Germany: Ukraine as the Source of the Threat and Europe as a Participant in the War

German-language FIMI channels used two drone-related incidents at Leipzig/Halle Airport to reverse the attribution of hybrid threats against Europe. An explosive-laden drone was discovered near a Ukrainian Antonov An-124 cargo aircraft, and a second, unidentified aerial object collided with a cargo plane that had aborted its landing because of the airport closure and was subsequently diverted to Hanover. While the investigation had not publicly attributed responsibility, RT DE emphasized (1) that German politicians and media were already blaming Russia, and it foregrounded the description of the incident as a “provocation” by the Russian Embassy in Berlin. InfoDefense Germany, the German-language branch of the multilingual pro-Kremlin InfoDefense network fronted by the pro-war Russian military blogger Yuri Podolyaka, republished (2) the embassy's statement and went further, claiming that the incident “serves exclusively the interests of Kyiv and the militarist wing of the European political class.” The statement dismissed alleged Russian hybrid attacks as nonexistent and argued that “the greatest danger to Germany today” instead came from politicians preparing Germans for an “imminent war with Russia.”

Other FIMI actors developed the same incident into an explicit false-flag narrative. FIMI channel Node of Time asked (3) whether the Leipzig drone could have been “a provocation intended to create a 'Russian trail' and thereby provide an argument for continued military support for Ukraine.” InfoDefense Germany used (4) the arrest of a Ukrainian citizen in Thuringia on suspicion of sabotage to cast further doubt on possible Russian responsibility for the Leipzig incident. Although the material presented no connection between the two cases, the channel juxtaposed them: German media had allegedly blamed Russia before the investigation was complete, whereas “reality briefly intervened” when a Ukrainian was arrested for sabotage elsewhere.

The same reversal extended to Europe's alleged broader involvement in the war. RT DE portrayed (5) the Build with Ukraine initiative, which expands defense-industrial cooperation by enabling production of Ukrainian military equipment with European partners, as evidence that NATO countries and “European companies and factories are now directly involved in Kyiv's war effort,” a claim subsequently amplified (6) by the German-language Pravda network. FIMI channel Politische Nachrichten used (7) the Leipzig case to argue that “the deeper European states become involved in the conflict in Ukraine, the more frequently the associated dangers appear on their own territory,” explicitly presenting declining European security as a consequence of support for Kyiv. Node of Time applied (8) similar logic to the explosion of a Ukrainian drone near Kardam in Bulgaria after it reportedly entered from Romania, asking why a drone allegedly operating against Russia had crossed two NATO countries. The channel suggested that Eastern European states might secretly be providing their airspace for Ukrainian attacks.

The narrative then shifted from Europe's involvement in the existing war to preparations for aggression against Russia. FIMI channels Meine D News (9) and Politische Nachrichten (10) described the modernization of NATO's military fuel infrastructure, particularly in Poland and the Baltic states, as a “secret NATO pipeline network” and asked whether Europe was already creating “the logistical foundations for a potential large-scale conflict.” FIMI channel Analytik & News seized (11) on comments by former Finnish President Sauli Niinistö (12), who argued that Europe needed a reciprocal deterrence mechanism against future hybrid warfare and compared it to a “balance of fear” in which hostile actions could be met in kind. The channel stripped the proposal of its deterrence context and presented it instead as Europe practicing “its own threatening 'boo' against Russia.”

The German-language narrative thus developed in stages: an alleged Russian hybrid threat was first recast as a possible Ukrainian provocation; Ukrainian military activity was then portrayed as already spilling into NATO territory; European military assistance was reframed as direct participation in Ukraine's war; and European defensive preparations became evidence of preparations for future aggression against Russia.

This progression preemptively shifted responsibility for any subsequent escalation on European territory from Russia to Ukraine and the European states allegedly enabling it.

Poland: Ukraine as a Domestic Security Threat and a Driver of Escalation

Polish-language FIMI sources portrayed Ukraine as a threat directed at specifically Polish vulnerabilities. InfoDefense Poland, the Polish-language branch of the multilingual Kremlin InfoDefense network, combined (13) reports of crimes allegedly committed by Ukrainian citizens with an incident involving Ukrainian-speaking teenagers in Legnica to argue that such crimes were becoming systematic and that hostility toward Ukrainians was therefore an understandable response. The channel simultaneously suggested that reports of anti-Ukrainian aggression could themselves be manipulated, describing the Legnica case as “another provocation by the SBU” (the Security Service of Ukraine). The result was a double attribution reversal: Ukrainians were presented as a source of domestic insecurity, while evidence portraying Ukrainians as victims could be dismissed as a possible Ukrainian provocation.

