Sponsored by Bertin Exensor
www.exensor.com
————————————————————————————————————————————————————————————————————————————————————————————————————————————-
Military And Security Developments
Nov 07.
Ukraine: Wiper malware highlights sustained destruction risks from Russian threat actors. On 6 November, the cyber security company ESET reported that renowned Russian state-sponsored group ‘Sandworm’ had targeted key sectors in Ukraine in destructive cyber attacks between April and September. Sandworm relied on another suspected Russian state-sponsored group (‘UAC-0099’) to obtain access to targeted organisations. The group then deployed two data wipers in April to corrupt and/or delete files within the systems of an unnamed Ukrainian university. Between June and September, Sandworm also targeted entities within the government, energy, logistics and grain sectors with multiple wiper variants. The grain sector presents a new target for Sandworm; it likely aims to disrupt Ukraine’s primary economic export, highlighting the continuous evolution of Russia’s targets. Sandworm’s destructive activity spiked during the initial phase of the Russo-Ukrainian war and later decreased to prioritise cyber espionage. Nevertheless, we assess that Russian threat actors simultaneously continue to carry out destructive malware operations to support ongoing kinetic action.
Nov 05.
KEY DEVELOPMENTS
• STRATEGY: NBC reported that a recent US intelligence assessment concluded that Russian President Vladimir Putin is ‘more determined than ever to carry on the war’, which strongly aligns with our own ongoing assessment
• PERSONNEL: The departure of young 18-22 year old Ukrainian men will highly likely compound not only short-term labour shortages, including in sectors such as hospitality and retail, but also medium-to-longer term manpower shortages
• ENERGY: The ‘heating season’ in Ukraine officially commenced on 28 October, with energy security risks likely to be particularly heightened this year amid upticks in the intensity and lethality of Russian long-range strikes
• FORECAST: The situation for Ukrainian forces in Pokrovsk is steadily deteriorating as Russian forces expand their presence within the city, threatening Ukrainian ground lines of communication
• STRATEGY: On 28 October, NBC reported that a recent US intelligence assessment concluded that Russian President Vladimir Putin is ‘more determined than ever to carry on the war’, which strongly aligns with our own ongoing assessment. The intelligence assessment was reportedly provided to members of the US Congress in October. It underscored that US intelligence agencies have detected no signs that Russia is willing to compromise to end the war in Ukraine, in line with our assessment. According to unnamed senior US congressional officials, President Putin is reportedly committed to securing more territory in Ukraine in order to justify the war’s human and financial costs to date. It is possible that this intelligence assessment influenced US President Donald Trump’s decision to levy sanctions on Russia’s two oil giants last month. It remains our assessment that the Kremlin is prepared for Russia to suffer even worse economic costs in a bid to achieve its objectives in Ukraine; it is likely doubling down on its attritional strategy ahead of 2026.
• LYMAN: In recent months, Russian forces have made slow but steady progress along the southern part of the Oskil-Kreminna axis, advancing slowly towards the key town of Lyman (Donetsk oblast). Over the last two years, Russian progress in reclaiming the territory lost in this area during Ukraine’s 2022 Kharkiv counter-offensive has been extremely slow. However, some notable advances have been made in recent months, including the consolidation of the Serebryanske forest on the northern (left) bank of the Siverskyi Donets River. The Russian forces are now operating in the eastern half of Yampil (Donetsk oblast), a town located around six miles (10km) to the south-east of Lyman and to the west of the Serebryanske forest.
• LYMAN: The spokesperson for Ukraine’s 11th Army Corps reported on 2 November that Russian forces are accumulating in the Serebryanske forest and are exploiting the terrain to bypass Ukrainian positions. Russian forces are also reportedly establishing artificial embankments across the Siverskyi Donets River to facilitate the transport of vehicles to reinforce their forward positions. We previously reported on possible Russian improvements in their amphibious tactics in recent months, after disastrous crossing attempts in this area made in 2022. Russian forces have nevertheless seemingly successfully used the forest throughout the summer and autumn to support their advances towards Lyman, but the loss of foliage cover in the winter will likely reduce its utility in the coming months. This will only underscore the importance of drone operations in facilitating further Russian advances in this sector.
• LYMAN: Ukraine’s 3rd Army Corps spokesperson reported on 30 October that Russian forces are continuing to attack in small infantry groups in the Lyman sector, but their intensity and frequency reduces when poor weather conditions limit Russia’s drone effectiveness. This is notable as Ukrainian soldiers fighting in the area have observed an increase in Russian drone activity, particularly heavy bomber drones. This includes the newly deployed Koschei drone with a payload capacity of 15kg (which as a result is a very capable logistics drone in resupplying forward Russian positions). Elsewhere along the frontline, Russian forces have appeared to favour attacking during poor weather, as this also hampers Ukraine’s drone capabilities. This possibly indicates growing Russian reliance upon drones to make advances in the Lyman direction.
• LYMAN: While it remains unclear if and when Russian forces will move on Lyman, pressure is clearly mounting despite Ukrainian counter-attacks successfully limiting some Russian advances. Geolocated footage published on 29 October indicated that Russian forces had likely infiltrated south-eastern Lyman for the first time since the 2022 Kharkiv counter-offensive. While unlikely to be a permanent presence, the development underscores Russia’s improvements in infiltration tactics and their ability to (temporarily) exploit gaps in Ukraine’s defences in this area, likely to prepare the ground for more concerted assaults in the coming weeks.
