We encourage you to read our review of the past week in Central and Eastern Europe:
Prime Minister Radev outlines EU Priorities during visit to Berlin
On May 18, 2026, Bulgarian Prime Minister and former President Rumen Radev made his first foreign visit since taking office, traveling to Berlin. During a joint press conference with the German Chancellor, Radev presented Bulgaria as an important industrial and logistical partner for Germany in Southeast Europe, citing, among other things, cooperation in the defense industries. During the visit, plans were announced to build an artificial intelligence gigafactory with German investment, as well as to further develop cooperation in the field of drones and joint European defense initiatives, going beyond existing projects with Rheinmetall. Radew also emphasized Bulgaria’s strategic location as a link between Central Europe and the Balkans, as well as the growing importance of the Black Sea region.
The visit carries a clear symbolic significance. Radev, long associated with a pro-Russian stance and criticism of the EU’s policy toward Ukraine, is clearly pointing to Europe’s strongest economy as the most important partner in the region. As an experienced reserve officer and former commander of the Air Force, Prime Minister Radev will likely actively influence Bulgarian defense policy. His statements on defense highlight, among other things, the crucial role of funds from the EU’s SAFE program, without which the implementation of modernization plans would be significantly more difficult.
Bulgaria: only 5% of defense production goes to the bulgarian armed forces
According to analyses by Bulgarian experts, only 5% of the Bulgarian defense industry’s production is directed toward the needs of the Bulgarian Armed Forces. Jordan Bozhilov, director of the Sofia Security Forum, who made this information public, highlighted the lack of coordination between the state and arms manufacturers in setting procurement priorities. In his view, the government should precisely define its equipment requirements, while companies should clearly communicate their own production capabilities. The problem is also exacerbated by a focus on the production of components and subassemblies, with only a small number of domestically produced complex systems.
The decisive predominance of exports in the production structure of the Bulgarian defense industry is a unique example on NATO’s eastern flank and stems from historical circumstances. It is also a significant indicator of the state of Bulgarian defense policy, which focuses exclusively on the development of the armed forces. The high level of defense industry exports meets the business needs of manufacturers; however, the government’s lack of a strategic approach to sectoral policy means that, when it comes to acquiring major land, sea, or air systems, the Bulgarian armed forces must rely almost entirely on foreign production.
Chief of the Czech General Staff: Ukraine’s NATO membership is a logical step
General Karel Řehka, Chief of the General Staff of the Czech Armed Forces, stated during the GLOBSEC forum in Prague (May 21–23, 2026) that Ukraine should ultimately join NATO. He described accession as the “logical next step” for European security. He emphasized that Ukraine has proven that it is not merely a recipient of aid but has itself become a guarantor of security. Řehka also called on the Czech government to significantly increase defense spending beyond the former target of 2% of GDP.
The defense budget remains a political flashpoint in the Czech Republic. Prime Minister Babiš’s cabinet approved only 1.7% of GDP for 2026, contrary to NATO commitments and the declared goal of 3.5% by 2035. Defense Minister Zůna, however, announced an increase in spending ahead of the NATO summit in Ankara. The statement by Řehka—the Czech Republic’s highest-ranking military officer—is of significant importance in light of the tensions surrounding the defense budget. The commander openly distances himself from the prime minister’s narrative, and GLOBSEC in Prague has become a platform where the voices of President Pavel and Gen. Řehka consistently highlighted Ukraine as a country requiring further support, in contrast to the line presented by the current cabinet.
Internal Security of the Russian Federation – FSB tightens control, agents active
In May 2026, the FSB carried out arrests of spies in 8 regions of Russia, foiled an assassination attempt using an electric scooter against a security service officer in Moscow, and—as of April 1—obtained the right to free access to the databases of all organizations in the Russian Federation without court approval. At the same time, on May 18 and 21, the SBU detained FSB agents in Ukraine responsible for directing strikes on Nikopol and preparing targeting data for missile attacks on Kyiv.