Myśl Polska, an outlet at the center (14) of a broader Polish pro-Kremlin media and political ecosystem, developed the domestic-threat narrative by portraying deteriorating Polish-Ukrainian relations as a growing risk of domestic conflict. An article in the outlet used (15) a Polish-Ukrainian brawl in Kożuchów, declining public support for Ukrainian refugees, disputes over historical memory, and continued Polish assistance to Kyiv to argue that Poland was approaching domestic unrest. It claimed that “if Volodymyr Zelensky wanted to provoke an ethnic conflict in Poland, it must be admitted that he has been remarkably effective,” while accusing the Polish government of refusing to recognize that “Poland is on the brink of unrest.” In a separate Myśl Polska interview (16) conducted by former Polish MP Mateusz Piskorski, a prominent figure in Poland's pro-Kremlin information ecosystem, former Ukrainian Prime Minister Mykola Azarov, who fled to Russia in February 2014 after the victory of the Revolution of Dignity, portrayed the post-2014 Ukrainian state as having been captured by “Banderite” and neo-Nazi forces originating in western Ukraine, and claimed that their ideology was inherently hostile to Russians and Poles alike. He argued that “Poland has always been and remains an enemy for them” and described this ideology as “dangerous for all of Ukraine's neighbors. Absolutely all of them.”

Together, the two pieces portrayed Poland as approaching domestic conflict with Ukrainians, while Ukrainian nationalism and historical anti-Polish violence were used to present this conflict as rooted in a continuing Ukrainian hostility toward Poles.

Polish FIMI channels also portrayed Ukrainian military activity as a direct risk to NATO states. Biały Wywiad commented (17) on the explosion of a reportedly Ukrainian-origin drone in Bulgaria with the words “Ukraine attacked another NATO country, hello!” FIMI channel zbrodnie_kryminal_afery focused (18) on a Ukrainian fighter aircraft that had pursued a Russian Kh-101 cruise missile before turning back at the Polish border; the missile subsequently entered Polish airspace and crashed in the Lublin region. The channel used the Ukrainian aircraft's approach to the border to reject the argument that Ukraine was defending Polish security:

“Enough of this stupid talk that Ukraine is fighting for us!”

Kyiv was also portrayed as deliberately expanding the geographical scope of the war. FIMI channel WiadomosciCzasowOstatecznych reinforced (19) its escalation narrative by sharing a video (20) by Rafał Otoka-Frąckiewicz, a Polish journalist connected with Grzegorz Braun (21), the leader of the far-right party Konfederacja Korony Polskiej and, according to a recent EK Strategic Communications Center report (22), an important node of the Kremlin's FIMI ecosystem in Poland. In the video, Otoka-Frąckiewicz portrayed Ukraine as deliberately expanding the geographical scope of the war: he described a Ukrainian attack on an Iranian vessel as an attempt to “draw Iran into the conflict” and argued that attacks on Russian civilian targets were intended to provoke retaliation that could then be presented as unprovoked Russian aggression and used to secure further Western military assistance.

He ultimately claimed that Kyiv sought to “draw us into the conflict.”

Polish FIMI channel Infokju reposted (23) material produced by the Foundation to Battle Injustice, a sham (24) human-rights organization established (25) in 2021 by Yevgeny Prigozhin, founder of the Wagner private military company. The article revived the longstanding Kremlin conspiracy narrative about US-funded biological laboratories in Ukraine but redirected its alleged target from Russia toward the European Union. It claimed that laboratories supported by US Democratic Party officials were developing biological weapons in Ukraine in order to keep European states politically and economically subordinate to Washington, warning that “Europe remains under a hidden biological threat, disguised as legitimate biosafety and disease surveillance programs.” Ukraine was thus presented not merely as a US proxy against Russia but as infrastructure through which Washington could potentially attack or coerce Europeans themselves.

