UKRAINE-RUSSIA

INTELLIGENCE SUMMARY (INTSUM)

Heatmap - Threats identified on Crowd Threat platform (past 7 days)

1. EXECUTIVE SUMMARY

The reporting period was dominated by two parallel, high-tempo campaigns rather than front-line movement alone. Russia sustained a near-continuous, nationwide drone and missile threat against Ukraine — air alerts and UAV/missile activity were recorded in virtually every oblast on a nightly basis, from Chernihiv and Sumy in the north to Odesa and Zaporizhia in the south. In parallel, Ukraine ran a sustained deep-strike drone campaign against Russian oil refining and logistics infrastructure hundreds of kilometres from the front — confirmed strikes reached refineries in Perm, Tyumen and Ufa, warehouses in the Moscow, Ryazan, Samara and Vladimir regions, and Black Sea coastal targets in Krasnodar Krai.

On the ground, Russian forces were reported to have captured a cluster of villages in Kharkiv and Donetsk oblasts on 29 July, consistent with continued incremental territorial pressure rather than a major breakthrough. Russian missile strikes hit defence-related and residential targets in Kyiv, Lviv and Kryvyi Rih. An explosive incident occurred inside Moscow itself with casualties, a notable departure from the front-line-focused pattern of prior weeks.

Strategic aviation movements — Russian Tu-95MS and Tu-160M bomber activity from bases in Murmansk and Amur — were verified twice in the period and are flagged as a leading indicator worth continued monitoring, though no strike attribution to these specific sorties was confirmed.

2. KEY DEVELOPMENTS

A. Nationwide Air Alert Campaign (Ukraine)

Air-raid and UAV alerts were recorded across nearly every Ukrainian oblast on a nightly basis throughout the period — Kharkiv, Sumy, Chernihiv, Poltava, Dnipropetrovsk, Zaporizhia, Kherson, Mykolaiv, Odesa, Kyiv, Cherkasy and Donetsk all recorded multiple alerts per night. Volume was highest overnight 28–30 July, with dozens of discrete alerts reported within single multi-hour windows. This pattern is consistent with sustained, large-scale Shahed/Geran-series drone waves combined with intermittent ballistic and cruise missile threats, rather than isolated incidents.

B. Deep-Strike Campaign Against Russian Infrastructure

A distinct and sustained Ukrainian drone campaign targeted Russian energy and logistics infrastructure well beyond the front line: oil refineries at Ufa (Bashneft-Ufimsky, 2 Aug), Perm (AVT-5 unit, 28 Jul) and Tyumen (Antipinsky, 24 Jul); e-commerce/logistics warehouses operated by Wildberries in Ryazan, Samara (Novosemeykino), Moscow Oblast (Reutov), Vladimir and St Petersburg (28 Jul–4 Aug — repeated hits on the same logistics network suggest deliberate, sustained targeting rather than coincidence); and Black Sea coastal targets in Krasnodar Krai, including a cargo ship reportedly struck near Novorossiysk (unverified) and repeated drone activity over Gelendzhik and Sochi.

C. Missile Strikes on Ukraine

Iskander-M ballistic missile strikes hit the Mayak Design Bureau and an industrial area in Kyiv (29–30 Jul), while Kh-101 cruise missiles struck the Lviv State Aircraft Repair plant and a residential building in Kryvyi Rih was hit by ballistic missile debris (30 Jul), with at least one fatality-linked report from that strike. A 15-missile barrage was reported as launched toward Lviv on 30 July.

D. Ground War — Kharkiv and Donetsk Oblasts

Russian forces were reported to have captured Artil'ne and Shev'yakivka (Kharkiv Oblast) and Novopavlivka, Pavlivka and Pryyut (Donetsk Oblast) in a single reporting batch on 29 July — consistent with continued, incremental Russian territorial gains along the eastern front rather than a large-scale breakthrough.

