-sturgess-inquiry-final-report-published/"
   }
  ],
  "group": "kill"
 },
 {
  "id": "opcw-hague-gru-2018",
  "date": "2018-04",
  "country": "Netherlands",
  "lat": 52.091,
  "lon": 4.283,
  "category": "cyber",
  "title": "GRU close-access hacking attempt against OPCW disrupted in The Hague",
  "summary": "In April 2018, Dutch security services, working with the UK, disrupted a GRU (Unit 26165) operation to hack the Organisation for the Prohibition of Chemical Weapons' Wi-Fi network in The Hague. At the time, the OPCW was examining the Salisbury Novichok poisoning. The officers were expelled from the Netherlands.",
  "status": "official",
  "established_by": "Dutch government and UK government joint disclosure, 4 Oct 2018. The UK statement in The Hague named GRU Unit 26165. The four officers were later listed in EU cyber sanctions (Implementing Regulation (EU) 2020/1125). The US indictment of 4 Oct 2018 charged related GRU officers.",
  "latest": "EU sanctions remain in force.",
  "link_to_ukraine": "",
  "sources": [
   {
    "tier": "B",
    "name": "UK Government – Minister for Europe statement: attempted hacking of the OPCW by Russian military intelligence",
    "date": "2018-10-04",
    "url": "https://gov.uk/government/speeches/minister-for-europe-statement-attempted-hacking-of-the-opcw-by-russian-military-intelligence"
   },
   {
    "tier": "A",
    "name": "EUR-Lex – Council Implementing Regulation (EU) 2020/1125",
    "date": "2020-07-30",
    "url": "https://eur-lex.europa.eu/eli/reg_impl/2020/1125/oj/eng"
   },
   {
    "tier": "C",
    "name": "CBS News – Russia GRU cyberattack operation targeting OPCW",
    "date": "2018-10-04",
    "url": "https://cbsnews.com/news/russia-gru-cyberattack-operation-targeting-opcw-chemical-weapons-netherlands-2018-10-04"
   }
  ],
  "group": "cyber"
 },
 {
  "id": "skripal-salisbury-2018",
  "date": "2018-03-04",
  "country": "United Kingdom",
  "lat": 51.0688,
  "lon": -1.7945,
  "category": "poisoning",
  "title": "Novichok attack on Sergei and Yulia Skripal in Salisbury",
  "summary": "Former GRU officer Sergei Skripal and his daughter Yulia were poisoned with a Novichok nerve agent applied to the door handle of his Salisbury home on 4 March 2018. Both survived after critical illness; police officer Nick Bailey was also seriously poisoned.",
  "status": "court",
  "established_by": "UK prosecutors charged GRU officers 'Alexander Petrov' (Alexander Mishkin) and 'Ruslan Boshirov' (Anatoliy Chepiga) in September 2018 and 'Sergey Fedotov' (Denis Sergeev) in September 2021; the Dawn Sturgess Inquiry report (4 December 2025) found the attack was a GRU operation authorised by President Putin.",
  "latest": "The three charged GRU officers remain in Russia and have not been tried; on 4 December 2025 the UK sanctioned the GRU in its entirety and summoned the Russian ambassador.",
  "link_to_ukraine": "",
  "sources": [
   {
    "tier": "B",
    "name": "UK Counter Terrorism Policing – Salisbury & Amesbury Investigation (charges against Petrov, Boshirov, Fedotov)",
    "date": "2021-09-21",
    "url": "https://www.counterterrorism.police.uk/?p=1015"
   },
   {
    "tier": "B",
    "name": "UK Government press release 'UK cracks down on Russian intelligence agency authorised by Putin to target Skripals' (mirror)",
    "date": "2025-12-04",
    "url": "https://www.globalsecurity.org/intell/library/news/2025/intell-251204-ukgov01.htm"
   },
   {
    "tier": "A",
    "name": "Dawn Sturgess Inquiry (official website, final report)",
    "date": "2025-12-04",
    "url": "https://www.dawnsturgess.independent-inquiry.uk/"
   }
  ],
  "group": "kill"
 },
 {
