Nightwatch
Intelligence archive
Historical intelligence

Situation Report

Archived operational intelligence briefing retained for historical analysis.

Intelligence brief / archived issue

Situation Update (UTC)

Report generated 2026-09-27 12:27 UTC. New evidence is drawn from supplied messages timestamped 2026-09-27 11:58:07–12:26:04 UTC. The previous situation report is used only as a dated baseline where noted; the previous daily report is treated as broad historical context only and is not independent corroboration. Air-raid alerts are official Ukrainian Air Force statements but do not by themselves confirm impacts.

Key reported developments

  • Ukrainian President Volodymyr Zelensky and the Ukrainian General Staff said there were “important results” on the Lyman direction in Donetsk Oblast under operation “Vivaldi” and by the Air Assault Forces group in another active-defence operation, following a report by Commander-in-Chief Mykhailo Drapatyi. They claimed Ukrainian units killed or wounded 10,660 Russian service members across active front sections this week, with each loss accompanied by video confirmation, and named Pokrovsk, Kostiantynivka and Lyman as the most intense areas, while praising the 3rd Army Corps and the 68th Separate Aeromobile Brigade named after Oleksa Dovbush of the 8th Air Assault Corps. (Event time: week to 27 Sep 2026; sources: Генеральний штаб ЗСУ, 12:10:19; ЦАПЛІЄНКО_UKRAINE FIGHTS, 12:04:23; confidence HIGH for the statement being made, LOW for the casualty figure.)
  • Russian-aligned channel НгП раZVедка claimed that objects of 14 large players on the Ukrainian communications market had been attacked: Домонет, Cosmonova, Faust, Kievnet, UTELS, Павутина, Etherlink, Crazy Network, КОЛО.ТВ, Датагруп, Cityhost, MiroHost, Vodafone and Киевстар. The post added that this was “little” and that “Kyiv should have no connection apart from Starlinks.” No independent evidence of the claimed attacks was supplied. (Event time: not stated; source: НгП раZVедка, 12:19:14; confidence LOW.)
  • RBC-Ukraine relayed a statement attributed to Oksana Ferchuk that the past day was difficult for Ukraine’s digital and telecommunications infrastructure, thanking emergency services, city and oblast services, electronic communications operators, energy and infrastructure companies, and industry specialists for resilience and rapid response. The post’s caption called the speaker “head of the Ministry of Digital Transformation,” while the same post’s accompanying assessment noted an attribution conflict because Oksana Ferchuk is widely known as head of the State Service of Special Communications and Information Protection, not the Ministry of Digital Transformation. (Event time: “past day” relative to post; source: РБК-Україна, 12:10:06 and 12:10:07; confidence MEDIUM for the official statement, LOW for the role attribution.)
  • Zaporizhzhia regional official Михайло Семікін reported work in the frontline Novomykolaivka and Kushuhum communities, saying roads and lighting were being restored, security and logistics protection strengthened, humanitarian aid moved closer to people, and winter preparations under way. He said all boiler houses in Zaporizhzhia were 100% technically ready for the heating season; the accompanying assessment said the video claimed 90% of residents had left Novomykolaivka and showed a damaged multi-story brick building with a collapsed roof and a damaged residential house. (Event time: week reported to 27 Sep 2026; source: Михайло Семікін - Запорізька ОВА, 12:00:37 and 12:00:38; confidence MEDIUM-HIGH for the video’s existence and visible damage, LOW for the quantitative claims.)
  • Russian-aligned channel Два майора relayed a claim that Ukrainian company Pegasus Arms had suspended UAV production indefinitely after a reported Russian ballistic missile strike severely damaged its production workshop in Kyiv in the night of 23–24 September. The post cited Russian MoD data that the workshop was used for large- and medium-range UAV production, including aircraft-type drones, while noting the company itself had not published data on such drones. The same post noted a date inconsistency: the company-style graphic referred to 23–24 September 2026, while a previous strike was dated 2 September 2025. (Event time: night of 23–24 Sep as claimed; source: Два майора, 12:18:10 and 12:18:11; confidence LOW to MEDIUM for the product imagery, LOW for the strike and production-halt claims.)
  • Kotsnews relayed an IRGC claim that Iran captured another U.S. underwater drone, identified as a Remus 600, in the Strait of Hormuz after detecting it with intelligence, suppressing it with electronic warfare, and taking it for data extraction. The post said the Pentagon had not responded and cited a prior 8 September IRGC recovery of a Dive-LD vehicle made by Anduril, which CENTCOM reportedly described as an old model that had broken down and was “dead in the water.” (Event time: not stated; source: Kotsnews, 11:58:07 and 11:58:08; confidence LOW.)
  • SOTA relayed that RIA Novosti briefly published and then deleted a column by Alexander Nosovich titled “Russia awaits another SVO. It will be very short,” which threatened nuclear bombardment of Lithuania over the possible placement of NATO nuclear weapons there. SOTA said Dmitry Kiselev, general director of MIA Rossiya Segodnya, called the publication a “technical oversight” and said no Russian official had announced another “SVO.” The attached screenshot was said to show the RIA Novosti page dated 08:00 25.09.2026 with 20,910 views. (Event time: column dated 25 Sep 2026, deleted after publication; source: SOTA, 12:13:53 and 12:13:54; confidence MEDIUM for the column’s existence and headline, LOW for Kiselev’s explanation.)
  • ЦАПЛІЄНКО_UKRAINE FIGHTS relayed a report attributed to Insider UA that Poland’s Ministry of National Defence offered to host a Patriot missile production plant on Polish territory if Ukraine obtains the necessary licenses, saying such production would be safe in Poland while in Ukraine it could be destroyed during construction. No named official, date, Polish MoD document or link was supplied. (Event time: not stated; source: ЦАПЛІЄНКО_UKRAINE FIGHTS, 12:18:35 and 12:18:36; confidence LOW.)