• PERSONNEL: Politico reported on 29 October that the relaxation of border rules for young Ukrainian men has precipitated an influx of 18 to 22 year olds to Germany and Poland in recent months. As of late August, restrictions have been lifted on Ukrainian men aged 18 to 22 which had prevented them from leaving the country (see Sibylline Ukraine Update – 28 August 2025). According to data from the Polish Border Guard, nearly 45,300 Ukrainian men in this age group crossed the border to Poland from the beginning of 2025 until the easing of restrictions in late August. In the following two months alone, that number grew to 98,500 (or 1,600 per day). Meanwhile, the number of Ukrainian men in this age range entering Germany rose from 19 per week in mid-August to between 1,400 and 1,800 per week in October.
• PERSONNEL: While we cannot confirm the figures, we assess that the departure of young Ukrainian men will highly likely compound not only short-term labour shortages in Ukraine, including in sectors such as hospitality and retail, but also medium-to-long-term manpower shortages. We assess that manpower remains the perennial and defining weakness of the Ukrainian war machine. Efforts to bolster recruitment and conscription have achieved diminishing returns at a time when Russia is beginning to slowly expand the size of its forces deployed to Ukraine. The conscription age in Ukraine starts from 25 years old, so an exodus of young men will lower Ukraine’s available pool of future manpower. While many European countries remain largely welcoming to Ukrainian refugees, influxes of young Ukrainian men will possibly fuel concerns about strains on housing and infrastructure in host nations. In turn, this will realistically drive Ukraine scepticism among sectors of society in these countries over the coming months.
• STRIKES: Russian strikes continue to include significant barrages launched on a semi-regular basis. On 30 October, Russia launched a particularly large airstrike, including 52 missiles and 653 drones, which hit multiple power plants across several regions. DTEK, Ukraine’s largest private energy company, stated that this was the third such major strike on its thermal power plants in October. Such large-scale attacks, along with relatively smaller salvos, will exert significant pressure on Ukraine’s energy security (see ENERGY below for further analysis).
• STRIKES: On 3 November, Bloomberg reported that the UK had recently resupplied Ukraine with British-made Storm Shadow cruise missiles. The number of missiles remains unknown as well as the exact date of their delivery. On 21 October, Ukraine conducted a strike on a chemical plant in Russia’s Bryansk oblast using a Storm Shadow missile. While representing a significant offensive capability, the effectiveness of Storm Shadows at range will partly depend on the provision of targeting data from the US. The missile is capable of striking targets independently using GPS but doing so increases its vulnerability to electronic warfare (EW) and air defence interception. Ultimately, the sustained provision of US geospatial intelligence is likely to remain uncertain amid US President Donald Trump’s oscillating foreign policy regarding Ukraine. Additionally, the impact of these strikes is unlikely to be a game changer due to the likely limited number of missiles available.
• STRIKES: Ukrainian strikes continue to heavily target oil facilities, adding growing pressure on Russia’s oil sector. On 31 October, Vasyl Maliuk, the head of Ukraine’s Security Service (SBU), said that between September and October, Ukrainian forces struck 20 oil production and refining facilities. According to Maliuk, there have been a total of 160 strikes since the start of the year. The official further assessed that Ukraine’s strike campaign has caused a 20% deficit in Russia’s domestic fuel market and temporarily shut down 37% of the country’s refining capacity.
POLITICAL DEVELOPMENTS
• ENERGY: The ‘heating season’ in Ukraine officially commenced on 28 October, with energy security risks likely to be particularly heightened this year. Previously, Russia has typically intensified its long-range strikes against Ukrainian energy infrastructure in the autumn and winter months, likely in part to demoralise the Ukrainian population and also to undermine military-industrial production and resiliency. We assess that the heightened energy insecurity will increase the risk of scheduled and unplanned blackouts for both domestic and industrial customers over the coming months.
• ENERGY: Earlier on 4 November, Ukraine’s Ministry of Energy reported that scheduled rolling blackouts and restrictions on electricity usage will be in effect across certain regions for industrial consumers. The Ministry specified that such measures are planned to be in place from 0800hrs to 1100hrs and from 1500hrs to 2200hrs (all local time). Such continuous blackouts and energy restrictions will increase the risk of operational disruption over the coming months, particularly for energy-intensive industries. This could realistically result in operational delays, operational downtime and revenue loss for companies. For further analysis on why energy security risks this autumn and winter in Ukraine are likely to differ from previous years, see Sibylline Ukraine Monthly Forecast – 24 October 2025.
• DIPLOMACY: The Kremlin’s comments on 2 November that there is ‘no need’ for a meeting between President Putin and President Trump highly likely reaffirm Moscow’s limited willingness to work towards ending the war in good faith. Plans for a second Putin-Trump summit in 2025 were shelved in October (see Sibylline Ukraine Update – 21 October 2025). According to a report from the Financial Times (FT) on 31 October, the US cancelled the meeting after the Russian Foreign Ministry sent a memorandum outlining the same demands to address what Russia refers to as the ‘root causes’ of its full-scale invasion. These included demands for Ukraine to make territorial concessions, a reduction in Ukraine’s armed forces and guarantees that the country will never become a member of NATO.