E. Strike Inside Moscow

On the evening of Saturday, August 1, 2026 (around 8:00–8:10 p.m. local time), a homemade improvised explosive device (IED) detonated outside the Balzi Rossi Italian restaurant on Kudrinskaya Square in central Moscow. The restaurant (in one of Moscow’s Stalin-era “Seven Sisters” skyscrapers) was closed for a private event, with reports indicating a gathering on the outdoor terrace. An unidentified woman approached carrying what was described as a package or gift. A security guard stopped her from entering and began inspecting it; the device then exploded.

Casualties and details

• Killed: At least three people—the woman carrying the device, the security guard who stopped her, and one restaurant guest/customer. Some Russian media (including Telegram channels and outlets close to security services) later reported the toll rising to five after additional hospital deaths, though official confirmations varied.

• Injured: At least 21 people, with injuries of varying severity (some reports noted several in serious condition).

The device was equivalent to roughly 1 kg of TNT and packed with metal ball bearings/shrapnel to increase casualties. Russian reporting (e.g., Kommersant) indicated it was likely detonated remotely and that the woman may have been an unwitting courier who did not know the package contained a bomb.

Official response and context - Russia’s National Anti-Terrorism Committee classified it as involving an IED and opened a terrorism investigation. Moscow Mayor Sergei Sobyanin called it a “brutal terrorist act.” The restaurant’s private function and heavy security were noted as factors that may have limited the death toll.

There was speculation (including on social media and in some Russian coverage) about a possible link to the Ukraine war or a targeted attack on high-profile guests—one unverified claim pointed to a birthday event possibly involving Aerospace Forces commander Alexander Chaiko—but Russian authorities had not publicly named a specific target or perpetrator at the time of initial reports. Some Russian statements (including from the embassy in Italy) blamed Ukraine, consistent with patterns in prior Moscow attacks, though no formal claim of responsibility was widely confirmed in the coverage.

F. Strategic Aviation Activity

Russian long-range bomber movements were reported on two occasions: Tu-160M Blackjack aircraft departing a base in Amur Oblast (29 Jul) and Tu-95MS Bear bombers relocating from and later departing Olenegorsk, Murmansk (29–30 Jul). No strikes were directly attributed to these specific sorties within the reporting window, but bomber repositioning of this kind is a standard precursor to stand-off missile strikes and is flagged for continued tracking.

G. Maritime Activity

Multiple vessel-fire incidents were reported off the Odesa Oblast coast, alongside a reported Russian strike on a vessel in Odesa Bay (28 Jul). A separate cargo ship strike near Novorossiysk (Krasnodar Krai) remains unverified as of the end of the reporting period.

H. Political / Information Domain

A protest march for “dialogue and reforms” was reported as planned in Kyiv for 31 July.

3. GEOGRAPHIC BREAKDOWN

Ukraine - Threats identified on Crowd Threat platform (past 7 days)

Western Russia - Threats identified on Crowd Threat platform (past 7 days)

Russia - Threats identified on Crowd Threat platform (past 7 days)

4. FORECAST / OUTLOOK

Expect continued nightly, nationwide drone and missile alert activity across Ukraine at a similar or escalating tempo, with no indication of let-up in the reporting window. The sustained targeting of the same Russian logistics network (Wildberries facilities) and refining capacity across multiple, widely dispersed regions suggests a deliberate Ukrainian deep-strike campaign that is likely to continue rather than a one-off. Watch for further Russian territorial pressure in Kharkiv and Donetsk oblasts following the 29 July village captures, and for any further strikes attributable to the bomber repositioning tracked at Olenegorsk and Amur Oblast bases. The explosive incident inside Moscow warrants continued monitoring as a potential shift in the geography of the conflict.

5. METHODOLOGY & SOURCING

This summary is derived from Crowd Threat's crowdsourced OSINT platform — “local eyes on global threats.” Figures reflect observed dataset volumes for the 28 July – 4 August 2026 reporting window and should be read as indicative of reporting activity and pattern, not as an exhaustive census of all incidents in the theater during the period.

Want live access to this kind of ground-truth reporting as it happens? Book a demo of the Crowd Threat platform — real-time, crowd-verified incident tracking; local reporters on the ground in places most feeds can't reach; and confidence-scored alerts so your team can tell signal from noise before it hits the news.

BOOK A DEMO