  "id": "olympic-destroyer-2018",
  "date": "2018-02-09",
  "country": "South Korea",
  "lat": 37.37,
  "lon": 128.39,
  "category": "cyber",
  "title": "'Olympic Destroyer' attack on PyeongChang Winter Olympics",
  "summary": "On 9 February 2018, the Olympic Destroyer malware attacked IT systems of the PyeongChang Winter Olympics during the opening ceremony. A US indictment charges officers of GRU Unit 74455 (Sandworm) with the attack. The same indictment covers hack-and-leak operations against the 2017 French election and attacks in Georgia.",
  "status": "official",
  "established_by": "US federal grand jury indictment of six GRU Unit 74455 officers (returned 15 Oct 2020, announced 19 Oct 2020). The UK NCSC issued a parallel attribution the same day.",
  "latest": "The indictment is outstanding, and no defendants are in custody.",
  "link_to_ukraine": "The same GRU unit is charged with attacks on Ukraine's power grid and with NotPetya.",
  "sources": [
   {
    "tier": "B",
    "name": "US Department of Justice – Six Russian GRU officers charged",
    "date": "2020-10-19",
    "url": "https://www.justice.gov/opa/pr/six-russian-gru-officers-charged-connection-worldwide-deployment-destructive-malware-and"
   },
   {
    "tier": "B",
    "name": "GOV.UK: UK exposes series of Russian cyber attacks against Olympic and Paralympic Games",
    "date": "2020-10-19",
    "url": "https://www.gov.uk/government/news/uk-exposes-series-of-russian-cyber-attacks-against-olympic-and-paralympic-games"
   }
  ],
  "group": "cyber"
 },
 {
  "id": "notpetya-2017",
  "date": "2017-06-27",
  "country": "Worldwide",
  "lat": 55.69,
  "lon": 12.6,
  "category": "cyber",
  "title": "NotPetya destructive malware spreads worldwide",
  "summary": "NotPetya wiper malware was launched on 27 June 2017 through Ukrainian accounting software and spread worldwide. Companies across Europe, the US and elsewhere suffered heavy losses. The map point marks Copenhagen, home of Maersk, one of the most affected firms, and is illustrative only.",
  "status": "official",
  "established_by": "UK Foreign Office attribution to the Russian military (15 Feb 2018), with US and allied statements. EU Council sanctions of 30 July 2020 (Implementing Regulation (EU) 2020/1125) listed GRU's Main Centre for Special Technologies (GTsST, 'Sandworm'). US indictment of six GRU Unit 74455 officers (15 Oct 2020).",
  "latest": "EU cyber sanctions listings remain in force. The US indictment is outstanding, and no defendant is in custody.",
  "link_to_ukraine": "The attack started in Ukraine and was aimed mainly at Ukraine before spreading worldwide.",
  "sources": [
   {
    "tier": "A",
    "name": "EUR-Lex – Council Implementing Regulation (EU) 2020/1125 of 30 July 2020 (cyber-attacks sanctions)",
    "date": "2020-07-30",
    "url": "https://eur-lex.europa.eu/eli/reg_impl/2020/1125/oj/eng"
   },
   {
    "tier": "B",
    "name": "US Department of Justice – Six Russian GRU officers charged in connection with worldwide deployment of destructive malware",
    "date": "2020-10-19",
    "url": "https://www.justice.gov/opa/pr/six-russian-gru-officers-charged-connection-worldwide-deployment-destructive-malware-and"
   },
   {
    "tier": "C",
    "name": "MIT Technology Review – The UK says Russia was behind the huge NotPetya ransomware attack",
    "date": "2018-02-15",
    "url": "https://www.technologyreview.com/2018/02/15/241258/the-uk-says-russia-was-behind-the-huge-notpetya-ransomware-attack/"
   }
  ],
  "group": "cyber"
 },
 {
  "id": "syria-homs-2017",
  "date": "2017-06",
  "country": "Syria",
  "lat": 34.73,
  "lon": 36.72,
  "category": "pmc-abuse",