• DIPLOMACY: While we cannot confirm the FT’s report, it is highly likely credible given that President Trump previously stated that he did not want the meeting to be in vain. Ultimately, the contents of the memorandum contain some of Russia’s long-standing terms on which it seeks to end the war, which reinforces our assessment that it has not largely deviated from its core objectives in Ukraine. On 3 November, the Deputy Chairman of Russia’s Security Council, Dmitry Medvedev, claimed that the more the West supports Ukraine, the more Ukrainian territory that will return to its ‘native Russia’. Such comments indicate that Russia has greater territorial ambitions in Ukraine beyond the lands it currently occupies and that the Kremlin remains unwilling to make significant compromises for peace, supporting our ongoing assessment (see STRATEGY above).
• BELARUS: Belarusian President Alyaksandr Lukashenka confirmed on 31 October that Russia will deploy its intermediate-range ballistic Oreshnik missile system in Belarus in December. President Lukashenka stated that the missile system will be placed on combat duty; he sought to portray the deployment as a warning to Western adversaries. The missile reportedly featured in the joint Belarusian-Russian ‘Zapad 2025’ military drills in September; Belarus had previously announced Russia’s plans to deploy multiple Oreshnik missile systems to Belarus by the end of the year. Russia first used the Oreshnik missile against Ukraine in Dnipro (Dnipropetrovsk oblast) in November 2024 (see Sibylline Ukraine Update – 25 November 2024).
• BELARUS: While we continue to assess that the Oreshnik’s military capability remains limited, the Kremlin almost certainly sees its primary utility as a strategic deterrence weapon; its deployment supports Russia’s reflexive control campaign aimed at deterring the West from expanding military support to Ukraine. We assess that further demonstrative strikes against Ukraine are possible in the coming months during periods of high geopolitical tension. Nevertheless, we continue to assess that such strikes are unlikely to present a marked increase in threat in comparison to existing ballistic missiles (such as Iskander-M or air-launched Kinzhal missiles).
FORECAST
POKROVSK: The situation for the Ukrainian forces in Pokrovsk (Donetsk oblast) is steadily deteriorating as Russian forces expand their presence within the city, threatening Ukrainian ground lines of communication. While a complete encirclement of Pokrovsk has not been achieved, steady Russian gains are raising concerns about the viability of Ukrainian logistics and evacuation routes, which are increasingly threatened by Russian drones as well as ground infiltrations. Ultimately, Pokrovsk retains significant strategic value; it would likely facilitate future Russian offensives in Donetsk oblast, particularly targeting the region’s so-called fortress-belt of cities to the north-east (Druzhkivka, Kostiantynivka, Kramatorsk and Sloviansk).
On 1 November, Ukrainian Commander-in-Chief Oleksandr Syrskyi assured the public that Russian forces have not encircled Pokrovsk and its nearby satellite town Myrnohrad (Donestk oblast), located to the east. However, he also noted that Russian units operating in the Pokrovsk agglomeration are systematically attempting to cut off supply routes. Geolocated footage over the past week has confirmed some notable Russian advances inside Pokrovsk, as well as in Myrnohrad to the east and Rodynske (Donetsk oblast) to the north, underscoring the growing threat on three exposed flanks. Syrskyi stated that the city’s defence will be reinforced with additional personnel, weapons and equipment, including drones.
The Russian forces have likely succeeded in infiltrating hundreds of soldiers inside Pokrovsk, amid a significant concentration of forces in the wider Pokrovsk region. On 29 October, Ukraine’s 7th Rapid Reaction Corps reported that Russian forces have concentrated an additional 11,000 personnel for the Pokrovsk effort alone; President Volodymyr Zelensky estimates that around 170,000 Russian personnel have concentrated across the wider Pokrovsk sector. It is almost certain that Russian forces significantly outnumber and overmatch Ukrainian forces, despite Ukraine’s successful counter-attacks to date. In particular, Ukrainian forces have successfully pushed back Russia’s positions to the north of Pokrovsk and to the east of Dobropillia, where a notable Russian penetration took place back in August. As of 2 November, it is highly likely that Ukrainian forces have retaken a significant proportion of the territory originally seized. This reflects Ukraine’s likely prioritisation of counter-attacking in this direction, likely in a mutually reinforcing operation aimed at relieving pressure on its forces defending Pokrovsk-Myrnohrad to the south.
The recent deployment of the Ukrainian special forces in the Pokrovsk sector reflects Ukraine’s capability to launch sophisticated counter-attacks, but it also likely highlights the growing concern among Ukrainian decision-makers as to the medium-term viability of its forward positions. On 31 October, Ukraine reportedly conducted a heliborne assault to insert special forces from the military intelligence (GUR) west of Pokrovsk. Ukrainian military intelligence sources told a Ukrainian outlet that the areas targeted by the operation had previously been claimed by Russian forces; the territory is critical for Ukrainian logistics. Russian sources, including the Russian Ministry of Defence (MoD), have denied Ukraine’s account, claiming that the operation was repelled and asserting that there were significant Ukrainian losses. While we cannot confirm how successful the operation was, the fact that it was launched (as confirmed by geolocated footage) raises questions about the density of Russia’s air defence umbrella around Pokrovsk. The density of drones should provide Russian forces with significant intelligence, surveillance and reconnaissance (ISR) capabilities, but these seemingly did not prevent the assault from taking place.