The expansion of the FSB’s data access rights closes the space for traditional HUMINT and OSINT operations within Russia. The simultaneous activity of agents on the Ukrainian side demonstrates that the FSB conducts external operations and protects the regime internally using the same tools. For NATO’s eastern flank, this means an increased hybrid risk—ranging from data penetration and support for kinetic strikes to the narrative of “Kyiv-directed terrorism” as a pretext for further restrictions
FSB: Taking control of runet and tasks regarding internal threats
Since the summer of 2025, according to sources in the telecommunications and IT sectors, management of Runet has come under the control of the FSB’s Second Department (Service)—responsible for “protecting the constitutional order.” This agency is behind the blocking of WhatsApp and Telegram connections, the crackdown on VPNs, and attempts to completely block foreign messaging apps; its head, Alexei Sedov, is said to have been given a “free hand” by Putin to “restore order on the internet.” At the same time, a package of laws is being processed that would give the FSB the ability to demand that operators shut down communications, which de facto allows for selective or mass “blackouts” of communication. On February 24, 2026, at an expanded meeting of the FSB Collegium, Putin identified the main internal threats as tactics of individual and mass terror, which he described as the enemy’s response to its inability to defeat Russia on the battlefield. He ordered the strengthening of protection for generals and Ministry of Defense officers, defense industry workers, border officials, journalists, and volunteers, as well as the “maximum exposure” of energy and transport infrastructure through new security measures. Counterintelligence was tasked with “cleansing the rear of the Special Military Operation of agents” and securing strategic information, while the FSB received a formal order to “protect the sovereignty” of the Duma elections.
In practice, these actions amount to a carte blanche to suppress dissent and filter out external influences in the campaign. The common thread linking both decision-making blocs is clear. The FSB is becoming the central instrument of informational and political control—both online and offline. The takeover of Runet by the FSB’s Second Directorate and the growing powers to shut down communications and “protect” the electoral process complete the model of a fortress state, in which the digital space, energy sector, transportation, and political arena are managed according to the logic of counterintelligence and counterterrorism operations, rather than normal domestic policy.
International Security Forum in the Moscow region – Russia’s alternative to western platforms
On May 26–29, 2026, the first International Security Forum under the auspices of the Security Council of the Russian Federation will take place at the “Live Arena” complex in the Moscow Region. Representatives from 155 countries and 26 international organizations have announced their participation, and the program includes a meeting of high-level security representatives, thematic sessions, bilateral meetings, and equipment exhibitions; among the content partners are MGIMO and other research centers.
The forum is conceived as a platform—competing with Western formats (WSF, Shangri-La, ASEAN)—for shaping the narrative of a “multipolar security order,” in which Moscow seeks to act as the organizer of a global debate and the leader of the “anti-hegemonic” camp. The scale of participation by Global South countries will serve as an indicator of the extent to which Russia’s message about an alternative security order finds real—rather than merely declarative—acceptance, as well as the room for maneuver remaining to the West in the competition over the formats and language of strategic discussion.
Belarus strengthens its cyber threat response system
On May 15, 2026, Belarusian Prime Minister Alexander Turcin signed a decree “On Cybersecurity Centers,” updating the list of state bodies and organizations required to maintain their own Computer Security Incident Response Teams (CSIRTs) within the national cybersecurity system. The document clarifies the structure of the state network of cybersecurity centers, anchored in the Operational-Analytical Center under the President, the National Cybersecurity Center, and sectoral centers within state institutions.
The regulation allows state institutions to procure cybersecurity services from designated providers through a single-source procurement process, which simplifies and accelerates the development of defense capabilities—but simultaneously strengthens the authorities’ control over the market and consolidates sensitive competencies within a narrow group of entities linked to the regime. Given the ongoing military-political integration with Russia, it must be assumed that the development of Belarusian cyber capabilities will be coordinated with the needs of the Union State, including tasks in the sphere of reconnaissance and cyber operations against NATO countries.
Belarus’s defense concept for 2026–2030 and alliance guarantees with Russia
In December 2025, the Security Council of Belarus approved the fundamental principles of national defense for 2026–2030, referred to as the “defense concept” and serving as the foundation for the five-year defense plan. The document, drawn up based on the experience of the 2020 protests and the course of Russia’s “Special Military Operation,” defines defense in terms of a nationwide effort—from the economy and administration to the armed forces—and assigns specific roles to every state body and every citizen in the event of a conflict. In January 2026, Alexander Lukashenko approved detailed decisions regarding the protection of the state border and the defense of airspace for 2026, emphasizing that Belarus is “practically surrounded by military units on all sides,” with the exception of the eastern border with Russia, which serves to legitimize the further strengthening of the border component and air defense in the logic of a “besieged fortress.”