  "title": "Syria: EU attributes 2017 torture-killing of deserter to Wagner",
  "summary": "The EU found that Wagner commander Dmitriy Utkin personally ordered the torture and killing of a Syrian deserter in Homs in June 2017 and ordered it filmed, and listed Wagner member Stanislav Dychko as one of four participants. Separately, US Treasury designated Prigozhin-controlled Evro Polis in January 2018 for contracting with the Syrian Government to protect oil fields in exchange for 25% of production.",
  "status": "official",
  "established_by": "Council of the EU Decision (CFSP) 2021/2197 of 13 December 2021 (statements of reasons); US Treasury designation of Evro Polis, 26 January 2018 (without naming Wagner).",
  "latest": "Utkin died in the August 2023 plane crash with Prigozhin; no prosecution known. After the fall of the Assad government (December 2024) Russian presence in Syria was reduced.",
  "link_to_ukraine": "Wagner's Syria veterans and command (Utkin) led its operations in Ukraine.",
  "sources": [
   {
    "tier": "A",
    "name": "EUR-Lex: Council Decision (CFSP) 2021/2197 of 13 December 2021",
    "date": "2021-12-13",
    "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32021D2197"
   },
   {
    "tier": "B",
    "name": "US Treasury: Treasury Sanctions Additional Individuals and Entities in Connection with the Conflict in Ukraine and Russia's Occupation of Crimea",
    "date": "2018-01-26",
    "url": "https://home.treasury.gov/news/press-releases/sm0266"
   }
  ],
  "group": "pmc"
 },
 {
  "id": "gebrev-sofia-2015",
  "date": "2015-04",
  "country": "Bulgaria",
  "lat": 42.6977,
  "lon": 23.3219,
  "category": "poisoning",
  "title": "Poisoning of arms manufacturer Emilian Gebrev in Sofia",
  "summary": "Bulgarian arms manufacturer Emilian Gebrev, his son Hristo and a company executive fell seriously ill after being poisoned in Sofia in April 2015; all three survived. Bulgarian prosecutors also cite earlier attempts on Gebrev, two of them outside Bulgaria.",
  "status": "charged",
  "established_by": "The Sofia City Prosecutor's Office charged three Russian citizens in absentia with attempted murder (announced 23 January 2020; further details 21 February 2020), including 'Sergey Fedotov', identified by UK police as GRU officer Denis Sergeev, also charged over the Salisbury attack.",
  "latest": "No trial has taken place; the accused are believed to be in Russia, which does not extradite its nationals, and Bulgarian authorities have not formally attributed the operation to the Russian state as such.",
  "link_to_ukraine": "",
  "sources": [
   {
    "tier": "B",
    "name": "Prosecutor's Office of Bulgaria – press release on charges in the Gebrev case",
    "date": "2020-02-21",
    "url": "https://prb.bg/en/news/40243-press-release_24_02_2020"
   },
   {
    "tier": "B",
    "name": "Sofia City Prosecutor's Office – press release (indictment, identities, extradition barrier)",
    "date": "2020-09-15",
    "url": "https://www.prb.bg/en/news/45994-press-release-of-the-sofia-city-prosecutor's-office"
   },
   {
    "tier": "C",
    "name": "RFE/RL – Bulgarian survivor of suspected Russian poison attack decries suspended probe",
    "date": "2020-09-03",
    "url": "https://www.rferl.org/a/bulgarian-survivor-of-suspected-russian-poison-attack-decries-suspended-probe/30819349.html"
   }
  ],
  "group": "kill"
 },
 {
  "id": "bundestag-hack-2015",
  "date": "2015-04",
  "country": "Germany",
  "lat": 52.518,
  "lon": 13.376,
  "category": "cyber",
  "title": "GRU hack of the German Bundestag",
