In CNN's September 12 report, a Ukrainian naval drone operator deployed in Libya said that his unit launches from the base at Misrata to attack Russia's shadow fleet, and that the price of the base is training Libyan forces. He spoke anonymously. His account is the clearest description yet of how Ukraine operates far from home: it pays for access with drone expertise.
The same reporting places roughly fifteen Ukrainian drone specialists with Tuareg separatists in northern Mali and several more in Sudan, and it quotes a Ukrainian defense intelligence source describing troops from Chad, Niger and Burkina Faso travelling to Mali for Ukrainian instruction. None of that is confirmed by Kyiv, and none of the governments named have acknowledged sending anyone.
What is confirmed is the policy these reported partnerships sit alongside. In a March 25, 2026 account, the Presidential Office reported that Kyrylo Budanov, the former military intelligence chief who now runs the Presidential Office, chaired an interagency meeting on expanding Ukraine's presence in Africa, at which, by the Presidential Office's account, Ukraine set itself for the first time the goal of influencing the continent comprehensively. Two months later the foreign minister stood at a forum in Kyiv and offered African governments Ukraine's experience with drones, electronic warfare and cyber defense. The war has become an export. The reported partnerships in Libya and Mali draw on the same expertise Kyiv is offering African governments.
The cost is also on the record. Two Sahel governments cut relations with Kyiv in 2024. A NATO ally lodged a formal protest this spring. The same expertise that opens doors to armed partners is closing them in capitals.
Kyiv’s Security Offer
The meeting described in that March 25 account was attended by the foreign minister and by representatives of the Presidential Office, the Cabinet, the Foreign Intelligence Service and Defense Intelligence, according to the Presidential Office's record. Participants named priority countries in the Maghreb and Sub-Saharan Africa, identified international financial mechanisms that could be used, and approved a draft action plan recommended to the Cabinet. Budanov said Ukraine had set itself the goal of "comprehensively influencing the situation on the African continent." The record establishes coordination at the top of the state. It does not establish a standing body, Cabinet adoption, or any direction of the operations reported since.
On May 26, Foreign Minister Andrii Sybiha told the Ukraine-Africa forum at the Diplomatic Academy that eight new embassies had opened across the continent in recent years, bringing Ukraine's missions to 18, and that Kyiv intended to exceed its prewar trade of 6.7 billion dollars. His second pillar was security. Ukraine, he said, possesses combat-proven experience in countering modern threats and is ready to share its expertise in using and neutralizing drones, in electronic warfare, and in cybersecurity. He also proposed a regional cyber alliance and a center for monitoring Russian influence.
Three days earlier Sybiha had asked the African Union to put Russia's recruitment of African fighters on its agenda. The diplomatic and the military tracks are aimed at the same target.
The document that preceded all this, the Ukraine-African Countries Communication Strategy for 2024 to 2026, is a communications plan and should be read as one. It placed embassies at the center of its messaging. Sybiha's forum speech explicitly included a security offer.
Operations and Diplomatic Fallout
Four dated events mark the record.
Tinzaouaten, July 2024. Tuareg fighters near the Algerian border claimed to have killed 84 Wagner personnel and 47 Malian soldiers over three days of fighting. On July 29, HUR spokesman Andriy Yusov said in a televised interview reported by Suspilne that the rebels had received the necessary information to carry out their operation. Mali severed relations on August 4, accusing Kyiv of supporting international terrorism; Niger followed on August 6; Senegal summoned Ukraine's ambassador. Ukraine denied involvement and called Mali's decision hasty.
Kidal, April 2026. The Azawad Liberation Front and the al Qaeda affiliate JNIM launched coordinated attacks across Mali on April 25. Russia's Africa Corps confirmed on Telegram on April 27 that its units had withdrawn from Kidal alongside Malian troops, with wounded and heavy equipment evacuated first. Le Monde, citing military and local sources, reported the Tessalit garrison leaving on May 1 and a withdrawal under way from Aguelhok on May 4, with some personnel still present. Russia's Defense Ministry said Ukrainian and European instructors had trained the rebels. CNN's operator said Ukrainians assisted the FLA in the Kidal takeover. The claimed Ukrainian role concerns assistance to the FLA, not JNIM.