Belarus’s defense concept has been embedded in increasingly tight alliance guarantees with Russia, stemming both from membership in the CSTO, and the Treaty on Security Guarantees within the Union State, which entered into force in 2025 and provides that an attack on one of the states shall be treated as an attack on the entire Union State. In accordance with the amended laws on military security, any act of aggression against Russia or another CSTO member may constitute grounds for imposing martial law in Belarus and the use of the armed forces of the Russian Federation and the Republic of Belarus within the framework of a joint defense system. In practice, this means that Minsk is conceptually shifting from a formally “neutral” to the role of an integrated operational component of Russian planning—the defense of Belarusian territory, including its airspace and borders, is conceived as part of the broader security architecture of the Union State, with the possibility of using all available means, including tactical nuclear weapons likely deployed on Belarusian territory.
SCO and CSTO exercises on Belarusian territory in 2026
On May 14, 2026, it was announced that joint counter-terrorism exercises of the Shanghai Cooperation Organization (SCO) would take place on Belarusian territory in 2026, involving the armed forces and security agencies of all ten member states, including, among others, Belarus, Russia, China, India, Iran, and Pakistan. The decision was announced following a meeting of the SCO member states’ security council secretaries in Bishkek, where the intention to deepen practical counterterrorism cooperation within the framework of programs adopted through 2030 was confirmed, and Belarus—recently admitted to the organization—offered its territory as a training ground for multinational exercises.
At the same time, the Collective Security Treaty Organization announced that in October 2026, a command-staff exercise with peacekeeping forces “Inviolable Brotherhood-2026” and a special exercise “Barrier-2026” dedicated to defense against chemical, biological, and radiological weapons and medical support. According to the CSTO’s announcement, contingents from all member states will participate in the maneuvers, and the scenarios will cover both classic peacekeeping operations and responses to CBRN threats, which is intended to strengthen Belarus’s role as a key training ground for joint military exercises of post-Soviet structures and the Union State—and to demonstrate its integration into both the CSTO and CSTO formats.
Ukrainian combat drone shot down over Estonia
On May 19, 2026, between 12:00 and 12:55 local time, the Estonian Defense Forces (Est. Kaitsevägi) issued a drone alert in six counties of southern Estonia—Tartu, Jõgeva, Viljandi, Valga, Võru, and Põlva. At 12:14 p.m. over the Alam-Pedja marshes, in the area between Lake Võrtsjärv and the town of Põltsamaa, a Romanian F-16 shot down an unmanned aerial vehicle with a single air-to-air missile; the drone had entered Estonian airspace from the Russian side earlier that morning in the southeastern part of the country. The wreckage fell near the village of Kablaküla. The Estonian KaPo (Est. Kaitsepolitseiamet) launched a criminal investigation under the supervision of the prosecutor’s office to fully identify the object. According to statements by the Estonian Ministry of Defense and the Ukrainian Ministry of Foreign Affairs, the object was likely a Ukrainian long-range combat drone targeting sites in the Leningrad Oblast (the region of oil export ports and the St. Petersburg transport hub). As a result of the Russian military’s use of electronic warfare measures—including jamming and GPS spoofing—it was knocked off course, flew over Latvian territory, where it was detected by Latvian radars, and then entered Estonia. The specific type of drone has not been officially confirmed; identification is ongoing based on fragments secured by the State Police.
The operation to shoot down the unmanned aerial vehicle provided a rare, well-documented example of effective allied cooperation in countering incoming airborne threats. The sequence of actions, which lasted several minutes, involved resources from five NATO countries and one command center in Germany. Latvian radars provided early warning, and the Latvian Control and Reporting Centre (CRC) in Lielvārde assumed operational command. The NATO Combined Air Operations Centre (CAOC) in Uedem, Germany, authorized the use of combat assets. A Romanian F-16 operating from the Lithuanian base in Šiauliai carried out the mission over Estonian territory, while Portuguese F-16s from Ämari and French Rafales from the Šiauliai air base remained on standby to provide support. Reconnaissance support was provided by a Swedish Saab 340 AEW&C. It is worth noting, however, that this was the first instance in the history of the NATO Baltic Air Policing mission where an approaching unmanned aerial vehicle was shot down using air-to-air missiles fired by an F-16 fighter on duty. A similar incident—though outside the formal framework of Baltic Air Policing—occurred in September 2025 in Poland involving Russian unmanned aerial vehicles violating the approach route to NATO airspace. This incident could become one of the arguments for the further evolution of NATO missions from classic air policing toward a full-scale air and missile defense system, particularly in the context of the growing threat posed by drones and low-cost air attack capabilities on the Alliance’s eastern flank. The incident also indicates that there are no ground-based systems along NATO’s northeastern flank capable of effectively countering drone threats during peacetime.