  "summary": "In April–May 2015, hackers broke into the German Bundestag's IT network and stole data, including from MPs' offices. The EU sanctioned GRU officer Dmitry Badin, GRU head Igor Kostyukov and GRU Unit 26165 (APT28) for the attack.",
  "status": "official",
  "established_by": "EU Council Decision (CFSP) 2020/1537 of 22 Oct 2020, adopting cyber sanctions over the Bundestag attack. Germany's Federal Prosecutor obtained an arrest warrant for Dmitry Badin (May 2020).",
  "latest": "EU sanctions remain in force. Badin is subject to a German arrest warrant and is not in custody.",
  "link_to_ukraine": "",
  "sources": [
   {
    "tier": "A",
    "name": "EUR-Lex – Council Decision (CFSP) 2020/1537",
    "date": "2020-10-22",
    "url": "https://eur-lex.europa.eu/eli/dec/2020/1537/oj"
   },
   {
    "tier": "C",
    "name": "RFE/RL – EU sanctions Russians over Bundestag hack",
    "date": "2020-10-22",
    "url": "https://www.rferl.org/a/30907514.html"
   }
  ],
  "group": "cyber"
 },
 {
  "id": "vrbetice-ammunition-depots-2014",
  "date": "2014-10-16",
  "country": "Czechia",
  "lat": 49.084,
  "lon": 17.958,
  "category": "explosion",
  "title": "Vrbětice ammunition depot explosions",
  "summary": "Two explosions at ammunition storage depots near Vrbětice (16 October and 3 December 2014) killed two employees and caused major material damage. Czech authorities attributed the blasts to officers of Russian military intelligence (GRU); the munitions were reportedly intended for onward sale abroad.",
  "status": "official",
  "established_by": "Czech government publicly attributed the blasts to GRU operatives on 17 April 2021 and expelled 18 Russian officials; NATO's North Atlantic Council expressed solidarity on 22 April 2021. On 29 April 2024 Czech police closed the case, calling GRU involvement a proven fact but unable to prosecute because Russia refused cooperation.",
  "latest": "Case closed by Czech police in April 2024 without indictment because of Russian non-cooperation; no trial possible. Two named suspects (Chepiga and Mishkin, also wanted by the UK over Salisbury) remain in Russia.",
  "link_to_ukraine": "Czech officials and media have said the stored munitions were probably destined for buyers abroad, possibly including Ukraine; this destination is not officially confirmed.",
  "sources": [
   {
    "tier": "B",
    "name": "NATO North Atlantic Council statement in solidarity with the Czech Republic",
    "date": "2021-04-22",
    "url": "https://nato.int/en/about-us/official-texts-and-resources/official-texts/2021/04/22/north-atlantic-council-statement-in-solidarity-with-the-czech-republic"
   },
   {
    "tier": "B",
    "name": "Czech MFA: Minister Kulhánek acquainted NATO allies with evidence of Russian agents' involvement",
    "date": "2021-04-22",
    "url": "https://mzv.gov.cz/jnp/en/issues_and_press/archive/events_and_issues/x2021/x2021_04_22_minister_kulhanek_acquainted_nato_allies.html"
   },
   {
    "tier": "B",
    "name": "Policie ČR: Ukončení prověřování výbuchů muničních skladů ve Vrběticích",
    "date": "2024-04-29",
    "url": "https://policie.gov.cz/clanek/ukonceni-proverovani-vybuchu-municnich-skladu-ve-vrbeticich.aspx"
   }
  ],
  "group": "sab"
 },
 {
  "id": "mh17-2014",
  "date": "2014-07-17",
  "country": "Ukraine (MH17)",
  "lat": 48.14,
  "lon": 38.65,
  "category": "aviation",
  "title": "Downing of Malaysia Airlines flight MH17",
  "summary": "Flight MH17 (Amsterdam–Kuala Lumpur) was shot down by a Russian Buk missile over occupied eastern Ukraine, killing all 298 people on board. A Dutch court, the ICAO Council and the European Court of Human Rights have each found Russia or persons under its control responsible. Included as an international aviation case although the crash site is in Ukraine.",