Reported situation by area

  • Donetsk Oblast: Zelensky and the Ukrainian General Staff claimed important results on the Lyman direction under operation “Vivaldi” and named Pokrovsk, Kostiantynivka and Lyman as the most intense areas. No new geolocated ground or impact reports for these locations appeared in this batch. The prior SITREP baseline also carried the same Lyman/Vivaldi claim. (Sources: Генеральний штаб ЗСУ, 12:10:19; ЦАПЛІЄНКО_UKRAINE FIGHTS, 12:04:23; confidence HIGH for the statement, LOW for operational effect.)
  • Zaporizhzhia Oblast: The Zaporizhzhia regional official reported infrastructure restoration and winterization in Novomykolaivka and Kushuhum communities, claimed 90% of Novomykolaivka residents had left, and said all Zaporizhzhia boiler houses were 100% ready for the heating season. Ukrainian Air Force reported a jet drone heading toward Zaporizhzhia from the south. A Russian-aligned fundraising post sought equipment for a “Zaporizhzhia direction” assault company and UAV unit. No impacts were reported in this batch. (Sources: Михайло Семікін - Запорізька ОВА, 12:00:37 and 12:00:38; Повітряні Сили ЗС України, 12:21:39; Дневник Десантника🇷🇺, 12:01:01; confidence MEDIUM-HIGH for the official video, LOW for metrics and air-alert implications.)
  • Kharkiv Oblast: Ukrainian Air Force reported a UAV over Prolisne from the east of Kharkiv Oblast and a UAV heading toward Kharkiv from the north. No impacts were reported in this batch. The prior SITREP baseline noted a Russian-aligned claim about Khripuny, but this batch adds no new ground evidence for Kharkiv Oblast. (Sources: Повітряні Сили ЗС України, 12:02:17 and 12:22:30; confidence MEDIUM for the alerts only.)
  • Dnipropetrovsk and Kirovohrad Oblasts: Ukrainian Air Force reported jet drones west of Kryvyi Rih heading toward Kirovohrad Oblast, north of Dnipro heading west, and toward Kropyvnytskyi. No impacts were reported in this batch. (Source: Повітряні Сили ЗС України, 12:09:56, 12:16:52 and 12:26:04; confidence MEDIUM for the alerts only.)
  • Mykolaiv and Odesa Oblasts: Ukrainian Air Force reported jet drones on the Mykolaiv/Odesa border heading north and in western Mykolaiv Oblast heading toward Odesa Oblast. No impacts were reported in this batch. (Sources: Повітряні Сили ЗС України, 12:09:56 and 12:16:52; confidence MEDIUM for the alerts only.)
  • Sumy, Chernihiv and Poltava Oblasts: Ukrainian Air Force reported jet drones in western Sumy Oblast heading south-west, in western Chernihiv Oblast heading south, at Sosnytsia in Chernihiv Oblast from the east, and between Poltava and Kremenchuk heading west. No impacts were reported in this batch. (Source: Повітряні Сили ЗС України, 12:16:52 and 12:20:42; confidence MEDIUM for the alerts only.)
  • Kyiv city: Два майора relayed a claim that a Pegasus Arms UAV production workshop in Kyiv was severely damaged in the night of 23–24 September and that production was suspended indefinitely. RBC-Ukraine separately relayed a statement that the past day was difficult for Ukraine’s digital and telecommunications infrastructure, without naming locations or damage specifics. (Sources: Два майора, 12:18:10; РБК-Україна, 12:10:06; confidence LOW for the workshop damage claim, MEDIUM for the infrastructure statement.)
  • Russia/Moscow: SOTA relayed the RIA Novosti column about Lithuania, its deletion and Kiselev’s explanation. Новости Москвы relayed a claim by the head of the “Sovet ZhKKh” association that housing and utility tariffs should be 40% higher and lag inflation by almost 40%, with the sector losing RUB 1.27 trillion annually and 62% of enterprises unprofitable. SOTA also relayed Moscow politician Varvara Kosheleva’s account that she and her spouse were beaten after midnight by unidentified men who claimed to be SVO veterans, and that she was diagnosed with concussion and bruises. (Sources: SOTA, 12:13:53 and 12:22:13; Новости Москвы, 12:08:42; confidence MEDIUM for the RIA column existence, LOW for the other claims.)

