UAV INGRESS TOWARD KHARKIV (0111Z, UAF Air Force, HIGH): Loitering munitions (Shahed/Geran type) detected on the border of Sumy and Kharkiv regions, moving on a vector toward Kharkiv city.
ZAPORIZHZHIA AIR ALERT (0130Z, Zaporizhzhia OVA, HIGH): An emergency "Attention" alert has been issued for the Zaporizhzhia region. While the specific threat (missile vs. drone) is not yet specified, the timing aligns with the expected strike window.
INTERNAL RUSSIAN CYBER EXPLOITATION (0121Z, TASS, MEDIUM): Reports of phishing/fraud targeting Russian "Gosuslugi" (State Services) accounts by individuals posing as government officials. This indicates domestic exploitation of the current heightened security state.
Operational picture (by sector)
Northern/Kharkiv Vector:
Battlefield Geometry: The threat has expanded from localized KAB strikes in Sumy (reported 0039Z) to a deeper UAV ingress toward Kharkiv city (0111Z). This suggests a multi-layered suppression of air defenses (SEAD/DEAD) or an attempt to saturate the regional AD network prior to a larger missile wave.
Environmental Factors: Night operations favor the use of loitering munitions and tactical aviation using stand-off munitions (KABs).
Southern Vector (Zaporizhzhia):
Disposition: The emergency alert (0130Z) suggests immediate kinetic threat. This sector is critical for both the land bridge security and UAF logistics supporting the southern front.
Donbas Sector (Bakhmut/Kramatorsk Axis):
No new updates since 0035Z. Previous reports of FPV interdiction on UAF logistics in Druzhkivka/Novoandriivka remain the current tactical baseline.
Enemy activity / threat assessment
1. Capabilities and Intentions:
UAV Operations: The movement of UAVs from the Sumy border toward Kharkiv (0111Z) indicates the Russian "Sever" group is coordinating with long-range aviation to create a "corridor" or provide reconnaissance for the 0200Z strike window.
Cyber/Hybrid: The TASS report (0121Z) regarding Gosuslugi scams suggests a breakdown in domestic administrative security or a criminal exploitation of the Kremlin's "Negotiation by Fire" narrative.
2. Courses of Action:
Most Likely COA (MLCOA): A coordinated strike involving the loitering munitions currently over Kharkiv and the unspecified threat in Zaporizhzhia, potentially coinciding with a mass missile launch from Tu-95MS platforms within the next 30-90 minutes.
Most Dangerous COA (MDCOA): Simultaneous kinetic strikes on the energy grid and C2 hubs, combined with a synchronized cyberattack on Ukrainian critical infrastructure to paralyze the response during the early morning hours.
Friendly activity (UAF)
Air Defense: UAF Air Force is actively tracking and reporting UAV vectors. Zaporizhzhia regional authorities have transitioned to an emergency alert posture (0130Z).
Force Protection: Units in the Kharkiv-Sumy corridor must maintain high readiness for both kinetic impact and subsequent ground incursions if the "bulge" at Staritsa is exploited.
Information environment / disinformation
Russian Domestic Context: The TASS report on Gosuslugi fraud (0121Z) may be used to mask state-sponsored data collection or simply reflects the chaotic domestic environment during the winter offensive.
Alert Fatigue: The frequent alerts (Sumy, Kharkiv, Zaporizhzhia) are part of the enemy's psychological operation to induce fatigue in both civilian populations and AD crews.
Outlook (next 6-12h)
CRITICAL WINDOW: The 0200Z–0600Z window is now high-risk. The detected UAV movement toward Kharkiv (0111Z) and the Zaporizhzhia alert (0130Z) are likely the leading edge of a larger engagement.
Targeting: Expect emphasis on Kharkiv and Zaporizhzhia urban centers and energy infrastructure.
Intelligence gaps & collection requirements
[CRITICAL] Immediate identification of the threat type in Zaporizhzhia (Ballistic vs. Cruise vs. Drone).
[HIGH] Confirmation of Tu-95MS launch activity or Black Sea Fleet missile carrier movement.
[MEDIUM] Assessment of whether the Gosuslugi "scams" are a cover for a wider Russian domestic mobilization/data-scrubbing effort.