Lefkada, May 2026. A fisherman found an armed unmanned surface vessel with its engines running near the Greek island on May 7. Greece attributed the drone to Ukraine after receiving findings from the Hellenic National Defence General Staff. Greece made representations in Athens and Kyiv, verbally and in writing, on May 28 and 29, stating that moving war operations into the Mediterranean endangers Greek security and its economy. Ukraine's foreign ministry apologized on June 5. A Ukrainian intelligence source later told CNN the drone had escaped from operators in Libya.
Libya, December 2025 to September 2026. The record includes three vessels hit in the central and eastern Mediterranean. On December 19, 2025, an anonymous SBU official told Reuters that Ukraine had struck the tanker Qendil in the Mediterranean, without specifying where or when; tracking placed the ship off Libya that afternoon. The LNG carrier Arctic Metagaz exploded southeast of Malta on March 3, and Russia's transport ministry blamed Ukrainian uncrewed boats launched from the Libyan coast. Footage circulating on September 6 showed the Russian-flagged cargo ship Lady Mariia, IMO 9220641, taking drone-dropped munitions on deck between Crete and Libya; no escort is visible in the available footage, and the ship reached Port Said on September 8 according to Maritime Optima's AIS record. Two Libyan officials told the Associated Press in April that Ukrainian drone specialists operate in western Libya. Lady Mariia's attackers and cargo are unconfirmed. As of September 24, Global Recon had identified no additional publicly reported attack on a Russian or Russia-linked vessel in the Mediterranean since September 7 in the sources reviewed.
Russia’s Escorts and Libya’s Denial
Kyiv is paying in the currency it is trying to earn. The Mali and Niger ruptures came during Kyiv's diplomatic expansion in Africa, and the Greek protest was delivered two days after Sybiha asked African governments to trust Ukraine's security expertise. The forum speech and the protest note describe the same capability from opposite sides.
Moscow has its own bill. Africa Corps withdrew from Kidal and Tessalit and began withdrawing from Aguelhok within nine days, whatever the cause. In the Mediterranean, the Russian Navy now escorts military sealift. The destroyer Admiral Levchenko brought Sparta, IMO 9268710, General Skobelev, IMO 9503304, and Akademik Pashin, IMO 9778193, through Gibraltar on August 27. The group reached Tartus on September 7. Itamilradar reported Sparta moving west through Gibraltar on September 23, corroborated by its AIS record. That tracking does not independently establish Levchenko’s outbound passage.
A second convoy, led by the landing ship Aleksandr Shabalin and escorting Anastasiia, IMO 9349291, and Yuriy Arshenevskiy, IMO 8406705, was reported under Italian P-72A surveillance between Sicily and Tunisia on September 10. SONARROW’s published Sentinel-2 image, dated September 13 at 08:55 UTC, placed the ships in and near Tobruk’s port entrance. Libya Field Notes geolocated footage published September 14 to a road in Tobruk and identified at least three Ural-63706-0010 Tornado-U armored trucks moving west. The road footage shows onward movement, not the unloading itself. The Royal Navy attributed Russia’s escort deployments to the risk of sanctions enforcement.
Tripoli has publicly denied authorizing such operations. On September 12, Libya’s Government of National Unity Defense Ministry denied any “agreement, arrangement or coordination” permitting Misrata Military Base or another national military facility to launch attacks or conduct operations outside Libya’s sovereign duties. In the statement reported by the Libyan News Agency, the ministry said no foreign party had permission to use Libyan territory, facilities, airspace or territorial waters for hostile action, while military cooperation and technical training with friendly countries remained subject to approved official and legal frameworks. The reproduced statement named neither Ukraine nor CNN. It denied authorization for attacks, without resolving the reported Ukrainian presence.
As of September 24, Global Recon had found no public response to CNN’s report from Mali, Niger, Burkina Faso or the Alliance of Sahel States in the sources reviewed. Mali’s junta, which cut ties with Kyiv two years ago, is the government the FLA is fighting.
Access and consent
Ukraine’s reported partnerships expose a limit to its Africa policy. Consent from a local armed partner does not necessarily mean consent from the national government. Drone expertise can open an operational foothold while the pursuit of Russian forces closes diplomatic doors.
John Hendricks is an OSINT analyst and the founder of Global Recon. Follow on X: @IGRecon