The Grey-Zone Flank: Security Watch, 4 November 2026

Baltic Security Monitor | WATCH log
Snapshot: 4 November 2026, 14:00 EET · monitoring window 08:00–14:00, look-back up to 24 hours

Nothing that happened on NATO's northeastern flank over the past three days counts as an attack in the classical sense. What the flank got instead was the full grey-zone kit: drones from both warring sides over Latgale, people with flashlights at the Kaliningrad border, and hacked freezers in Estonian and Finnish shops. None of these is a crisis on its own. Together they show what pressure looks like when it stays below the Article 5 threshold.

Cycle status

The register of ongoing investigations stood at 41 at the start of the cycle. A full item-by-item reconciliation was not available this time, so no closures and no revised total are recorded.

Every item below was independently checked against open sources.

🟠 1. Latvia: two drones, two attributions

On Sunday and Monday, 1–2 November, Latvia's armed forces twice warned of airspace threats near the Russian and Belarusian borders and told residents in the area to take shelter. The second alert came with NATO Air Policing fighters scrambled.

On 3 November the military gave a preliminary attribution. Sunday's drone was probably a Russian Geran-type; it is unclear whether it was armed, and it flew back across the Russian border. Monday's drone was probably Ukrainian. It came down on Latvian soil but had not been found as of 3 November. No damage or injuries were reported.

BSM analysis

Riga has now publicly split the attribution of a single episode between the two belligerents. For Baltic air defence that matters more than it seems: a stray drone no longer defaults to "Russian", and the response has to rest on identification rather than flight direction. Ukrainian drones aimed at Russia's Baltic Sea oil ports have repeatedly wandered off course, partly because of Russian jamming, and Moscow uses every such case to accuse Kyiv of hiding behind NATO airspace. Drone incidents already helped bring down a Latvian government earlier this year, so for Riga the political cost of each new episode outweighs the military one.

The attribution is preliminary. Next cycles will look for recovered wreckage of Monday's drone, a final identification and any NATO statement.

🟠 2. Poland: "disturbing movement" near Kaliningrad

On 2 November Poland launched a special security operation along its border with the Kaliningrad region. Prime Minister Donald Tusk said Polish and allied intelligence pointed to possible sabotage or armed provocations in the first half of November, including attempts by armed people to enter Polish territory.

Shortly after midnight on 3 November, the Border Guard spotted a group of people with flashlights near Sępopol in Warmia-Masuria. Polish forces moved in; nobody crossed, and the group withdrew deeper into Kaliningrad. Police, counter-terrorism units and Border Guard reinforcements are involved, run from a joint headquarters covering the Warmian-Masurian and Podlaskie regions. Force numbers have not been disclosed.

BSM analysis

A public warning with a specific time window is unusual for Warsaw. It deters, since the other side knows it is expected, but it also primes everyone for false alarms. The Sępopol episode fits both readings: a probe of Polish reaction times, or routine night-time movement seen through the lens of a warning. The telling detail is the force mix. Poland is fielding police and counter-terrorism units rather than the army, which means it reads the threat as sabotage, not military action.

Confirmed by Polish government statements. Until 15 November, BSM tracks actual crossing attempts, arrests and any new border restrictions.

🟣 3. Second wave of supermarket freezer hacks reaches Estonia and Finland

Overnight into 2 November, attackers took control of refrigeration systems in shops across at least nine countries: Belgium, Luxembourg, Sweden, Estonia, Ireland, the Netherlands, Finland, Portugal and Italy. It is the second wave, roughly three weeks after hundreds of French supermarkets were hit.

In Estonia one Selver store was affected; a freezer warmed by only 2–3 °C and was restored in about ten minutes with no product loss. In Finland a few small Kesko stores were hit. The heaviest impact was in Belgium, where dozens of Delhaize, Carrefour, Intermarché and Spar stores were affected, and in Ireland, with 13 SuperValu stores. The targets were mostly outdated, internet-exposed Danfoss AK-SM and AK-SC controllers plus Copeland and Dixell devices, often still on default passwords.

No one has claimed responsibility. Belgium's Centre for Cybersecurity acknowledged the perpetrators may never be identified, and Belgian federal prosecutors have opened a criminal investigation. France's CERT-FR considers the campaign probably still active.