Reported strikes and air-defense activity

  • Ukrainian Air Force issued multiple UAV and jet-drone alerts: a UAV over Prolisne from eastern Kharkiv Oblast; jet drones on the Mykolaiv/Odesa border heading north, west of Kryvyi Rih toward Kirovohrad Oblast, north of Dnipro heading west, and in western Chernihiv Oblast heading south; a UAV course toward Kharkiv from the north; jet drones in western Sumy Oblast heading south-west, toward Kropyvnytskyi from the south, in western Mykolaiv Oblast toward Odesa Oblast; jet drones between Poltava and Kremenchuk heading west and at Sosnytsia in Chernihiv Oblast; a jet drone toward Zaporizhzhia from the south; and a jet drone toward Kropyvnytskyi. Alerts describe directions of travel and do not by themselves confirm impacts. (Sources: Повітряні Сили ЗС України / Air Force of the Armed Forces of Ukraine, 12:02:17–12:26:04; confidence MEDIUM for the alerts only.)
  • Два майора relayed a claim that a Russian ballistic missile strike severely damaged the Pegasus Arms UAV production workshop in Kyiv in the night of 23–24 September, causing indefinite suspension of production. The attached images were product and promotional images, not battle-damage documentation. (Source: Два майора, 12:18:10 and 12:18:11; confidence LOW.)
  • НгП раZVедка claimed attacks on objects of 14 Ukrainian communications-market players and called for Kyiv to have no connection apart from Starlinks. No technical evidence, locations or damage assessments were supplied. (Source: НгП раZVедка, 12:19:14; confidence LOW.)
  • No other specific strike impacts were reported in the supplied new messages.

