Russia escalates European sabotage campaign targeting defense sites

Through the summer of 2026, as European cities baked under record heat and politicians packed for August holidays, Russia kept working. Its military campaign in Ukraine intensified, growing deadlier for civilians by the week. But Moscow was not content with the battlefield alone. Across the continent, from the Baltic to the Mediterranean, a coordinated wave of attacks struck at the infrastructure that keeps Ukraine supplied with Western weapons.

On August 4th, German authorities discovered explosive-laden drones at Leipzig airport, a facility used to transport military goods to Kyiv. A month later, Germany's interior minister declared flatly: Russia was responsible. The Kremlin demanded proof and called the accusation absurd, as it always does. But the drones were only the opening move. What followed was a cascade of fires and explosions at defence facilities across Europe, each one suspicious, each one potentially deniable.

Bulgaria reported a major fire at EMCO, a defence contractor in Tryavna, on August 10th. The company itself stated that human error could be excluded—a pointed detail, given previous blasts at its sites that had been investigated for Russian links. Three days later, a fire at an ammunition plant outside Rome belonging to KNDS Ammo Italy triggered a large explosion; the local prosecutor opened an investigation into possible outside interference. On August 15th, the Milrem Robotics factory in Tallinn, which supplies drones to Ukraine according to the Kyiv Post, burned to the ground. Two suspects were arrested. Estonia's prime minister said the possibility of Russian sabotage was being taken seriously. By August 25th, Slovakia—Russia's closest ally in Europe—announced police had stopped an arson attack on a Ukrainian-owned drone manufacturer and seized a large quantity of incendiary mixture. Three suspects were arrested, accused of following orders. Poland reported two more fires on August 30th: one at a helicopter components factory in Lublin, the other at WB Group, a drone producer. Security footage caught a masked figure hurling incendiary devices from a car. Prime Minister Donald Tusk called it a continuation of Russia's escalatory activities. The pattern spilled into September when two Bulgarians were arrested in Munich for suspected arson after throwing incendiary devices at defence firm Rhode & Schwarz.

What made this summer different was not sabotage itself—Russia has long conducted such operations—but the concentration and precision. Daniela Richterova, a researcher at King's College's Department of War Studies, noted that the intensity of military sites being targeted over recent weeks was unusual. She linked the spike to Ukraine's own escalation: Kyiv had begun striking deep inside Russian territory, putting Moscow under pressure. The Kremlin, she suggested, was engaged in what analysts call coercive signalling—raising the stakes to pressure European countries into cutting support for Ukraine. Others saw a different calculation. Keir Giles from the Chatham House think tank argued Russia was less interested in turning off the supply taps and more focused on testing NATO for weaknesses, probing boundaries and collecting intelligence on what works and what is vulnerable. He framed the campaign as preparation for the next phase of Russian aggression in Europe, a way of assessing how willing victim countries were to respond.

The International Institute for Strategic Studies, which tracks sabotage cases, pointed to a previous surge in 2024 when Ukraine's allies began allowing deeper strikes inside Russia. That year brought the parcel bomb plot—packages containing liquid explosive sent to the UK and Poland, one of which ignited before being loaded onto a DHL cargo plane. Giles described it as a test run for something far larger, a probe of how far Russia could push before facing consequences. The White House had contacted the Kremlin directly, telling it to stop. Russia had found a limit. Yet the attacks continued.

German federal police documented more than 165 suspected sabotage cases nationwide in 2026 alone, though attribution remained unclear in most. The identity of the saboteurs themselves offered clues about Moscow's intentions. Reports suggested the men who launched drones at Leipzig were Russian, possibly brought in specifically for the job—unusual in itself. Most European sabotage attacks had been carried out by proxies: Russian-speakers from former Soviet states, recruited online and motivated by cash rather than ideology. The IISS compared them to kamikaze drones—cheap, disposable, easy to deploy in large numbers. But they could be sloppy. One operative in the parcel plot failed to find a pick-up point, forcing the entire mission to abort. If Moscow had sent professionals to Leipzig, it signalled a desire for precision and success. Yet the devices appear to have malfunctioned.

The campaign echoed Cold War playbooks. Richterova's research showed that Soviet sabotage lists contained remarkably similar targets, and agents were deployed in much the same way: small, deniable attacks in peacetime that could escalate during conflict. We are still in the grey zone between the two, she said, but recent weeks have shrunk that zone considerably, raising the risk of what comes next. As NATO scrambled to respond, fundamental questions remained unanswered: how many small attacks constitute a sustained assault demanding action? And perhaps more dangerous still was the potential for accidental escalation. What if the exploding parcel had detonated mid-air, bringing down a plane? What if the Leipzig drone had struck an aircraft? Richterova was direct: it could result in a major attack, one that NATO, in a heightened security environment, would not be able to ignore.