Brussels has renewed its hybrid-threat sanctions for a year and is now weighing direct limits on Russian diplomats, the platform from which such operations are widely assessed to be run.
Intelligence Lead
The European Union is moving from sanctioning individuals and entities toward constraining the diplomatic presence that counterintelligence services regard as the enabling layer of Russian sabotage in Europe. The Council on 8 October extended its hybrid-activity sanctions regime to 9 October 2027, and draft conclusions for next week's leaders' summit state that Russia's actions "will not remain unanswered." If adopted, curbs on diplomatic movement would raise the operating cost of Russian intelligence officers working under official cover.
Situation Report
The European Council confirmed on 8 October that it had extended its sanctions framework against those held responsible for Russia's hybrid activities by one year. The regime covers 80 individuals and 20 entities, who face asset freezes and EU entry or transit bans. The Council said Russia is "continuing and intensifying" foreign information manipulation and interference aimed at the Union, its member states and partners. The listings themselves were not itemised in the reporting reviewed.
Euronews reported on 6 October, citing senior diplomats, that tighter checks on Russian diplomats are being discussed as a potential next step. The draft leaders' conclusions promise that the Union and its members will "act resolutely and in a coordinated manner." The discussions are described as early stage, and no deadline for new restrictions has been published.
The political pressure follows specific incidents. Hungary expelled 10 Russian diplomats in September for behaviour it called unacceptable under the 1961 Vienna Convention, and Moscow responded in kind. Estonia's Internal Security Service announced on 29 September that an overnight arson attack on 15 August against Milrem Robotics in Tallinn was a "deliberate and pre-planned act commissioned by Russian security services." Milrem supplies THeMIS unmanned ground vehicles to Ukraine. Two Latvian suspects were detained in Latvia on 17 August and a third the following day, and all were handed to Estonia. Kremlin spokesman Dmitry Peskov called the accusation "unfounded." Separately, an unexploded drone found at Leipzig Airport has been linked to Russia in reporting, though attribution there remains unconfirmed.
Background & Context
Since 2022 European services have documented a pattern in which Russian intelligence outsources physical sabotage to locally recruited intermediaries, often paid through messaging applications, to preserve deniability. The Milrem case fits that profile: Latvian nationals were detained, while tasking is attributed to Russian security services by the Estonian service on the basis of modus operandi. The public evidence offered so far is thin, which is typical of attributions that rest on classified collection.
The EU already requires Russian diplomats to notify any intended travel or transit through another member state at least 24 hours in advance. The requirement, part of the 19th sanctions package in force since January 2026, covers all ranks and family members. It provides visibility but does not restrict movement. Member states may require transit authorisation, and only two have done so. The Commission itself says experience with the system is limited.
The constraint on any tougher approach is legal and diplomatic. The Vienna Convention grants broad protections to accredited diplomats, and reciprocal Russian measures can degrade European embassies in Moscow, which also serve as collection platforms.
Analysis & Assessment
It is assessed with moderate confidence that Brussels has concluded sanctions on proxies and facilitators are not degrading the campaign, and that the residents of Russian missions are the more productive pressure point. Listing 100 targets over time has not demonstrably halted attacks, whereas movement controls and expulsions strike at case officers, who cannot be easily replaced at scale.
Binding EU-wide restrictions remain uncertain. National divisions were visible in September, when the removal of two oligarchs from sanctions strained unity, and several capitals will resist measures that invite retaliation. The more probable outcome is a coordinated tightening of transit authorisation and a further round of bilateral expulsions, rather than a uniform regime.
A competing explanation should be weighed: that the rhetoric serves domestic political signalling ahead of the summit. The concrete Hungarian and Estonian actions argue against reading it as purely rhetorical, but the absence of published evidence in the Milrem attribution means the public cannot independently test the claim.