Third day, same signature: Spain calls the flight threats hybrid aggression

Baltic Security Monitor | Material Update · 6 November 2026, 14:00 EET

On 6 November European aviation faced its third wave of bomb threats in a week: Copenhagen, Prague, France, Italy, Portugal. Again, no explosives were found. What is new is not the scale but a political assessment: Spanish Foreign Minister José Manuel Albares said the "most reasonable assumption" is an attempt at hybrid aggression and psychological warfare. No state has formally blamed anyone yet.

The third wave: what happened on 6 November

• Denmark. Police are investigating threats against air traffic at Copenhagen airport. Their initial assessment is that passengers were not in danger, and the airport is operating normally.
• Czech Republic. Police registered threats against nine Prague flights, four inbound and five outbound. No flights were cancelled or diverted.
• Italy. A Wizz Air Prague–Rome flight was diverted to Venice and landed safely.
• France. The prime minister's office reported four new threats against aircraft over French territory; all landed safely.
• Portugal. A bomb alert on a Ryanair Rome–Lisbon flight triggered a security operation on landing, according to CNN Portugal.

The waves came on Tuesday, Thursday and Friday. On 3 November at least seven flights were targeted; on 5 November, at least 27. (Full analysis: Material Update, 5 November 20:00.)

Who and how

In Italy, the threats were emailed to several airlines and airport operators in Rome and Milan. The messages claimed to come from "fighters of the Male State", a movement founded in 2016 by Russian blogger Vladislav Pozdnyakov. Pozdnyakov said the group no longer exists and was not involved. How threats were delivered elsewhere has not been reported, and Reuters could not independently identify the sender. 🟡 A signature on an email is not attribution.

Speaking to TVE, Albares said "it cannot be mere coincidence that so many incidents with exactly the same modus operandi are happening across Europe," adding that "the most reasonable assumption is that we are facing an attempt at hybrid aggression and a form of psychological warfare." He did not name any state.

BSM analysis

Albares's statement is a ministerial-level assessment from an EU government, but it is an assessment, not evidence. It rests on modus operandi, not on technical traces. The context in which it was made is familiar, though: Reuters points to a series of sabotage attacks and attempts across Europe, including on German electricity substations, defence sites in the Baltic states, French supermarket refrigeration and Leipzig airport. Many European officials link that campaign to support for Ukraine and accuse Moscow of hybrid pressure.

For the Baltic states, what matters is not who signed the emails but that the mechanism works. Three waves in a week forced airports, police and militaries in several countries to treat every threat as real. If this is a test, it is testing not aircraft but the speed and unity of Europe's response — and so far each country is responding on its own. 🟡 No joint EU or Europol investigation has been publicly announced.

Monitoring: open investigations

• Abu Dhabi talks, 10–11 November. On 3 November Peskov said European participation was "impossible" because a three-way format had been agreed, and that security guarantees "can only be mutual." (Full analysis of the Brussels track: Security Watch, 5 November 08:00.)
• Atlantique 2, Baltic Sentry. No changes since the French mission extension. (Material Update, 6 November 08:00.)
• Latvia. No wreckage found in Balvi district.
• Poland. The security operation near the Kaliningrad border continues until at least 8 November.
• Refrigeration cyberattacks. No common vector or attribution.

Conclusion

Three waves, no bombs, no accusations — but now a government assessment. Europe is shifting from asking "what was that?" to asking "who is doing it?" The answer will depend on technical traces, not on a signature in an email. Until those emerge, each new wave remains cheap for whoever launches it and expensive for everyone else.

Psychological warfare wins not when a bomb goes off, but when everyone behaves as though one might.

Baltic Security Monitor (osint-baltic.com) — an analytical publication on security across NATO's north-eastern flank.
Prepared from open-source monitoring; the verification status of each fact is marked in the text.