Reported Russian activity

  • Russian-aligned channel Дневник Десантника🇷🇺 posted a fundraising appeal for an assault company and UAV unit, requesting one Mavic 3pro at RUB 170,000, four Matrix 4T at RUB 1,120,000, and 15 generators of 2.5 kW at RUB 220,000, with a stated collection goal of RUB 1,510,000. The post said RUB 15,136 had been collected and RUB 939,124 remained to be collected, figures that do not arithmetically reconcile as stated. It mentioned the Zaporizhzhia direction. (Event time: not stated; source: Дневник Десантника🇷🇺, 12:01:01; confidence MEDIUM for the post’s existence, LOW for the financial figures.)
  • Два майора relayed Russian MoD data that the damaged Kyiv workshop was used for production and storage of large- and medium-range UAVs, including aircraft-type, while noting the company itself had not published data on such drones. The post also speculated that public Ukrainian claims of complete destruction or cessation of production can mask relocation, time-buying, or financial discrepancies, an interpretive claim rather than evidence. (Source: Два майора, 12:18:10 and 12:18:11; confidence LOW.)
  • НгП раZVедка claimed Russian-aligned attacks on 14 Ukrainian communications providers and called for Kyiv to be left without connection apart from Starlinks. (Source: НгП раZVедка, 12:19:14; confidence LOW.)
  • SOTA relayed that RIA Novosti briefly published and deleted a column threatening nuclear bombardment of Lithuania, and that Dmitry Kiselev called it a technical oversight and said no Russian official had announced another “SVO.” (Source: SOTA, 12:13:53 and 12:13:54; confidence MEDIUM for the column, LOW for the explanation.)
  • Fighterbomber posted a single undated photo captioned as the “standard bulletin board of an ordinary fighter regiment,” showing handwritten Cyrillic graffiti on a white missile or store mounted on an АКУ-470 pylon. The accompanying assessment said the image is internally consistent with Russian tactical aircraft hardware but does not establish unit identity, location or date. (Source: Fighterbomber, 12:15:10 and 12:15:11; confidence LOW.)
  • Новости Москвы relayed a claim by the head of the “Sovet ZhKKh” association that Russian housing and utility tariffs should be 40% higher and lag inflation by almost 40%, with the sector losing RUB 1.27 trillion annually and 62% of enterprises unprofitable. (Source: Новости Москвы, 12:08:42; confidence LOW.)
  • SOTA relayed Varvara Kosheleva’s account that she and her spouse were attacked after midnight near their Moscow home by men who claimed to be SVO veterans; she reported concussion and bruises and said she filed a police statement. The post did not provide independent confirmation of attacker identity or motive. (Source: SOTA, 12:22:13 and 12:22:14; confidence LOW for the attribution, MEDIUM for visible injury in the supplied photo.)

Reported Ukrainian activity

  • Zelensky and the Ukrainian General Staff said Ukrainian forces achieved important results on the Lyman direction in Donetsk Oblast under operation “Vivaldi” and by the Air Assault Forces group in another active-defence operation. They claimed 10,660 Russian service members killed or wounded across active front sections this week with video confirmation, named Pokrovsk, Kostiantynivka and Lyman as the most intense areas, and praised the 3rd Army Corps and 68th Separate Aeromobile Brigade named after Oleksa Dovbush of the 8th Air Assault Corps. (Sources: Генеральний штаб ЗСУ, 12:10:19; ЦАПЛІЄНКО_UKRAINE FIGHTS, 12:04:23; confidence HIGH for the statement, LOW for the casualty figure.)
  • The Zaporizhzhia regional official reported restoration of roads and lighting in Novomykolaivka and Kushuhum communities, moving humanitarian aid closer to people, preparing for winter, opening the first veterans’ care space in Zaporizhzhia, psychological check-ups in schools, and arranging rest and rehabilitation in Bulgaria for children of military personnel. He claimed all Zaporizhzhia boiler houses were 100% ready for the heating season. (Source: Михайло Семікін - Запорізька ОВА, 12:00:37 and 12:00:38; confidence MEDIUM-HIGH for the official video, LOW for the quantitative claims.)
  • RBC-Ukraine relayed Oksana Ferchuk saying the past day was difficult for Ukraine’s digital and telecommunications infrastructure, thanking emergency and industry services, and saying work continues to restore and strengthen infrastructure. The same post contained an attribution conflict over whether the speaker was head of the Ministry of Digital Transformation or the State Service of Special Communications. (Source: РБК-Україна, 12:10:06 and 12:10:07; confidence MEDIUM for the statement, LOW for the role attribution.)
  • Два майора relayed a claim attributed to Pegasus Arms that its Kyiv UAV production workshop was severely damaged in the night of 23–24 September and that production was suspended indefinitely. The same post noted a date inconsistency between the graphic’s reference to 2026 and a prior strike dated 2 September 2025. (Source: Два майора, 12:18:10 and 12:18:11; confidence LOW to MEDIUM.)
  • WarArchive marked Mariupol Day with a commemorative post saying the 2022 defense lasted 86 days in near-total encirclement and naming the 36th Separate Marine Brigade, the Azov Regiment, border guards, police, National Guard and other defenders. The attached image was a symbolic composite, not documentary evidence of current conditions. (Source: WarArchive, 12:23:27 and 12:23:28; confidence MEDIUM for the commemorative narrative, LOW for evidentiary value.)
  • Ukrainian Air Force issued multiple UAV and jet-drone alerts across Kharkiv, Odesa, Mykolaiv, Dnipropetrovsk, Kirovohrad, Sumy, Chernihiv, Poltava and Zaporizhzhia areas. (Source: Повітряні Сили ЗС України / Air Force of the Armed Forces of Ukraine, 12:02:17–12:26:04; confidence MEDIUM for the alerts only.)

