Russia has crossed another red line, and NATO and the EU have to figure out how to respond.

On October 14, 2026, Yara J, a Comoros-flagged tanker, came under drone attack near the port town of Sulina on Romania’s Black Sea coast. This was in the country’s territorial waters, not the Exclusive Economic Zone (EEZ) where previous attacks had happened.

The incident is anything but a one-off. In the same month, a total of seven ships have been hit by both aerial and submarine devices along the same stretch of EU and NATO shoreline. Twenty-seven crew are either confirmed dead or missing at sea.

This is part of Moscow’s campaign to stifle Ukraine by disrupting its maritime trade. But it also shows that the Black Sea faces a double whammy of horizontal and vertical escalation. Russian strikes are now spilling over into Romanian and Bulgarian jurisdictions—a horizontal escalation. At the same time, intensified hybrid operations such as acts of sabotage up the ante on land—a vertical escalation. NATO and the EU are scrambling to find the right response. Directly or by proxy, Russia is de facto prosecuting its war on the union’s and the alliance’s territories, both at sea and on land.

Beyond calling out Russia, the EU is grappling with the question of how to deter hybrid attacks that fall under NATO’s Article 5 collective defense threshold. Several hurdles are shortchanging a more resolute response. Security services still struggle to effectively cooperate across borders and the EU’s division of labor with NATO, along with a reluctance to use offensive responses, remain challenging.

With Ukraine’s severely diminished access to early warning intelligence following U.S. restrictions, its interceptor stocks running low, and its Starlink satellite access reportedly being throttled at the behest of the Trump administration, Russia is trying to press its advantage as winter arrives.

This shift in favor is being felt in the Black Sea, too. Ports like Odesa, Chornomorsk, and Pivdennyi, which handle 95 percent of Ukraine’s grain exports, are under constant threat. Using neighboring Romania as a gateway is no solution either. Grain-carrying ships coming out of Galați, a port city on the Danube, have also been struck. Despite calls for a deal to restore freedom of navigation, notably from Turkey, it appears that Moscow will press ahead. And now it is trespassing into Romania’s sovereign domain, which is in theory covered by NATO’s collective deterrent. Officials in Bucharest have reported at least six incursions of Russian drones, two of which were shot down by an F-16 fighter on October 17. That hints at Russia’s readiness to take risk.

This can all be seen as part of the intensified hybrid warfare Russia has been waging against Europe. Bulgaria is a case in point: In August and September, there were explosions at weapons depots. On the night of October 9–10, eleven antennas at a classified Starlink facility near Sofia were set on fire. Arrest warrants have been issued for two German nationals suspected of carrying out the arson. The incident mirrors an earlier attack at a Starlink ground station in Poland, where Russian involvement has been speculated.

In Brussels, Bulgarian Prime Minister Rumen Radev is ironically one of the loudest voices in favor of reestablishing economic ties with Moscow and talking to Russian President Vladimir Putin. Bulgaria has also pulled out of the so-called coalition of the willing backing Ukraine, a decision the government in Sofia presented as serving the cause of peace. The caretaker President Iliana Iotova shares Radev’s views and is hoping to garner the Russophile vote in the presidential election scheduled for October 25.

Yet, their pro-Russian positions have not shielded the country from these attacks, with both figures reluctant to call Moscow out. Nevertheless, behind the scenes, Radev appears to be pleading for help to NATO and the United States. The moral of the story is that being friend or foe makes little difference to the Russians. They will look for opportunities and soft targets to strike at Ukraine and its Western supporters.

Romania, a Russia skeptic, and Bulgaria, a dove, have been following the same course in responding to the threat. They have pleaded for expanding NATO’s presence in the Black Sea. The alliance’s decisionmaking body, the North Atlantic Council, is set to meet at Bucharest and Sofia’s request—though neither country has invoked Article 4, the trigger for a formal consultation process on whether the countries’ territorial integrity is at stake. The European Council condemned the attacks on civilian shipping and called for the restoration of navigation. And the Bulgarian minister of defense is now saying that the country will join NATO’s anti-drone initiative, too, having previously said it wouldn’t.

Obviously, it is for the alliance to deal with the escalation at sea, for two reasons: Article 5 is being tested, and Romania and Bulgaria are pushing to set up a regional command with Turkey, a prominent NATO ally but not a member of the EU. The Turkish-Romanian-Bulgarian mine clearance naval mission could have its mandate broadened to monitor the territorial waters of all three countries and enforce freedom of navigation. NATO might also ramp up air policing in the Black Sea to convey a clear signal to Russia. Ankara can play a key diplomatic role as well, owing to its ties to Moscow.

A show of strength will not necessarily solve the problem. In all likelihood, it will contain the strikes deeper into the Romanian and Bulgarian EEZs. Preventing escalation in the Black Sea would be no mean feat. But at the end of the day, it is for Ukraine and its Western allies to find a counter to the Russian drone challenge and, hopefully, restore commercial shipping out of Odesa and other ports.