Fighter jets from Italy, France and Bulgaria have been scrambled to intercept commercial aircraft after a third successive wave of hoax bomb threats struck approximately 20 flights across Europe, forcing diversions, emergency landings and urgent security searches. No explosives were found on any aircraft, but the coordinated pattern of threats has drawn suspicion toward a far-right Russian group that calls itself the Male State.

What happened: diversions, escorts and a disputed landing

The disruption has been widespread, with low-cost carriers bearing the brunt of the threats, particularly those operating routes to or from Bulgaria, the Czech Republic and Italy.

Among the most dramatic incidents, French fighter jets intercepted an Aer Lingus flight travelling from Dublin to Rome, forcing it to land at the Evreux military base, roughly 100 kilometres west of Paris. French Prime Minister Sebastien Lecornu's office confirmed that the pilot had allegedly resisted the instruction to land at the military facility, preferring a civilian airport instead. The local prosecutor named in the source material described the pilot as having "allegedly refused" the military diversion. Aer Lingus later stated that its pilots had cooperated fully with French authorities. All 151 passengers and six crew members were safe, and military bomb disposal teams examined the aircraft.

In Bulgaria, the air force escorted three Ryanair aircraft into Sofia after threats were received, with flights originating from Madrid, Copenhagen and London all subjected to searches. A fourth Ryanair flight, travelling from London to Sofia, was diverted further east to Plovdiv Airport. A Wizz Air flight from Milan to Warsaw was redirected to Vienna. A LOT Polish Airlines flight also received a threat, with Belgian reports indicating that aircraft was forced to land at Brussels' Zaventem Airport.

A Finnair flight from Helsinki was escorted to its scheduled destination in Rome by the Italian air force before landing safely. In total, at least five flights received military escorts during this latest wave of threats.

Who is behind the threats

No group has formally claimed responsibility for the threats, but the content of several messages has pointed investigators toward a movement known as the Male State, a far-right organisation based in Russia.

Threat messages sent to email addresses for Sofia Airport and to ADR, the company that manages Rome's airports, were viewed by journalists and contained strikingly similar language. One message read: "We, fighters of the Male State, with our actions today will leave a mark in history. Your feminist regime will remember it forever. The explosion will occur in 60 minutes. Today your skies will turn red." The messages were described as misogynistic in tone and threatened to "annihilate" those they accused of being "accomplices in a criminal conspiracy."

Birmingham Airport in central England confirmed it also received a hoax threat attributed to a group named "Men's State," describing it as similar to other threats received across the continent.

Lou Osborn, founder of Inpact, a non-governmental organisation that monitors clandestine Russian activities, told reporters the Male State movement uses Nazi symbolism and has thousands of members. The group was designated an extremist organisation by Russian courts in 2021, yet notably expressed support for Russia's invasion of Ukraine the following year. Osborn acknowledged uncertainty about the group's current relationship with the Russian government, saying: "Today we don't know to what extent they are connected to those in power."

The threats arrive amid heightened concern in Europe about Russian sabotage operations in Europe, with officials across the continent pointing to what they describe as a broader campaign of hybrid warfare, including attacks on supermarket refrigeration systems, drone incursions and unexplained triggers to alert applications. Moscow denies involvement in any such campaign, as does Tehran, which has also been named by some European governments in connection with alleged hybrid attacks.

The wave in context: a third day of disruption

This latest outbreak of threats is not an isolated incident. On the Tuesday of the same week, at least seven flights and a cruise ship received bomb threats, causing airport disruptions across multiple countries, though no devices were found in any of those cases either. A flight headed to Bulgaria had also been diverted to Hungary the day prior after a mid-air bomb threat.

The threats have targeted airlines including Ryanair, Wizz Air, Scandinavian Airlines and LOT Polish Airlines, with Bulgaria, Italy and the Czech Republic appearing most frequently as intended destinations.

The incidents have also spread beyond Europe. An All Nippon Airways flight from Tokyo's Haneda Airport landed in Sydney on Thursday evening and was met by a large Australian Federal Police presence on the tarmac. Passengers were held for over an hour while the aircraft was searched and luggage screened by bomb detection dogs. Police confirmed the airport and aircraft were subsequently cleared and normal operations resumed.

What authorities are saying

While investigators have not formally attributed blame to any individual or organisation, the pattern of the threats, their content and their timing have alarmed security agencies across Europe. Officials have been cautious in drawing direct lines of responsibility, but the broader context of heightened geopolitical tensions and alleged state-sponsored disruption campaigns has made authorities reluctant to dismiss the incidents as the work of unconnected individuals.

All affected flights have been cleared following searches, and no explosive devices have been located on any aircraft throughout the entire series of incidents. Investigations are continuing across multiple jurisdictions.