The shadow fleet as an element of hybrid operations
On May 22, 2026, the ACLED (Armed Conflict Location & Event Data) analytical platform published a report titled “Russia’s Shadow Fleet Presents a Sustained Hybrid War Threat at Sea,” authored by Witold Stupnicki, ACLED’s senior analyst for Europe and Central Asia. The text presents a new perspective on the “shadow fleet”—that is, the issue of old tankers and merchant ships used by Russia, and more broadly by other sanctioned states, to circumvent export restrictions, primarily those concerning crude oil. Stupnicki goes further, however, and highlights a systemic hybrid operation being waged against Europe using “shadow fleet” vessels as operational platforms.
The report effectively integrates various phenomena into a single operational model. However, as is often the case in such analyses, attributing responsibility remains a challenge, and not every incident can be unequivocally attributed to Russia. Many of the analyzed events can only be explained by a broader pattern of behavior and modus operandi. For comparison, one can cite the example from Denmark on September 22–26, 2025. At that time, the Copenhagen airport was closed, and in the following days, drones were observed over Aalborg and other sites, including military ones. It was suspected at the time that these drones were highly likely to have taken off from ships of the “shadow fleet” located near Danish territorial waters. The author’s findings, however, warrant serious attention, as they raise the crucial question of whether we are dealing with random incidents or with elements of an organized system facilitating hybrid warfare against the West.
Final verdict against russian spy in Latvia
The Supreme Court of Latvia (Senate) refused to initiate cassation proceedings in the case of a 73-year-old Russian citizen, a former Soviet officer, convicted of spying for the Russian Federation. As a result of this decision, the arrested Russian will be forced to begin serving an 8-year sentence. During the trial, the defense argued that there had been an allegedly erroneous interpretation of the law regarding the collection of open-source information on Latvia’s security and armed forces on behalf of a foreign intelligence service. The convicted man has exhausted all available appeals. The verdict is final.
The retired Soviet military officer was detained in late 2023 as a result of an operation by the Latvian State Security Service (Latvian: Valsts drošības dienests, VDD). According to the VDD’s findings, the man was collaborating with a representative of Russian intelligence services operating in the Kaliningrad region. As part of this collaboration, he provided open-source information, including analyses of political processes in Latvia, data on critical infrastructure, and details regarding civilian and military facilities in the Riga area, including the vicinity of the airport. Additionally, he conducted surveillance and reconnaissance of the area near the 17th Battalion of the Zemessardze (Latvian National Guard), which raised suspicions of intelligence-related activities. During a search of his residence, officers seized explosives and ammunition, including hexogen, TNT, as well as ammunition. According to investigators, the substances in his possession could have been used to construct explosive devices, which became an additional subject of the criminal investigation. The case remains part of a broader context of Latvian counterintelligence activities targeting individuals suspected of collaborating with Russian intelligence structures and potential hybrid threats on Latvian territory.
News from the Eastern Flank Institute (IWF):
- Grzegorz Matyasik, an expert at the Eastern Flank Institute, in his analysis titled “The Fiction of Anti-Drone Defense in the Protection of Mandatory Protection Sites” addresses the topic of realistic possibilities for protecting critical infrastructure against threats posed by unmanned aerial vehicles. The author emphasizes that the protection of facilities of particular importance to national security is one of the key elements of the national security system, and the experiences of the war in Ukraine demonstrate the growing role of drones used for both reconnaissance and sabotage operations or attacks on strategic facilities. We encourage you to read the full analysis.
- Tomasz Szatkowski, a member of the Program Council of the Eastern Flank Institute, gave an interview to the Defence24 portal, in which he addressed the issue of the U.S. military presence in Poland and the importance of Polish-American relations for regional security. In a conversation with editor Michał Górski, the former Polish ambassador to NATO Headquarters highlighted the strategic importance of the U.S. presence for Poland’s security and the need to actively work to maintain and strengthen relations with Washington. We encourage you to read the full interview.