The gains made by Russian troops in Pokrovsk likely highlight continued improvements in their urban tactics compared with previous battles, such as in Avdiivka (Donetsk oblast; 2023-2024) and Bakhmut (Donetsk oblast; 2022-2023). A prominent Ukrainian military observer noted that Russian forces are taking a more systematic approach by mapping Ukrainian defences to identify logistics routes, drone teams and vulnerabilities. They then launch co-ordinated insertions into identified gaps to disrupt command-and-control (C2), logistics and strike operations rather than merely occupying ground. This was confirmed by a Ukrainian officer who stated on 31 October that Russian forces in Pokrovsk are deliberately targeting Ukrainian drone and mortar units to degrade Ukraine’s strike and counter-battery capabilities. Russian forces are also exploiting adverse weather, which limits Ukrainian drone efficiency, to penetrate Pokrovsk with groups of up to 30 to 40 personnel.
Ultimately, Russia’s gains are likely to increase pressure on Ukrainian decision-makers to either commit to a risky, protracted defence or organise a withdrawal to conserve capability. The deployment of GUR units likely indicates Kyiv’s determination to continue defending the city in the short term, given its strategic importance, as well as to facilitate evacuations and secure supply routes. However, failure to withdraw in time could produce a similar outcome to the final phase of the battle for Avdiivka in 2024, where a delayed retreat resulted in notable Ukrainian losses and the taking of prisoners.
Pokrovsk’s capture would likely provide Russian forces with an opportunity to build a semi-encirclement of Donetsk oblast’s so-called fortress-belt cities of Kramatorsk and Sloviansk further to the north in 2026. It ultimately remains unclear how strong Ukraine’s second-line defences are behind Pokrovsk or whether Russian forces will have exhausted themselves before opportunities emerge to advance further if the city falls. Capturing Pokrovsk would nevertheless provide opportunities for Russian forces to disrupt crucial Ukrainian military supply lines in arguably less advantageous, more rural terrain. Concurrently, the fall of Pokrovsk would enable Russia to continue operations towards Ukraine’s Dnipropetrovsk oblast, where it has already established a small foothold along the border with Donetsk oblast.
Beyond the battlefield, the Kremlin would highly likely use the capture of Pokrovsk to support its information operations aimed at Western leaders, including President Trump, to suggest that supporting Ukraine is not viable and that a Russian victory is inevitable. However, even if Pokrovsk does fall in the coming weeks and months, the battle will have been ongoing for over a year. Given that the battles for Bakhmut and Avdiivka before it were multi-year operations, it remains unlikely that Russian forces will be able to make much quicker progress in the much larger (and more heavily defended and defensible) fortress-belt cities of Donetsk oblast in the coming months.
Russian Cyber Strategy
Key points
• The development of Russia’s tactics, techniques and procedures (TTPs) will highly likely sustain cyber espionage risks to Ukraine’s government, critical national infrastructure (CNI) and defence sectors, as well as European NGOs in the long term.
• The current geopolitical landscape will highly likely continue to encourage a redirection of Russian cyber operations towards European countries. This trend will increase cyber espionage risks to government, CNI, defence, diplomatic and academic entities.
• European CNI will also face heightened operational risks as pro-Russia hacktivist groups increasingly demonstrate their intent and capability to compromise operational technology (OT) systems.
Context
In the first half (H1) of 2025, Ukraine recorded a total of 3,018 cyber incidents by Russian threat actors, which marked a 17.2% increase compared to the number of incidents (2,575) recorded in late 2024. During these attacks, Russian threat actors largely adopted new techniques of collecting data and informing ongoing kinetic action, highlighting a broader de-prioritisation of causing larger-scale disruption to Ukrainian CNI. At the same time, the US’ shifting stance towards NATO and Ukraine has precipitated an increase in Russian cyber operations against Europe, raising security and espionage risks for the region. These risks will likely persist over the medium-to-long term as the geopolitical landscape continues to inform Russia’s objectives in the cyber domain.
Forecast
The ongoing evolution of Russia’s TTPs will sustain cyber espionage risks to Ukrainian entities as the war persists
A cyber espionage operation (‘PhantomCaptcha’) targeted Ukrainian regional government administrations and NGOs involved in war relief efforts in October. Preparations for the campaign reportedly started in March and continued through to October, though the campaign itself was active for only one day, highlighting its-pre-meditated and surgical nature. In February, multiple Russia-backed groups infiltrated devices used by members of the Ukrainian military likely to exfiltrate tactical intelligence, further illustrating the increasingly targeted nature of data collection attacks.
