Russia appears to have intensified its sabotage campaign across Europe, with military and defence facilities increasingly becoming targets, according to European officials and security experts.
The escalation follows a series of suspicious fires and alleged arson attacks reported across several European countries in August, alongside the discovery of explosive-laden drones at Leipzig airport in Germany.
Defence sites increasingly targeted
On 4 August, a drone was discovered at Leipzig airport, which is used by Ukraine to transport military goods. A month later, Germany’s interior minister said Russia was responsible.
Moscow has rejected the accusation, with Russian officials describing it as “absurd” and President Vladimir Putin demanding evidence.
The incident was followed by a series of suspicious fires at defence-related facilities.
On 10 August, a major fire broke out at a factory belonging to Bulgarian defence company EMCO. Initial reports said a truck caught fire during a fuel delivery.
Three days later, a fire at KNDS Ammo Italy near Rome triggered a large explosion. Prosecutors are investigating possible outside interference, although authorities have so far only confirmed that a case for negligent disaster involving unknown persons has been opened.
On 15 August, the Milrem Robotics factory in Tallinn, Estonia, caught fire. The company is reported to supply drones to Ukraine, while two suspects were arrested. Estonian Prime Minister Kristen Michal said the possibility of Russian sabotage was being taken seriously.
More suspected attacks in August
On 25 August, Slovak police said they had prevented an arson attack against a Ukrainian-owned drone manufacturer and seized a large quantity of incendiary material. Three suspects were arrested and police said they had been “following orders”.
Poland, which has been heavily targeted by suspected Russian sabotage, reported two more fires on 30 August.
One occurred at a company in Lublin producing helicopter components. Polish Prime Minister Donald Tusk said arson could not be ruled out.
A separate attack targeted drone manufacturer WB Group. CCTV footage reportedly showed a masked man throwing incendiary devices at the facility, with Tusk describing it as a continuation of Russia’s escalatory activities.
The suspected campaign continued into September, when two Bulgarians were arrested in Munich on suspicion of arson after allegedly throwing incendiary devices from a car at defence company Rhode & Schwartz.
Why has sabotage intensified?
Experts say the concentration of incidents is unusual.
Daniela Richterova of King’s College London’s Department of War Studies linked the increase to Ukraine’s attacks deep inside Russian territory, arguing that Moscow is under pressure to respond.
She described the suspected campaign as “coercive signalling”, aimed at raising the cost for countries supporting Ukraine and potentially discouraging further military assistance.
Germany, after a slow start, has become Ukraine’s biggest supplier of military aid.
Another theory is that Russia is testing NATO’s vulnerabilities and assessing how individual countries respond to sabotage.
Keir Giles of Chatham House said Russia may be “probing the boundaries of what’s acceptable” while gathering information about vulnerable targets and the willingness of countries to respond.
The International Institute for Strategic Studies has also identified a previous surge in suspected sabotage activity in 2024, when Ukraine’s allies began allowing Western-supplied weapons to be used deeper inside Russia.
Who is carrying out the attacks?
Most suspected sabotage operations in Europe have reportedly been carried out by Russian proxies rather than professional Russian agents.
These individuals are often Russian speakers from former Soviet states who are recruited online and motivated primarily by financial rewards.
The people coordinating the operations are generally believed to remain in Russia, organising missions remotely.
The International Institute for Strategic Studies has compared these operatives to kamikaze drones: inexpensive, easily deployed and ultimately disposable.
However, the reported involvement of Russian nationals in the Leipzig airport drone operation could indicate a more professional and targeted approach.
The drones themselves appear to have malfunctioned, however.
NATO faces an old threat in a new form
Security experts say the suspected Russian campaign resembles Soviet-era sabotage tactics, when small and deniable attacks were used during peacetime and could be escalated during conflict.
Richterova said Europe remains in a “grey zone” between peace and war, but the recent incidents appear to be narrowing that space and increasing the risk of further escalation.
German media reported on Friday that a federal police report lists more than 165 suspected sabotage cases across the country this year, although the report does not identify who was responsible.
The growing concern for NATO is how a series of seemingly isolated incidents could eventually amount to a sustained campaign requiring a collective response.
Experts also warn of the risk of accidental escalation.
A parcel carrying explosives could have detonated in mid-air, potentially causing an aircraft crash, while the Leipzig drones could theoretically have brought down a plane.
Richterova warned that a major incident could force NATO to respond in an increasingly tense security environment.
Also read: Defence SMEs struggle to access the EU market
For more videos and updates, check out our YouTube channel