  "status": "court",
  "established_by": "District Court of The Hague (17 Nov 2022) convicted Girkin, Dubinskiy and Kharchenko of murder in absentia (life sentences), acquitted Pulatov, and found Russia had overall control of the 'DPR' at the time. ICAO Council (12 May 2025) held the Russian Federation responsible under the Chicago Convention. ECtHR Grand Chamber (9 July 2025, Ukraine and the Netherlands v. Russia) found violations of Articles 2, 3 and 13 over MH17.",
  "latest": "Dutch verdict final (prosecution did not appeal, Dec 2022). ICAO Council ordered reparations negotiations on 30 June 2025; Russia filed an appeal against that decision at the ICJ (Russian Federation v. Australia and Netherlands, announced 19 Sept 2025), pending. ECtHR reserved just satisfaction for MH17 for later decision.",
  "link_to_ukraine": "Occurred during Russia's armed aggression in eastern Ukraine; the Buk system belonged to Russia's 53rd Anti-Aircraft Missile Brigade per the JIT findings relied upon by the courts.",
  "sources": [
   {
    "tier": "A",
    "name": "District Court of The Hague – MH17 operative paragraphs",
    "date": "2022-11-17",
    "url": "https://www.courtmh17.com/en/news/2022/the-operative-paragraphs_english.html"
   },
   {
    "tier": "B",
    "name": "Netherlands Public Prosecution Service does not appeal MH17 judgment",
    "date": "2022-12-01",
    "url": "https://www.prosecutionservice.nl/latest/news/2022/12/1/netherlands-public-prosecution-service-does-not-appeal-the-judgement-in-criminal-case-mh17"
   },
   {
    "tier": "B",
    "name": "Government of the Netherlands: Russia responsible for downing of Flight MH17 (ICAO Council decision)",
    "date": "2025-05-12",
    "url": "https://www.government.nl/topics/mh17-incident/achieving-justice/russia-responsible-for-downing-of-flight-mh17"
   },
   {
    "tier": "A",
    "name": "Council of Europe: ECHR holds Russia accountable, including for downing of MH17",
    "date": "2025-07-09",
    "url": "https://www.coe.int/en/web/kyiv/-/the-echr-holds-russia-accountable-for-widespread-abuses-of-human-rights-arising-from-the-conflict-in-ukraine-since-2014-including-the-downing-of-flight-mh17"
   },
   {
    "tier": "A",
    "name": "ICJ: Russia files appeal against ICAO Council decision of 30 June 2025",
    "date": "2025-09-19",
    "url": "https://www.icj-cij.org/node/205720"
   }
  ],
  "group": "sab"
 },
 {
  "id": "bulgaria-arms-depot-explosions",
  "date": "2011-11-12",
  "country": "Bulgaria",
  "lat": 42.6436,
  "lon": 24.8072,
  "category": "explosion",
  "title": "Bulgarian arms depot explosions (2011–2020)",
  "summary": "Four explosions between 2011 and 2020 hit Bulgarian arms and ammunition facilities, including Lovnidol (2011), two blasts at VMZ-Sopot's Iganovo depot (2015) and the Arsenal plant near Maglizh. Bulgarian prosecutors charged six Russian nationals, who entered under false identities, with terrorism and issued European Arrest Warrants. Prosecutors said in 2021 the six were believed to be GRU agents and the case may be linked to the 2015 poisoning of arms dealer Emilian Gebrev.",
  "status": "charged",
  "established_by": "Bulgarian Prosecutor's Office, 28 Apr 2021: at least six Russians believed to be GRU agents were in Bulgaria around the blasts; prosecutors cited a 'reasonable assumption' of a link to the Gebrev poisoning and the 2014 Vrbětice blast. The six were charged in 2021 with terrorism (Art. 108a(1) Criminal Code); the Sofia City Prosecutor's Office reissued European Arrest Warrants on 30 Jan 2024.",
  "latest": "Suspects at large, not tried; EAWs reissued January 2024.",