At the same time, the PhantomCaptcha operation also employed a new social engineering technique (‘ClickFix’) to trick users into executing a remote access trojan (RAT) after completing a fake CAPTCHA verification page. This further highlights a broader technical and methodical shift in Russian operations. This shift was exemplified by two cyber attacks on at least two Ukrainian organisations by a Russia-backed group (‘Seashell Blizzard’) between June and August. Seashell Blizzard used Living-off-the-Land (LotL) techniques, typically considered uncommon for Russian threat actors, to avoid installing custom malware payloads and to enhance the operation’s stealth. As a result, the group was able to maintain prolonged persistence to facilitate reconnaissance, lateral movement and data exfiltration, marking a departure from previous resource-intensive operations.
The adaptation of Russia’s TTPs was also corroborated by a report published in July by the Computer Emergency Response Team of Ukraine (CERT-UA) that stated that a Russia-backed group (‘APT28’) had deployed an artificial intelligence (AI)-generated payload onto compromised systems in Ukraine. Later in October, CERT-UA confirmed that Russia is increasingly incorporating AI into its cyber operations, highlighting its adoption of modern technologies to streamline malware development. As a consequence, Ukrainian entities will face sustained cyber espionage and data-theft risks as Russia dynamically adapts its TTPs to the fluctuating demands of the war.
Russia will pose increased cyber espionage risks to European entities amid shifting geopolitical demands
In May, a joint investigation by Germany, France, the UK and the US revealed that a Russia-backed group (‘APT28’) had targeted European organisations involved in supplying defence, IT services and logistics support to Ukraine. In the same month, another Russia-backed group (‘Void Blizzard’) was reported to have targeted government and defence sector organisations across Europe in a cyber espionage operation that had been ongoing since at least 2024. Throughout the campaign, the group extracted emails, files and chat messages to collect strategic information pertaining to the war in Ukraine and Europe’s security posture. Later in October, the technology company Google also warned that another group (‘COLDRIVER’) had upgraded its malware, after it had been discovered by security researchers, to continue infiltrating European systems within the government and defence sectors, as well as journalists, think tanks and NGOs.
Europe’s continued support for Ukraine, alongside US President Donald Trump’s hostile rhetoric towards NATO and its shifting stance towards Ukraine, have likely influenced an incremental redirection of Russia’s cyber efforts towards the bloc. It is highly likely that this geopolitical landscape will continue to inform Russia’s cyber strategy in the medium term, therefore heightening cyber espionage risks to the aforementioned entities. These risks will also likely apply to European entities operating within Russia in light of a cyber attack on foreign diplomatic entities and embassies in the capital Moscow in February. During the attack, threat actors intercepted telecommunications and internet service providers (ISPs) to install malware and monitor communications, highlighting the increased infection risks stemming from an organisation’s supply chain.
In September, another Russia-backed group (‘APT29’) targeted Europe-based academics and other individuals who have been critical of Russia in a cyber espionage campaign that likely aimed to gather information and monitor communications. This operation aligns with a broader attempt by Russia to stifle anti-Russia dissent across Europe. Such operations are also likely to continue in the medium term.
• Global: Stealthy technique highlights heightened cyber espionage risks for Russia’s strategic targets. On 4 November, international news outlets reported that a Russian state-sponsored group (‘Curly COMrades’) had exploited the legitimate Microsoft feature Hyper-V to conduct stealthy cyber espionage operations since at least July. Reportedly, Curly COMrades enabled Hyper-V after infiltrating targeted systems, in order to deploy a lightweight Linux-based virtual machine (VM) within an organisation’s virtual environment. The group then used the VM to store two malicious payloads (‘CurlyShell’ and ‘CurlCat’), while simultaneously evading detection by traditional endpoint detection and response (EDR) mechanisms. Curly COMrades also renamed the VM after a legitimate Windows system to make malicious traffic appear legitimate, thereby enhancing the operation’s stealth. The group also employed PowerShell scripts to maintain prolonged persistence while the two payloads facilitated traffic obfuscation and command execution, highlighting the likely long-term nature of these attacks. We assess that Russia’s strategic targets face heightened security and cyber espionage risks amid the continuous evolution of Russia’s cyber capabilities.
Nov 03.
• Ukraine: Failure to secure EU loan backed by frozen Russian assets will worsen public finances. Earlier on 3 November, news outlet Politico reported that the EU’s failure to issue a loan to Ukraine backed by frozen Russian assets will reduce the likelihood of the International Monetary Fund (IMF) providing financial support to Kyiv. Anonymous EU officials cited by Politico stated that securing the loan is essential to convince the IMF that Ukraine remains financially viable in the coming years and to unlock further support from the international institution. However, Belgium has long opposed the use of Russian frozen assets for Ukraine’s benefit. IMF experts are expected to visit Ukraine in November to discuss a three-year support programme, with a decisive IMF meeting on the issue planned for December. EU leaders will also debate the use of Russian frozen assets on 18 to 19 December. Even if the EU agrees to such a loan, it will likely come too late to influence the IMF’s decision. Ultimately, failure to secure this crucial aid will highly likely undermine Ukraine’s fragile public finances, which are already projected to face a USD 19bn deficit.
