Sabotage campaign against EU defence sites intensifies – officials and analysts

As European politicians shifted into holiday mode over the northern summer, Russia intensified both its military attacks on Ukraine and, according to several European governments, its sabotage campaign across the continent – this time targeting military and defence-sector sites.

A month after explosive-packed drones were found at Leipzig airport, used by Ukraine to transport military goods, Germany's interior minister declared that “Russia is responsible”.

The Kremlin has dismissed the accusation as “absurd” and demanded proof, writes Sarah Rainsford, Southern and Eastern European correspondent for the BBCitalic text.

The drones were followed by a string of suspicious fires at defence facilities from Italy to Estonia, some already blamed on Russia, others still under investigation. Poland's interior minister, Marcin Kierwiński, said: “There are many, many signals that Russia is changing its strategy and intensifying its activities, including terrorist and sabotage activities.”

August campaign across Europe

• 4 August, Germany: The first drone is discovered at Leipzig airport.
• 10 August, Bulgaria: A major fire breaks out at defence firm EMCO's factory; initial reports pointed to a truck igniting during a fuel delivery.
• 13 August, Italy: A fire and explosion hit KNDS Ammo Italy outside Rome; the local prosecutor has opened a case for negligent disaster against “unknown persons”, with La Repubblica reporting possible outside interference is being investigated.
• 15 August, Estonia: The Milrem Robotics factory in Tallinn, which reportedly supplies drones to Ukraine, catches fire; two suspects are arrested, and Prime Minister Kristen Michal says the possibility of Russian sabotage is being “taken seriously”.
• 25 August, Slovakia: Police say they averted an arson attack on a Ukrainian-owned drone manufacturer, seizing a “large amount of incendiary mixture”. Three suspects, said to have been “following orders”, are arrested.
• 30 August, Poland: Two more fires are reported – one at a helicopter-components firm in Lublin, where Prime Minister Donald Tusk said arson “cannot be ruled out”, and one at drone producer WB Group, where a masked man was filmed throwing incendiary devices. Tusk called it a “continuation of Russia's escalatory activities”.
• September, Germany: Two Bulgarians are arrested in Munich on suspicion of arson after throwing incendiary devices at defence firm Rohde & Schwarz.

Sabotage linked to Russia is not new – past incidents have included attacks on an Ikea store and a Polish paint store – but the concentration of recent cases is unusual, according to Daniela Richterova of King's College London's Department of War Studies.

She links the spike to Ukraine's deepening strikes inside Russian territory, arguing Moscow is under pressure to respond, with the Kremlin's likely aim being “coercive signalling” intended to pressure countries into scaling back support for Kyiv.

Others see a different motive. Keir Giles of Chatham House argues Russia is “probing the boundaries of what's acceptable and collecting information on the results”, testing Nato's weaknesses and the willingness of targeted countries to respond, as preparation for a “next phase” of aggression in Europe.

The International Institute for Strategic Studies points to a similar surge in 2024, when Ukraine's allies first allowed it to strike deeper inside Russia using Western-supplied weapons – the same year Russia was accused of a parcel-bomb plot involving packages of liquid explosive sent to the UK and Poland, one of which ignited before being loaded onto a DHL cargo plane. Giles describes that episode as “a marked high in terms of their willingness to inflict mass casualties” – serious enough that the White House contacted the Kremlin directly to demand it stop. German police have since logged more than 165 suspected sabotage cases nationwide this year.

Most sabotage attacks in Europe are believed to be carried out not by Russian agents directly, but by proxies – Russian-speaking recruits from former Soviet states hired online for cash rather than ideology, sometimes including former Ukrainian volunteer fighters.

Handlers are thought to coordinate operations remotely from Russia. But reports suggest the men behind the Leipzig drone launch were Russian nationals, with at least one believed to have entered Germany specifically for the operation – an unusual departure suggesting Moscow wanted precision, even though the devices ultimately appear to have malfunctioned.

Richterova notes that the pattern echoes Cold War-era Soviet sabotage tactics: small, deniable attacks in peacetime designed to escalate in wartime.

“I think we are still in the grey zone between the two,” she said, “but the kind of attacks we've seen in the past weeks shrink that zone. And I think that increases the risk of what happens next.”

She warned that an accidental escalation – such as a downed aircraft – could force Nato into a response it could not avoid.