  "link_to_ukraine": "",
  "sources": [
   {
    "tier": "B",
    "name": "Sofia City Prosecutor's Office: EAW issued against Russian nationals accused of terrorism",
    "date": "2024-01-30",
    "url": "https://prb.bg/en/news/68319-sofia-city-prosecutor%E2%80%99s-office-issued-eaw-against-russian-nationals-accused-of-t"
   },
   {
    "tier": "C",
    "name": "RFE/RL: Bulgaria to expel Russian diplomat over arms depot blasts",
    "date": "2021-04-29",
    "url": "https://www.rferl.org/a/bulgaria-to-expel-russian-diplomat-over-arms-depot-blasts/31229772.html"
   },
   {
    "tier": "C",
    "name": "Meduza: Connecting the dots",
    "date": "2021-04-28",
    "url": "https://meduza.io/en/feature/2021/04/28/connecting-the-dots"
   },
   {
    "tier": "C",
    "name": "Civil.ge: Bulgaria Alleges Russia Behind Georgia-Bound Arms Explosions",
    "date": "2021-04",
    "url": "https://civil.ge/?p=416765"
   }
  ],
  "group": "sab"
 },
 {
  "id": "yamadayev-dubai-2009",
  "date": "2009-03-28",
  "country": "United Arab Emirates",
  "lat": 25.078,
  "lon": 55.134,
  "category": "assassination",
  "title": "Killing of former Chechen commander Sulim Yamadayev in Dubai",
  "summary": "Sulim Yamadayev, a former Chechen battalion commander and rival of Ramzan Kadyrov, was shot dead in Dubai. Dubai's police chief publicly named Russian State Duma deputy Adam Delimkhanov, a Kadyrov relative, as the alleged organiser and said he was on Interpol's wanted list. Two accomplices were convicted in Dubai in 2010; Delimkhanov denied involvement and was never tried.",
  "status": "official",
  "established_by": "Dubai Police chief Lt Gen Dahi Khalfan Tamim, April 2009: said Delimkhanov masterminded the killing and that he was 'officially wanted by Interpol'. Dubai court, April 2010: convicted Mehdi Taqi Dahuria (Iran) and Makhsood Jan Asmatov (Tajikistan) of aiding the killing (life, reduced to 3 years on appeal in Dec 2010).",
  "latest": "Moscow Times reported in 2012 that Delimkhanov was removed from the Interpol list and that Dubai halted the search; he was never tried.",
  "link_to_ukraine": "",
  "sources": [
   {
    "tier": "B",
    "name": "Dubai Police chief statements, as reported by Jamestown Foundation North Caucasus Weekly",
    "date": "2009-04-17",
    "url": "https://jamestown.org/program/dubai-police-chief-reiterates-accusations-against-adam-delimkhanov/"
   },
   {
    "tier": "C",
    "name": "Dubai appeals court ruling, as reported by The Moscow Times ('Dubai cuts sentences in Yamadayev slaying')",
    "date": "2010-12-22",
    "url": "https://www.themoscowtimes.com/2010/12/22/dubai-cuts-sentences-in-yamadayev-slaying-a3943"
   },
   {
    "tier": "C",
    "name": "The Moscow Times: Deputy off Interpol list",
    "date": "2012-01-23",
    "url": "https://www.themoscowtimes.com/2012/01/23/deputy-off-interpol-list-a12089"
   },
   {
    "tier": "C",
    "name": "The Moscow Times: Dubai halts search for Delimkhanov",
    "date": "2012-07-19",
    "url": "https://www.themoscowtimes.com/2012/07/19/dubai-halts-search-for-delimkhanov"
   }
  ],
  "group": "kill"
 },
 {
  "id": "israilov-vienna-2009",
  "date": "2009-01-13",
  "country": "Austria",
  "lat": 48.2566,
  "lon": 16.3995,
  "category": "assassination",
  "title": "Killing of Kadyrov critic Umar Israilov in Vienna",
  "summary": "Umar Israilov, a former Kadyrov bodyguard who had filed a complaint against Ramzan Kadyrov at the ECtHR, was shot dead in Vienna in a failed kidnapping. In June 2011 a Vienna court convicted three men, including the group's leader, who received life imprisonment. Austrian investigators believed, largely on circumstantial evidence, that Kadyrov, head of the Russian Federation's Chechen Republic, ordered the kidnapping; he denied it and was not charged.",