• Ukraine: Democratic backsliding, particularly on corruption, will remain major bar to EU integration. On 3 November, the European Commission urged Ukraine to reverse a recent downturn in its anti-corruption efforts, while praising the country’s continued commitment to joining the EU. In July, President Volodymyr Zelensky signed a law that limited the independence of two anti-corruption agencies, triggering the largest protests since the start of Russia’s full-scale invasion in February 2022. These protests prompted Zelensky to withdraw the legislation and submit a new bill aimed at restoring the agencies’ independence (see Sibylline Special Report – 31 July 2025). The move threatened to seriously undermine the independence of the bodies, which together with recurring corruption cases, underscores the longstanding governance challenges facing the country’s EU integration. Embroiled in conflict with Russia and under martial law, Ukraine’s political system has undergone significant centralisation of power under the presidency, sparking criticism about the risks this poses to the country’s democratic standards. Ultimately, failure to improve governance and strengthen institutional independence will continue to undermine Ukraine’s already-limited prospects of EU membership but will also further erode public and private sector investor confidence in the meantime. (Source: Sibylline)
04 Nov 25. Exclusive: inside Ukraine’s new defence procurement structure.
In a bid to speed up delivery of key equipment, Ukrainian brigades are able to procure directly from manufacturers.
Oksana Ferchuk, Deputy Minister of Defence of Ukraine for Digital Development, Digital Transformation and Digitalization. Credit: IT Arena
• Dual-track procurement: traditional channels for lethal gear and DOT-Chain marketplace for rapid non-lethal buys
• Local funding, DOT-Chain, and “unique” postal service cut delivery from months to days
• Digitised administration (Army+, Reserve+, Impulse) improves recruitment, tracking, and real-time testing
As much as the Ukraine-Russia conflict is teaching Western nations about changing operational concepts on the modern-day battlefield, Ukraine is also able to demonstrate a new approach in equipment procurement and sustaining units in the field.
In an exclusive interview with Army Technology, Oksana Ferchuk, Deputy Minister of Defence of Ukraine for Digital Development, Digital Transformation and Digitalization discussed Ukraine’s evolved military procurement practises during a war where time is of the essence.
“Doing it [via traditional Western European procurement], you would spend months, years [waiting for delivery]. Now you are able to test in a week’s time, adjust your products and delivery gap,” Ferchuk said, speaking to Army Technology in Lviv in late-September 2025.
Ukraine’s “unique” postal service is also able to deliver systems to units in the field without risk of being uncovered via a security weakness or a loose paper trail.
Maintaining a two-pillar procurement structure, where lethal capabilities are acquired through more traditional government-led structures, along with the rapid delivery of non-lethal systems, such as drones, sensors, and electronic warfare (EW) systems, to battlefield units via the DOT-Chain platform.
Through the DOT-Chain digital marketplace, certain Ukrainian brigades order drones and other equipment direct from the manufacturer. This allows defence start-ups and SMEs to pitch directly to the customer, who can then provide feedback and quickly iterate, a key requirement for Ukraine’s ever-evolving battlefields.
“Each brigade actually has their own budget, supplied from the local communities because brigades are paying a lot of taxes,” said Ferchuk. “It was a decision made by the country that a portion of those taxes and the local authorities will return to the military units as a donation. In such a way, our brigades currently have their own budget, which they are able to spend to the specific tasks.”
With this funding, selected Ukrainian brigades can acquire platforms outside the usual acquisition structures, that could otherwise take significantly longer to deliver.
“When the government noticed that such direct procurement is working effectively, they started to allocate directly from Ministry of Defence. This is the reason why the brigade can procure directly, not everything, but in areas where the general staff and army commanders decide that it’s wise. It is working very well,” Ferchuk explained.
While Army Technology was in Ukraine, the country’s Ministry of Defence revealed that within two months of the launch of the DOT-Chain initiative, the country’s military had ordered nearly 17,000 UAVs worth about UAH 600m ($14.3m). Currently, 12 combat brigades in key sectors, including Kharkiv, Zaporizhzhia, Donetsk, and Kherson, are participating in the pilot project.
The process enabled the delivery of drones to be reduced “from months to just a few days”, stated Denys Shmyhal, Minister of Defence of Ukraine, at the time.
This approach, described by Ferchuk as “absolutely unknown to the conventional military sector”, has produced “amazing results”, with drones and other electronic systems constantly being updated.
With Russia’s EW and tactical-level doctrine changing on a monthly, if not weekly basis, this helps keep Ukraine’s frontline units operationally relevant.
“The innovation is happening in Ukraine. If you would like to be relevant to the battlefield of the current, let’s say, decade, you have to be present in Ukraine.
“If you are not present in Ukraine, trying to sell products with the old conventional methodology, most probably you will be out of this market. Not next year, not three, five years, but in ten years,” Ferchuk contended.
Ukraine also has an advantage over Western European countries in being able to test new systems in real time and contested environments. Given this, Ukraine’s defence sector had a distinct advantage over European counterparts in being able to test and iterate capabilities, validating concepts before going to market.
“The Ukrainian Army is a frontier to other countries as well. This is a trained m-person army that knows how to conduct modern war. Other armies… are far behind the current processes, trends, technologies, and tactics. The only way for them to understand it is to come and to see how it’s working,” explained Ferchuk.
“We’ve tried a lot to explain how it works online, workshops, seminars, webinars. It doesn’t work. You have to be on the frontline to understand how it’s done in reality.”
