Eleanor Danby 
Montenegrin police detained Mikhail Zvinchuk, founder of the pro-Kremlin military blog Rybar, in Risan on 9 October — the first arrest of a central propaganda figure since European governments began naming Russia for hybrid attacks (Moscow Times).
Denmark has accused Russia of sabotaging its defence suppliers, and Britain and Germany have warned the campaign could “tip into open violence.”
An arrest, not just an accusation
Police detained Zvinchuk's wife and Rybar creative director, Valeria Zvinchuk, along with three associates (Odessa Journal). Rybar's Telegram channel reaches 1.5 million subscribers and, per British and US authorities, is coordinated by Russia's presidential administration and funded through the state defence conglomerate Rostec (UNITED24 Media); Washington is offering $10 million for information on Zvinchuk (Moscow Times). Montenegrin Prime Minister Milojko Spajić, whose government wants EU membership by 2028, called the arrest a defence of “our European future” (Moscow Times).
War-gaming the AI-enabled attack
NATO's Strategic Communications Centre of Excellence in Riga is running Exercise SYNESIS 2026, pairing AI-driven audience-behaviour modelling with a live simulation platform to test responses to AI-generated attacks (StratCom COE). It follows a drill at NATO's training centre in Bydgoszcz where Ukrainian officials played the attacker, mirroring tactics Russia uses against Ukraine; NATO's defending teams narrowly prevailed, exposing gaps in handling AI-accelerated disruption (Defence Matters).
Brussels names its nightmare scenario
Incidents behind Brussels' nightmare scenario
- Aug 2026Explosives-laden drone found at Leipzig airport, Germany
- Sep 2026Fire at a Starlink ground station in Poland
- Oct 2026Drones sink a ship in the Black Sea
The incidents pushed EU ambassadors from all 27 member states into closed-door talks on 7 October about a “nightmare scenario”: a Russian hybrid attack causing multiple casualties (Yerepouni News, via Politico). Hybrid CoE director Teija Tiilikainen put it bluntly: “At some point, intentionally or unintentionally, this is what happens” (Yerepouni News). Two days earlier, EU foreign policy chief Kaja Kallas had warned that Russia's hybrid attacks were putting lives at risk across Europe (US News).
The capability gap
Ukraine's decade defending infrastructure against Russian sabotage — spanning incidents “from Leipzig Airport to the Black Sea” — gives it expertise in counter-disinformation and recruitment-network detection that NATO lacks, the Atlantic Council argues (Atlantic Council). Former NATO official Camille Grand calls Moscow's method “boiling the frog” — escalating slowly enough that no single incident forces a response, which is the logic behind Ursula von der Leyen's proposed European Security Council (Atlantic Council).
Hypothesis: the Zvinchuk arrest, the Riga and Bydgoszcz exercises, and Brussels' casualty planning form one policy shift — from naming Russia's campaign to actively degrading and rehearsing against it. Supporting this: all three landed within ten days, each targets a different layer of the threat, and Montenegro framed its arrest as advancing EU accession rather than routine policing. Against this: the EU talks remain closed-door and non-binding, and RUSI's Oana Lungescu warns that overlapping EU-NATO mechanisms “risk being very confusing for decision-makers at all levels” rather than clarifying them (Yerepouni News).
What to watch
- Whether Montenegro charges or extradites Zvinchuk, testing how far an EU candidate will go against a Kremlin-linked network.
- Whether the EU adopts a binding emergency protocol or lets the European Security Council proposal stall over EU-NATO overlap.
- Whether a future hybrid incident causing a death triggers Article 5 consultations, the legal tripwire officials are discussing.