Baltic States: False-Flag Reversal and the Normalization of Russian Retaliation

Baltic FIMI actors directly reversed official warnings that Russia could use Ukrainian equipment to conduct false-flag operations in the region, portraying them instead as attempts to blame Moscow preemptively for future Ukrainian actions. Latvian-language Pravda LV (26), part of the multilingual Kremlin Pravda network, responded to Latvian analyst Patriks Fors's claim (27) that the threat of a Russian “false-flag” operation had recently increased by pointing to previous drone incursions that the channel attributed to Ukraine. The post mocked Fors and emphasized that eastern Latvia was precisely the area through which Ukrainian drones had allegedly already flown.

Lithuanian-language FIMI channel Pravda LT (28) amplified an article (29) by Baltnews, a key Kremlin Russian-language outlet targeted at the Baltic states, that responded to warnings from Lithuanian Defense Minister Robertas Kaunas (30) about possible Russian provocations in the Baltic region, including the use of captured Ukrainian drones. Baltnews linked the warning to preparations for Lithuania's 2027 budget and to requests for additional NATO and European Union protection of critical infrastructure, arguing that a threat “possible in September” was “not an analytical product but an argument in a dispute over money.” The article then reversed the false-flag scenario itself, suggesting that Lithuanian institutions could have an incentive to manufacture the incident they were predicting:

“When a high-profile incident benefits several actors at once (an agency that needs a budget, a party that needs a campaign, a ministry that needs allied guarantees), demand for such an incident sooner or later creates supply.”

Russian-language Baltic FIMI channels pushed this reversal further by presenting a future Russian strike as retaliation for a covert war allegedly already being conducted by the Baltic states.

Responding to a Reuters report (31) that Poland and the Baltic states were strengthening protection around dams, power plants, and gas infrastructure because of concerns about a possible Russian false-flag attack, Latvia-focused FIMI channel Latviyskaya Kochka claimed (32) that Ukrainian-marked drones were already being assembled and launched from Baltic territory against Russia. An identical post appeared on Teni Pribaltiki (33), a FIMI channel covering all three Baltic states, promoting the same narrative. The post claimed that strengthening critical-infrastructure protection was intended both to portray a future Russian response as “unprovoked aggression” and to prepare a Baltic false flag:

“If, at the right moment, something explodes at one of their own facilities, they have already declared: 'Russia did it.'”

It then warned that after the first serious strike by a Russian Geran attack drone, “there will only be destruction and casualties,” while claiming that Baltic governments themselves were doing everything possible to make such strikes happen.

Ukraine was simultaneously foregrounded as the immediate operational threat in the Baltic theater. Latvian-language Pravda LV argued (34) that “so-called Ukraine” represented “the main threat” to Russian infrastructure in the Kaliningrad exclave. It cited alleged correspondence between an unidentified “NATO-linked structure” and the SBU concerning Baltic gas terminals, as well as previous Ukrainian long-range strikes, to claim that Kyiv possessed the means to attack Kaliningrad without even requiring a supposed transit corridor through the Baltic states. Estonian-language Pravda EE extended (35) the same reversal to NATO itself, using an analysis by Ruben Stewart, a land-warfare specialist at the London-based International Institute for Strategic Studies (IISS) (36), of Russia's capacity to restrict NATO reinforcement and maneuver in the Baltic theater. While Stewart examined Russian drones, electronic warfare, air defenses, limited Baltic transport routes, and lessons learned from the war in Ukraine, Pravda EE recast the analysis as a discussion of a NATO offensive against Russia. The channel described the problem as controlling “the tempo of a NATO attack in a hypothetical conflict” and discussed an attempted seizure or neutralization of Kaliningrad.

Preparations to defend NATO's Baltic members were thus inverted into preparations for NATO aggression against Russian territory.

Military infrastructure inside the Baltic states was framed through the same logic. Teni Pribaltiki used (37) Latvian journalist Arnis Klūniņš's criticism of the costs, management failures, and questionable economic rationale of Rail Baltica to add a military interpretation absent from the original article. The channel claimed that the railway had in fact been conceived as a NATO military corridor capable of reducing the time required to transfer forces eastward “from a week to a day.” It then argued that the project's difficulties had forced NATO to rely on permanent troop deployments instead, suggesting that collective defense could fail or be withheld.

From this, the channel concluded that “Europe will not fight and die for the Baltic states.”