Civilian and infrastructure impact

  • Ukraine digital and telecommunications infrastructure: RBC-Ukraine relayed Oksana Ferchuk saying the past day was difficult for Ukraine’s digital and telecommunications infrastructure, but no affected regions, equipment, durations or damage assessments were supplied. Separately, Russian-aligned НгП раZVедка claimed attacks on 14 Ukrainian communications providers and called for Kyiv to have no connection apart from Starlinks; this is a single-source aligned claim without technical evidence. (Sources: РБК-Україна, 12:10:06 and 12:10:07; НгП раZVедка, 12:19:14; confidence MEDIUM for the official statement, LOW for the attack claim.)
  • Zaporizhzhia Oblast: The regional official’s video showed a damaged multi-story brick building with a collapsed roof and a damaged white residential house, according to the accompanying assessment. The official claimed 90% of Novomykolaivka residents had left, roads and lighting were being restored, humanitarian aid moved closer to people, and all Zaporizhzhia boiler houses were 100% ready for winter. The quantitative claims were described as administrative metrics difficult to verify in real time. (Source: Михайло Семікін - Запорізька ОВА, 12:00:37 and 12:00:38; confidence MEDIUM-HIGH for visible damage, LOW for metrics.)
  • Kyiv city: Два майора relayed a claim that the Pegasus Arms UAV production workshop was severely damaged in the night of 23–24 September; the attached images were product and promotional images rather than damage documentation. This concerns industrial capacity rather than a confirmed civilian impact. (Source: Два майора, 12:18:10 and 12:18:11; confidence LOW.)
  • Moscow, Russia: SOTA relayed Varvara Kosheleva’s account that she and her spouse were beaten after midnight by unidentified men who claimed to be SVO veterans, and that she was diagnosed with concussion and bruises. The supplied photo was consistent with visible facial injuries but did not independently confirm the attack context, attacker identity or motive. (Source: SOTA, 12:22:13 and 12:22:14; confidence LOW for attribution, MEDIUM for visible injury.)
  • Mariupol commemoration: WarArchive’s Mariupol Day post described the 2022 defense and Azovstal siege as historical commemoration; it did not report current civilian or infrastructure conditions in the city. (Source: WarArchive, 12:23:27 and 12:23:28; confidence MEDIUM for the narrative, LOW for evidentiary value.)