Digitisation of Ukraine’s administration
As reported by Army Technology in 2024, Ukraine has taken strides in digitising much of the administrative processes of the miliary and reserve services, bringing efficiencies at a time when the system itself has had to expand exponentially to manage the demands of the war.
This includes the development and launch of the Army+ and Reserve+ digital apps, aiding training and administration for existing personnel as well as future recruitment.
Ferchuk, who prior to Russia’s 2022 large-scale invasion had executive experience inside Ukraine’s telecommunications sector, described the Reserve+ app as “really successful” in finding a way to “communicate with your potential audience” and help prepare those at initial or early stages of determining eligibility and recruitment.
The Army+ initiative has since evolved with the launch a new version, dubbed Impulse, which is in rollout and acts as an analytical database to catalogue skillsets and needs of the individual soldier.
While such digital systems are increasingly common in the civil sectors, the adoption by Ukraine’s government for defence purposes is a distinct non-traditional approach.
“It’s a really complicated task, but we have to perform it. There is no other way. If such data, such important data, do not exist online and you cannot rely on it, then your processes and decision making can lead to the incorrect solutions,” Ferchuk said.
Ukraine-Russia war: update
Despite the coming onset of the winter season, Russia continues to make incremental gains in sporadic areas across the frontline, which has changed little through 2025.
However, recent reports indicate that Russian forces have gained access to parts of Pokrovsk, with forces operating with “increased comfort” inside the city, according to the Institute for the Study of War.
Claims and counterclaims by both sides make exact understanding as to the situation on the ground in Pokrovsk difficult.
According to Ukraine’s Ministry of Defence, the intensity of combat operations along the front “remained high” throughout October, registering an increase in the number of recorded combat engagements compared to the previous month.
In a 3 November release, Ukraine’s MoD stated that its Armed Forces has reported 5,480 combat engagement in October, regularly exceeding 200 actions per day.
In addition, in October Russian forces conducted almost 140,000 artillery strikes, including 3,353 launched from multiple launch rocket systems.
(Source: army-technology.com)
06 Nov 25. Circus SE (ISIN: DE000A2YN355 / Symbol: CA1), a global technology leader in autonomous AI robotics systems, today announces that Circus Defence has signed a framework agreement with BRAVE1, the Ukrainian government’s defence technology platform. The program, initiated by the Ministry of Digital Transformation, Ministry of Defence, the Armed Forces of Ukraine, and Military Innovation Technology Solutions (MITS), aims to integrate and scale next-generation defence technologies in Ukraine.
The agreement establishes a collaboration to deploy autonomous ground infrastructure systems, starting with Circus AI robotics nutrition supply systems at BRAVE1 facilities, with deployments set to begin immediately. Circus Defence will additionally use the government-owned program’s expertise to grow its AI robotics product portfolio, expanding beyond meal supply to next-generation autonomous defence systems.
The first deployment marks both the first deployment under the newly formed Circus Defence entity and the world’s first use in active defence operations – starting in Ukraine. The deployment will provide Ukrainian partners with an operational logistics and efficiency advantage through fully autonomous nutrition systems.
The delivery to Ukraine marks Circus Defence’s operational market expansion where the company will leverage its global mass-production capabilities and the upcoming start of European high-volume production.
About BRAVE1
BRAVE1 is the official defence technology coordination platform of the Government of Ukraine, launched on 26 April 2023 to bring together innovative companies, startups, and research institutions developing technologies that can strengthen Ukraine’s defence capabilities. Founded jointly by the Ministry of Digital Transformation, Ministry of Defence, General Staff of the Armed Forces, National Security and Defense Council, Ministry of Strategic Industries, and Ministry of Economy, BRAVE1 serves as a hub for accelerating the development and deployment of cutting-edge defence innovations across multiple domains.
About Circus Defence
Circus Defence SE is part of Circus SE, a global leader in autonomous AI robotics and dual-use infrastructure systems. The company develops modular, AI-driven autonomous infrastructure solutions for mission-critical environments, building on Circus’s patented technologies and proven expertise in meal supply robotics. From its European engineering base, Circus Defence is advancing mobile, containerized systems for rapid setup and autonomous operation — developed and manufactured in Europe, for Europe.
About Military Innovation Technology Solutions (MITS)
MITS Capital – an American-Ukrainian investment group established in early 2024 to connect Western capital with Ukraine’s battlefield innovation. The firm combines a venture fund, accelerator, and financial advisory, uniquely positioning it to scale dual-use and defense technologies. Its platform includes the MITS Accelerator, MITS Lightning Fund, an investment advisory unit, and MITS LAB Initiative, with a mission to bring global capital into Ukraine’s defense industrial base.
(Source: BUSINESS WIRE)
04 Nov 25. Joint Statement: 19th Ukraine Defence Contact Group – National Armaments Directors. Joint Statement from the National Armaments Directors of Ukraine, Germany and the United Kingdom, co-chairs of the Ukraine Defence Contact Group (UDCG). On Friday 31 October, the 19th UDCG-NAD meeting took place at the NATO Headquarters in Brussels. National Armaments Directors (NADs) from over 40 nations and international agencies met, continuing to demonstrate the international resolve to provide enduring support to Ukraine through defence industrial cooperation and military assistance.