BSM analysis

The attack has no military value and did no real harm in the Baltic states. Its significance lies elsewhere. It tests how fast fragmented, poorly secured infrastructure responds in several countries at once, and the Estonian ten-minute fix reads as a sign of readiness rather than weakness. Still, a campaign that scales from one country to nine in three weeks, with no attribution and no demands, is a textbook grey-zone tool: cheap, deniable, and aimed at public trust in everyday systems.

Incidents are confirmed by operators and national agencies; there is no attribution. Next come technical findings from CERT-EE, Finland's NCSC-FI and Belgium's CCB, and any joint EU attribution.

🔵 4. Brussels today, Abu Dhabi next week

Today, 4 November, the European Commission hosts a meeting in Brussels of EU, US and Ukrainian representatives at national security adviser level, joined by France, Germany, Britain, NATO and the World Bank. US Special Envoy Steve Witkoff set out the agenda as security guarantees for Ukraine, Europe's post-war security architecture and economic opportunities in reconstruction. The meeting builds on earlier rounds in Miami and Oslo.

Separately, Witkoff announced US-mediated working-level talks between Ukraine and Russia in Abu Dhabi on 10–11 November.

BSM analysis

For the Baltic states and Poland, the Brussels format matters more than Abu Dhabi. This is where it gets decided whether Europe's post-war security architecture is discussed with Europeans or about them. A scheduled meeting is neither a commitment nor a deployment, and BSM will track only signed documents and concrete decisions.

The meeting is confirmed by the Commission and NATO; no outcomes were available at snapshot time. The next cycle checks Brussels readouts and the delegation line-up for Abu Dhabi.

🔵 5. Strikes deep inside Russia: Yaroslavl again

Overnight on 3 November, Ukrainian drones hit the Slavneft-YANOS refinery in Yaroslavl, Russia's fifth-largest, with capacity of up to 15 million tonnes of crude a year. The independent channel Astra counted at least seven fire sites. Governor Mikhail Evraev confirmed damage to plant infrastructure and two injured workers, and claimed 124 drones shot down; that figure is unverified.

Separately, AP reported that Ozon confirmed a fire at its logistics centre in Adygeysk after a drone attack, with no casualties. Russia's Defence Ministry claimed 709 Ukrainian drones intercepted overnight, also without independent confirmation.

BSM analysis

Yaroslavl lies roughly 250 km from Moscow, and repeated hits on YANOS show Ukraine's refinery campaign reaching well beyond the border regions. The Baltic link is direct: the heavier the long-range drone campaign, the more drones stray over Latvia, Lithuania and Estonia (see item 1).

The YANOS strike is confirmed by Russian regional authorities; production losses have not been established. Next step is measured refining impact and satellite imagery.

Other register items with no material change

• The cyberattack on Ukraine's air-alert app still lacks technical attribution.
• Patriot / PURL remains at proposal stage, with no signed contracts.
• New IAEA findings on Zaporizhzhia NPP power lines are pending.
• The Oleshky ceasefire has expired, with no independently verified military changes.
• No new confirmed attacks on Black Sea shipping inside this cycle's window.

Bottom line

Nothing on the flank this cycle crossed the threshold of a military incident. But the pattern is telling: Latvia splits drone attribution between two sides, Poland warns of provocations with a date attached, and freezers in Estonian and Finnish shops become part of a Europe-wide cyber campaign. The grey zone works precisely because each episode looks small.

Abu Dhabi talks are six days away. Next snapshot: 4 November, 20:00 EET.

Sources

Reuters / WSAU (Latvia, 3 Nov); United24 / RMF24 (Poland, 3 Nov); The Hacker News, CERT-FR (cyberattacks, 3 Nov); Xinhua, NATO, European Commission (Brussels, 4 Nov); Meduza / Astra (Yaroslavl, 3 Nov); AP (Ozon, Russian MoD claims).

Baltic Security Monitor (osint-baltic.com) is an analytical publication covering security on NATO's northeastern flank.
The investigations register and event classification are maintained by an automated monitoring system based on open sources.