  "status": "official",
  "established_by": "Vienna court verdict, June 2011: Otto Kaltenbrunner (life), Suleiman Dadayev (19 yrs), Turpal Ali Yeshurkayev (16 yrs) convicted. Link to Kadyrov rests on Austrian investigators' assessment; the court's attempt to hear Kadyrov by video link failed.",
  "latest": "Convictions stand; no charges against Kadyrov or other Russian officials.",
  "link_to_ukraine": "",
  "sources": [
   {
    "tier": "C",
    "name": "Vienna court verdict, as reported by The Moscow Times ('Vienna jails 3 in killing of Kadyrov foe')",
    "date": "2011-06-02",
    "url": "https://www.themoscowtimes.com/2011/06/02/vienna-jails-3-in-killing-of-kadyrov-foe-a7370"
   },
   {
    "tier": "C",
    "name": "VOA: Austrian Court Convicts 3 in Chechen's Murder",
    "date": "2011-06-01",
    "url": "https://blogs.voanews.com/breaking-news/2011/06/01/austrian-court-convicts-3-in-chechens-murder"
   },
   {
    "tier": "C",
    "name": "FIDH: Israilov case — Trial in Vienna",
    "date": "2011",
    "url": "https://www.fidh.org/en/region/europe-central-asia/russia/chechnya/Israilov-case-Trial-in-Vienna-The"
   }
  ],
  "group": "kill"
 },
 {
  "id": "estonia-cyberattacks-2007",
  "date": "2007-04-27",
  "country": "Estonia",
  "lat": 59.437,
  "lon": 24.7536,
  "category": "cyber",
  "title": "Mass DDoS cyberattacks on Estonia after Bronze Soldier relocation",
  "summary": "From late April to mid-May 2007, during the dispute over relocating the Soviet war memorial in Tallinn, Estonian government, media and banking websites were hit by large-scale distributed denial-of-service attacks. Estonia's foreign minister said part of the traffic came from Russian state IP addresses; Russia denied involvement and refused investigative cooperation. The only conviction was of an Estonian resident; no Russian state actor has been charged.",
  "status": "official",
  "established_by": "Estonian Foreign Minister Urmas Paet, press conference 1 May 2007: Estonia had proof attacks came from 'IP addresses of governmental authorities of Russia' (reported speech); later accused the Kremlin of direct involvement. Defence Minister Jaak Aaviksoo later said he could not state for certain the attacks were managed by the Kremlin.",
  "latest": "Single conviction: Tallinn student Dmitri Galushkevich fined 17,500 kroons on 24 Jan 2008 for attacking the Reform Party website. A Nashi activist claimed involvement in 2009. The attacks led to the NATO CCDCOE being established in Tallinn (May 2008).",
  "link_to_ukraine": "",
  "sources": [
   {
    "tier": "B",
    "name": "Estonian Foreign Minister Urmas Paet press conference, as reported by Delfi (via eesti.ca)",
    "date": "2007-05-02",
    "url": "https://www.eesti.ca/paet-russia-attacks-estonia-and-the-european-union-delfi/article16198"
   },
   {
    "tier": "C",
    "name": "Christian Science Monitor: Estonia accuses Russia of 'cyberattack'",
    "date": "2007-05-17",
    "url": "https://csmonitor.com/2007/0517/p99s01-duts.html"
   },
   {
    "tier": "C",
    "name": "Baltic Times: Kremlin denies involvement in cyber attacks on Estonia",
    "date": "2007-05",
    "url": "https://www.baltictimes.com/news/articles/17908"
   },
   {
    "tier": "C",
    "name": "InformationWeek: Estonian Hacker Fined For Cyber Attack",
    "date": "2008-01",
    "url": "https://www.informationweek.com/cyber-resilience/estonian-hacker-fined-for-cyber-attack"
   }
  ],
  "group": "cyber"
 },
 {
  "id": "litvinenko-london-2006",
  "date": "2006-11-01",