At the meeting, the Deputy Minister of Defence of Ukraine, Serhii Boyev, delivered an operational update on the current situation in Ukraine and their defence requirements. Significant time was also dedicated to discussing potential opportunities for future collaboration in supporting Ukraine’s defence needs, showcasing the groups continued and coordinated support.
NADs are now working together to ensure that commitments made in the Ministerial UDCG are rapidly delivered to ensure Ukraine’s long-term security and sovereignty. (Source: https://www.gov.uk/)
03 Nov 25. Ukraine gets more Patriot air defenses to counter Russian attacks — Ukraine has received more American-made Patriot air defense systems to help it counter Russia’s daily barrages, President Volodymyr Zelenskyy said, as Russian drones killed a man and injured five of his family members, including two children, in the latest nighttime attack.
Russia’s relentless pounding of urban areas behind the front line following its full-scale invasion of Ukraine nearly four years ago has killed thousands of civilians. It has also targeted the energy supply to deny civilians heat and running water in winter, as well as disrupt industrial production of Ukraine’s newly developed drones and missiles.
The sophisticated Patriot systems are the most effective weapon against Russian missiles. Zelenskyy has pleaded with Western partners to provide more of them, but production limitations and the need to maintain stockpiles have slowed their delivery.
“More Patriots are now in Ukraine and being put into operation,” Zelenskyy said on social media late Sunday. “Of course, more systems are needed to protect key infrastructure sites and our cities across the entire territory of our state.”
He thanked Germany and its Chancellor Friedrich Merz for the Patriots. Germany said three months ago it would deliver two more Patriot air defense systems to Ukraine. It agreed to the move after securing assurances that the U.S. will prioritize the delivery of new Patriots to Germany to backfill its stocks. Patriot systems are made only in the U.S.
NATO is coordinating regular deliveries of large weapons packages to Ukraine. European allies and Canada are buying much of the equipment from the United States, which has greater stocks of ready military materiel, as well as more effective weapons. The Trump administration is not giving any arms to Ukraine, unlike the previous Biden administration.
Russia launched 12 missiles of various types and 138 strike and decoy drones at Ukraine overnight from Sunday to Monday, Ukraine’s air force said. On some nights it has fired many hundreds of drones and missiles at Ukraine.
In Ukraine’s northeastern Sumy region, Russian drones hit a house where they killed a man and injured five members of his family, authorities said. Two women were also injured in a separate Sumy attack.
“The Russians cynically targeted people — deliberately, at night, while they were sleeping,” regional head Oleh Hryhorov wrote on Telegram in response to the attacks.
Russian missiles started a fire at a business in the central Dnipro region, injuring one man, regional head Vladyslav Haivanenko said.
Russian drones have also struck energy infrastructure in the southern Mykolaiv region.
At the same time, Ukraine has been trying to constrain Russia’s oil industry, a mainstay of its economy.
Ukrainian forces struck Russia’s Saratov oil refinery overnight and started a fire, according to Ukraine’s general staff. It was Ukraine’s fourth attack on the Saratov installation in almost seven weeks.
The refinery, located some 500 kilometers (300 miles) from the Ukrainian border, can process several m metric tons of oil a year.
Zelenskyy claimed last week that long-range strikes on Russian refineries have reduced Moscow’s oil refining capacity by 20%. (Source: Defense News)
31 Oct 25. Russia uses missile in Ukraine that led Trump to quit nuclear treaty, Kyiv says.
• Summary
• Russia uses 9M729 missile in Ukraine, Kyiv says
• The 9M729 was at heart of arms control dispute in 2019
• The missile can carry a conventional or nuclear warhead
Russia has in recent months attacked Ukraine with a cruise missile whose secret development prompted Donald Trump to abandon a nuclear arms control pact with Moscow in his first term as U.S. president, Ukraine’s foreign minister said.
Andrii Sybiha’s comments are the first confirmation that Russia has used the ground-launched 9M729 missile in combat – in Ukraine or elsewhere.
Russia has fired the missile at Ukraine 23 times since August, a second senior Ukrainian official told Reuters. Ukraine also recorded two launches of the 9M729 by Russia in 2022, the source said. (Source: Reuters)
——————————————————————————————————————————————————————————————————————————————————————————————————————————
Founded in 1987, Exensor Technology is a world leading supplier of Networked Unattended Ground Sensor (UGS) Systems providing tailored sensor solutions to customers all over the world. From our Headquarters in Lund Sweden, our centre of expertise in Network Communications at Communications Research Lab in Kalmar Sweden and our Production site outside of Basingstoke UK, we design, develop and produce latest state of the art rugged UGS solutions at the highest quality to meet the most stringent demands of our customers. Our systems are in operation and used in a wide number of Military as well as Homeland Security applications worldwide. The modular nature of the system ensures any external sensor can be integrated, providing the user with a fully meshed “silent” network capable of self-healing. Exensor Technology will continue to lead the field in UGS technology, provide our customers with excellent customer service and a bespoke package able to meet every need.
A CNIM Group Company
—————————————————————————————————————————————————————————————————————————————————————————————————————————–