Serhii "Flash" Beskrestnov, an adviser to Ukraine's president on defense technology, said on 2 August 2026 that Russian forces are collecting downed or crashed Ukrainian drones, repairing them, and preparing them for future use - a capability he linked to potential false-flag operations against NATO members. "I can tell you with certainty that the enemy is collecting our surviving drones, repairing them, and preparing them for future provocations," Beskrestnov wrote in a Facebook post reported by United24 Media.
The claim rests on interceptor footage showing aircraft with the design characteristics of Ukraine's FP-1 and FP-2 long-range strike drones operating under apparent Russian control - airframes that should not exist on the Russian side unless recovered from Ukrainian territory and rebuilt.
Why a Ukrainian-made drone striking NATO territory would be a propaganda weapon
A drone strike on Polish, Baltic, or Romanian territory using genuine Ukrainian hardware would let Moscow point to Ukrainian components regardless of who launched it. The tactic would not need to fool investigators indefinitely - it only needs enough ambiguity to blunt the immediate diplomatic response and feed a narrative that Ukrainian weapons, not Russian ones, are destabilizing NATO's eastern flank. That framing directly targets the political case for continued Western military aid.
Polish Defence Minister Władysław Kosiniak-Kamysz raised a related warning in July 2026, saying Russia had recovered a significant number of Ukrainian drones over the course of the war - the recovery pipeline Beskrestnov's claim assumes already existed before the repair and reuse allegation surfaced.
The claim lands three days after a confirmed Russian munition crossed 97 km into Poland
On 30 July 2026, a Russian Kh-101 cruise missile crossed into Polish airspace and crashed in the Lublin region, roughly 97 km inside NATO territory - unambiguously Russian hardware, confirmed by Polish and Ukrainian officials (see AirVeto's Tarnawa-Kolonia coverage). A rebuilt-Ukrainian-drone incident, if one occurs, would land in the same stretch of airspace under a starkly different evidentiary picture: Ukrainian-origin components with no confirmed operator, precisely the ambiguity a false-flag operation would be designed to produce.
Lithuania's own military intelligence confirmed the threat pattern on 6 August
Robertas Kaunas, defence minister of NATO member Lithuania, confirmed on 6 August that Lithuanian military intelligence assesses Russia is considering exactly this kind of operation. "We have data that Russia is considering unconventional kinetic strikes against critical infrastructure in the Baltic region. It's likely Russia could use Ukrainian-made drones for that," Kaunas told 15min.lt, which said it was the first outlet to report the officially confirmed assessment. The ministry did not disclose specific targets or a timeline.
15min.lt named the tactic directly as a "false flag" operation, in which a state carries out an act while creating the impression another state did it. Under NATO's Article 5, a strike against one member is treated as a strike against all; ambiguity over who launched it is the point of the tactic, not a side effect, since it gives Moscow room to contest whether Article 5 applies at all. Lithuania's military has reinforced protection this year at the Klaipėda LNG terminal, the LitPol Link power connection in Alytus, an Alytus-district transformer substation, and the Kruonis pumped-storage hydroelectric plant.
Geopolitics and Security Studies Centre director Linas Kojala told 15min.lt that battlefield pressure on Russian forces, not strength, is the likely driver: provocations against NATO members are a way to try to unsettle Western support for Ukraine precisely when that support (70 billion euros in EU and bilateral aid pledged for the year) has held steady.
A Ukrainian-type drone crossed into Bulgaria on 8 August, but officials say it was not deliberate
A drone crossed from Romania into Bulgarian airspace and exploded near Kardam, close to Bulgaria's Trans-Balkan gas pipeline compressor station, on 8 August 2026. Bulgaria's Defence Ministry identified it as a likely Maya decoy drone, a type widely used by Ukraine's armed forces, and said there was no reason to believe the incident was deliberate (see AirVeto's Kardam coverage). Ukraine denied targeting Bulgaria.
The incident carries elements the warnings above describe: Ukrainian-type hardware, NATO territory, and proximity to energy infrastructure. Attribution rested on a preliminary military assessment, not an independent investigation. Bulgaria's own assessment cuts against a false-flag reading specifically, since a false flag is deliberate by definition. AirVeto is not treating Kardam as an instance of the pattern described in this piece, only as a reference point for what an ambiguous-attribution incident on NATO territory looks like when one occurs.
What is confirmed and what is not
The original recovery-and-repair claim came from a single named source, a Ukrainian government adviser, not an independent forensic investigation. Lithuania's 6 August confirmation changes that: a NATO member's own military intelligence, on the record through its defence minister, now assesses the same threat as plausible. No strike using a rebuilt drone has occurred as of this writing, and neither Lithuania nor any other government has disclosed a specific target or timeline. AirVeto is tracking this as a confirmed intelligence assessment of a risk, not a confirmed incident; a future strike bearing Ukrainian-drone characteristics on NATO territory would still need independent attribution before AirVeto would treat it as executed rather than warned-of.
A full record of airspace incidents over NATO's eastern flank is at the incident archive.