Information environment and disputed claims

  • The IRGC claim that Iran captured a U.S. Remus 600 underwater drone in the Strait of Hormuz was relayed by Kotsnews with no Pentagon confirmation, no verifiable imagery metadata, no coordinates, timestamps or chain-of-custody details. The same post cited a prior 8 September Dive-LD recovery and CENTCOM’s reported explanation that the earlier vehicle was an old model that had broken down. This remains a single-source claim with strong information-operation value for IRGC and Iranian media. (Source: Kotsnews, 11:58:07 and 11:58:08; confidence LOW.)
  • The RIA Novosti column threatening nuclear bombardment of Lithuania and its subsequent deletion were relayed by SOTA with a screenshot said to show the article page dated 25.09.2026. SOTA assessed the screenshot as corroborating the column’s existence but not the deletion or Kiselev’s explanation, and noted a possible plausible-deniability pattern in state media. (Source: SOTA, 12:13:53 and 12:13:54; confidence MEDIUM for the column’s existence, LOW for the explanation.)
  • ЦАПЛІЄНКО_UKRAINE FIGHTS relayed an unverified claim attributed to CBS News that the United States is likely preparing forces for an invasion of Cuba within “90–120 days.” The post supplied a symbolic Cuban-flag graphic, not documentary evidence, and the accompanying assessment rated the claim LOW. (Source: ЦАПЛІЄНКО_UKRAINE FIGHTS, 12:17:03 and 12:17:04; confidence LOW.)
  • The Pegasus Arms claim contains a date inconsistency: the company-style graphic referred to the night of 23–24 September 2026, while a previous strike was dated 2 September 2025 and the Russian caption gave no year for the current strike. Два майора also offered an interpretive frame that public Ukrainian claims of production halt can mask relocation or financial irregularities, which is not evidence. (Source: Два майора, 12:18:10 and 12:18:11; confidence LOW to MEDIUM for the product imagery, LOW for the strike and motive claims.)
  • The НгП раZVедка post claiming attacks on 14 Ukrainian communications providers is a single Russian-aligned assertion without locations, technical evidence or damage assessments. Its call for Kyiv to have no connection apart from Starlinks is an information-warfare statement, not a verified operational report. (Source: НгП раZVедка, 12:19:14; confidence LOW.)
  • SOTA’s account of the Kosheleva attack relies on victim testimony and a sympathetic Telegram channel, with loaded terms such as “heroes of SVO” in scare quotes and “drunk svo-shniki.” The post itself acknowledged uncertainty about whether the attack was connected to her election campaign or reflected broader issues of returning SVO personnel. (Source: SOTA, 12:22:13 and 12:22:14; confidence LOW for attribution.)
  • Fighterbomber’s missile-graffiti photo was captioned as an “ordinary fighter regiment’s bulletin board,” but the accompanying assessment said the image does not establish unit identity, location or date and could be staged, reposted or used for military humour or discipline commentary. (Source: Fighterbomber, 12:15:10 and 12:15:11; confidence LOW.)
  • WarArchive’s Mariupol Day post is a commemorative and symbolic item. Its unit list, 86-day duration claim and description of hundreds of civilians at Azovstal were asserted but not corroborated within the supplied content. (Source: WarArchive, 12:23:27 and 12:23:28; confidence MEDIUM for the general commemorative narrative, LOW for evidentiary value.)
  • The supplied Dempster-Shafer beliefs list “Uncertainty” at 0.692110, with lower-scored hypotheses including historical commemoration in Ukraine, an archaeological find at Mount Ararat, a Russian missile strike on the Pegasus Arms workshop in Kyiv, and IRGC information-warfare and electronic-warfare claims regarding the U.S. Navy Remus 600. These are analytic support only and are not treated as facts or independent corroboration.

Evidence limitations and unresolved questions

  • Most claims in this batch remain single-source or aligned-source. The IRGC Remus 600 capture, the Pegasus Arms strike and production-halt claim, the 14-provider telecommunications attack claim, the RIA Novosti column deletion explanation, the Poland Patriot production proposal, the Zaporizhzhia evacuation and boiler-readiness metrics, the Russian fundraising totals and the Kosheleva attack attribution lack independent corroboration in the supplied messages.
  • The Zelensky/General Staff claim of 10,660 Russian service members killed or wounded this week is an official Ukrainian aggregate without per-incident verification. No independent casualty totals were supplied for any specific engagement in this batch.
  • Event times are often vague or absent. Messages describe “the past day,” “this week,” “the night of 23–24 September,” “25 September,” or provide no event time at all. Air-raid alerts describe directions of travel, not impacts.
  • The previous situation report at 11:57 UTC already carried the Oleshky drone-delivery claim, the Henichesk strike claim and Iranian REMUS 600 relays; the new batch adds further relays and assessments but not independent corroboration. Areas not named in this batch are not established as quiet or unchanged.
  • The previous daily report was supplied for broad historical context only and is not treated as new evidence or independent corroboration. The weather context supplied time-qualified numeric observations as of 2026-09-27 12:15 UTC for Kharkiv/Vovchansk, Luhansk/Svatove, Donetsk/Pokrovsk, Zaporizhzhia/Orikhiv and Kherson/Kherson; these are environmental observations only and are not evidence of military events.
  • No battle-damage imagery was supplied for the Pegasus Arms workshop claim, the IRGC underwater-drone claim, or the claimed attacks on Ukrainian telecommunications providers. The Pegasus Arms images were product and promotional material; the Iranian post supplied no inspectable frames or metadata; the telecommunications claim supplied no technical evidence.