The biggest threat to Ukraine’s cities can strike with little or no warning.

Over the past few months, Ukraine has put Russia on the back foot with strikes that have hit Russia’s oil refining capacity , caused long lines at fuel stations and set commercial logistics centers alight . But Russia has exploited a key Ukrainian vulnerability – a dearth of ballistic-missile interceptors – to launch terrifying, high-speed missile attacks on Ukrainian cities combined with other long-range strikes that have claimed hundreds of civilian lives.

On one night alone this week, a barrage of more than two dozen ballistic and anti-ship missiles hit the Ukrainian capital region . All of the missiles slipped past Ukrainian defenses, killing least 17 people and wounding dozens more.

The massive Russian air attacks on Ukraine are complex: An attack concentrating on the Kyiv and Lviv regions on the night of June 30 saw Russia launch four anti-ship missiles, nine ballistic missiles, 61 cruise missiles and close to 300 strike drones at targets around the country, according to the Ukrainian Air Force.

But Russian ballistic missiles appear to be the threat that has Ukrainian’s leadership most worried. Russia’s ballistic missile broadsides against Ukraine come as Kyiv desperately seeks to replenish its supply of US-made Patriot air-defense missile interceptors, one of the few weapons capable of knocking down a ballistic missile.

Ballistic missiles are not new to warfare: Nazi Germany debuted the V-2 rocket during World War II and the “war of the cities” during the Iran-Iraq war of the 1980s saw dueling rounds of Scud missiles – descendants of the V-2 – wreak havoc on civilian populations. But the technology for defeating ballistic missiles has advanced significantly since the Cold War. The Patriot’s PAC-3 interceptor steers directly into its target, destroying it with sheer kinetic energy rather than with an explosive warhead – in shorthand, a bullet hitting a bullet.

In a statement Wednesday , Ukrainian President Volodymyr Zelensky pleaded for more interceptors.

“Ballistic missile interceptors could have saved the lives of those killed today,” he said. “It is very important that our partners understand that delays in supplying them, or an unwillingness to provide anti-ballistic systems, lead directly to such horrific casualties and destruction. Partners who are not yet ready to play a more active role in supplying interceptors can help by implementing new sanctions. A significant share of Russia’s ballistic missile production is still not under sanctions.”

The threat to Ukraine cities can be largely boiled down to three broad categories: ballistic missiles, cruise missile and drones, all typically launched from inside Russian territory or occupied portions of Ukraine. Closer to the front lines, Russians have employed smaller attack drones to terrorize civilian areas in Ukraine, targeting gas stations and vehicles. Earlier this week, a food vendor in the southern Kherson region narrowly survived an attack by an FPV drone, in an attack commonly described as a “drone safari.”

Ukraine has already showcased its prowess and ingenuity in countering Russian drones. The devices are relatively cheap and plentiful: Russia mass-produces the Geran-2, a version of the Iranian-designed Shahed drone, and has introduced upgrades including jet engines as well as decoy drones to up the effectiveness of its drone strikes. But Ukraine has a layered array of defenses against the relatively slow-flying ones, and its counter-drone expertise has been in demand following the US-Iran war.

Cruise missiles typically carry a much larger payload than a drone. Propelled by jet engines, they typically can fly close to the ground to evade detection. The Missile Defense Advocacy Alliance says the Kalibr – a sea-launched cruise missile deployed by Russian surface ships and submarines – can cruise about 20 meters over the sea or 50 meters above ground .

A ballistic missile, by contrast, has a very different speed and trajectory. Boosted by rocket engines, the missile follows a high arc before descending to its target. The ranges vary, but speeds are extreme: the short-range Russian Iskander ballistic missile flies at six to seven times the speed of sound and can carry up to 700 kilograms of explosives. A long-range intercontinental ballistic missile – originally designed to loft nuclear warheads out of the atmosphere before they re-enter – can fly from a launch site in the United States over the Arctic Circle to a target in Russia in the time it takes to deliver a pizza, 30 minutes or less . In recent attacks on Kyiv, air-raid sirens have sounded at the same time as impacts.

Russia has fired the Oreshnik missile , an intermediate-range hypersonic weapon, on a handful of occasions against Ukraine in strikes viewed as signa l ling Moscow’s willingness to escalate. But short-range systems such as the Iskander ballistic missile have been the workhorse for the Russian military. Ukrainian officials say the Russians have also repurposed S-400 air-defense missiles as ballistic missiles to strike Ukrainian targets.

Faced with a tight supply of interceptors and worsening attacks on its cities, Kyiv has been pressing Washington to co-produce the Patriot system. US President Donald Trump signaled on the sidelines of the NATO summit last month in Ankara that he might be willing to license Ukrainian co-production of the Patriot , but the US president appeared to dash Ukrainian hopes last week, saying, “We’re talking about it, but it’s a hard thing to give away that kind of technology.”

Meanwhile, Ukrainian officials say Russia is augmenting its arsenal with North Korean ballistic missiles, further raising the threat.

Vladyslav Vlasyuk, Ukrainian Presidential Sanctions Envoy, said Ukraine had identified a North Korean KN-23 missile – a counterpart to the Russian Iskander – that had recently demolished a house in Radushne, in rural Dnipropetrovsk region, killing six people, including three children, with five more children still missing after the attack.

The KN-23, he said, “is practically an exact counterpart to the Russian Iskander. They even share identical components, including Western-made ones. This is one example of Russia’s dependence on military aid from North Korea. North Korean missiles are killing Ukrainian civilians just as Russian ones are.”

And Ukraine’s missile-defense gap may get wider because of the US-Iran war. As CNN reported this week , the US military has burned through nearly four-fifths of another missile-defense system, Terminal High-Altitude Area Defense, according to multiple sources familiar with the matter. The inventory of Patriot interceptors has dropped by roughly half since the start of the war, according to two sources familiar with the latest inventory report.

“Ballistic missile defense remains a difficult problem,” said military analyst Dara Massicot in a post on X , following a recent research visit to Ukraine. “Patriot interceptor problems are known. Ukraine knows what must be done, and it is time, and now in my opinion, for (Ukraine) to consider Plan B and Plan C about how to undercut Russian launch potential.”

And while Kyiv considers Plans B and C, the clock is ticking for Ukraine’s cities as Russia continues to build its missile campaign.

CNN’s Svitlana Vlasova contributed to this report.