  "country": "United Kingdom",
  "lat": 51.5113,
  "lon": -0.152,
  "category": "assassination",
  "title": "Alexander Litvinenko poisoned with polonium-210 in London",
  "summary": "Former FSB officer Alexander Litvinenko, a British citizen, was poisoned with radioactive polonium-210 at a London hotel on 1 November 2006 and died on 23 November 2006. One victim died; polonium contamination was found at multiple sites in London.",
  "status": "court",
  "established_by": "The UK statutory Litvinenko Inquiry (report of 21 January 2016) found Andrei Lugovoy and Dmitry Kovtun killed him in an FSB operation probably approved by Nikolai Patrushev and President Putin; the ECtHR (Carter v. Russia, no. 20914/07, 21 September 2021) held Russia responsible for the killing under Article 2.",
  "latest": "Russia has not surrendered the suspects or complied with the ECtHR judgment; no criminal trial has been possible.",
  "link_to_ukraine": "",
  "sources": [
   {
    "tier": "A",
    "name": "UK Home Office / The Litvinenko Inquiry: report into the death of Alexander Litvinenko",
    "date": "2016-01-21",
    "url": "https://www.gov.uk/government/publications/the-litvinenko-inquiry-report-into-the-death-of-alexander-litvinenko"
   },
   {
    "tier": "A",
    "name": "ECtHR, Carter v. Russia (no. 20914/07), judgment (PDF copy)",
    "date": "2021-09-21",
    "url": "https://www.courthousenews.com/wp-content/uploads/2021/09/echr-carter-russia.pdf"
   },
   {
    "tier": "A",
    "name": "ECtHR HUDOC entry, Carter v. Russia",
    "date": "2021-09-21",
    "url": "https://hudoc.echr.coe.int/eng?i=001-211972"
   }
  ],
  "group": "kill"
 },
 {
  "id": "yandarbiyev-doha-2004",
  "date": "2004-02-13",
  "country": "Qatar",
  "lat": 25.2854,
  "lon": 51.531,
  "category": "assassination",
  "title": "Car-bomb killing of Zelimkhan Yandarbiyev in Doha",
  "summary": "Former Chechen separatist leader Zelimkhan Yandarbiyev was killed by a car bomb in Doha; his 14-year-old son was wounded. In June 2004 a Qatari court convicted two Russian intelligence officers of the murder, attempted murder and arms smuggling. Qatar handed them over to Russia in December 2004 to serve their sentences there.",
  "status": "court",
  "established_by": "Doha criminal court, 30 June 2004: convicted two Russian intelligence agents (Anatoly Belashkov/Bilashkov and Vasily Bogachev/Pokchov, spellings vary); Judge Ibrahim al-Nisf said the evidence showed the killing was directed from Moscow. Russia denied involvement.",
  "latest": "Convicts transferred to Russia in December 2004 under a bilateral accord; Al Jazeera reported in February 2005 they were no longer in prison in Russia.",
  "link_to_ukraine": "",
  "sources": [
   {
    "tier": "C",
    "name": "Doha court verdict, as reported by Al Jazeera ('Qatar finds Russian agents guilty of murder')",
    "date": "2004-06-30",
    "url": "https://www.aljazeera.com/news/2004/6/30/qatar-finds-russian-agents-guilty-of-murder"
   },
   {
    "tier": "C",
    "name": "Arab News: Qatari Court Jails Russian Agents Over Yandarbiyev Murder",
    "date": "2004-06-30",
    "url": "https://www.arabnews.com/node/251841"
   },
   {
    "tier": "B",
    "name": "Qatari foreign ministry announcement, as reported by Al Jazeera ('Qatar to hand over two jailed Russians')",
    "date": "2004-12-24",
    "url": "https://www.aljazeera.com/news/2004/12/24/qatar-to-hand-over-two-jailed-russians"
   },
   {
    "tier": "C",
    "name": "Al Jazeera: Chechen leader's killers free in Russia",
    "date": "2005-02-16",
    "url": "https://www.aljazeera.com/news/2005/2/16/chechen-leaders-killers-free-in-russia"
   }
  ],
  "group": "kill"
 }
]