Europe is being targeted by a growing campaign of sabotage, with Russia widely suspected of being behind the attacks.
Germany stated that an incident at Leipzig airport was part of a pattern of "Russian hybrid operations" in Europe.
While European politicians took a summer break, Russia intensified its military attacks in Ukraine and appears to have escalated its sabotage campaign across the continent, with military and defense sector sites being the primary targets.
A month after explosive-laden drones were discovered at Leipzig airport, which is used by Ukraine for military transport, Germany's interior minister declared that "Russia is responsible." Russian officials have denied the accusations, calling them "absurd."
Following the Leipzig incident, August saw a series of suspicious fires at defense facilities across Europe, from Italy to Estonia. Some affected countries have directly blamed Russia, while others are still investigating, with the possibility that some fires may be ruled accidental.
Poland's interior minister, Marcin Kierwiński, stated, "There are many, many signals that Russia is changing its strategy and intensifying its activities, including terrorist and sabotage activities," urging vigilance.
August campaign across Europe
- 4 August Germany: The first drone is found at Leipzig airport.
- 10 August Bulgaria: A major fire occurs at a warehouse belonging to defense firm EMCO in Tryavna. The company noted previous blasts at its facilities that were investigated for Russian links, stating "Human error is excluded."
- 13 August Italy: A fire at KNDS Ammo Italy near Rome results in a large explosion. Prosecutors are investigating potential external interference.
- 15 August Estonia: The Milrem Robotics factory in Tallinn, which reportedly supplies drones to Ukraine, catches fire. Two suspects are arrested, and Estonian Prime Minister Kristen Michal indicated that investigators are "taking seriously" the possibility of Russian sabotage.
- 25 August Slovakia: Police announce they thwarted an arson attempt on a Ukrainian-owned drone manufacturer, seizing a "large amount of incendiary mixture." The firm blames Russia, and police arrest three suspects allegedly "following orders."
- 30 August Poland: Two more fires are reported. One in Lublin at a company producing helicopter components, where arson is not ruled out by Prime Minister Donald Tusk. Another attack targets the drone producer, WB Group, with a masked man caught on CCTV throwing incendiary devices. Tusk described it as a "continuation of Russia's escalatory activities."
The pattern continued into September with two Bulgarians arrested in Munich, Germany, for suspected arson after throwing incendiary devices at defense firm Rhode & Schwartz.
Why is this happening now?
While attacks on military and defense targets are not new, the current concentration of cases is unusual. Daniela Richterova of King's College London suggests the spike is linked to Ukraine's recent successes in striking deep inside Russian territory, putting Moscow under pressure to respond.
Richterova believes the Kremlin's aim is "coercive signalling" – pressuring countries to halt support for Kyiv by raising the stakes. Germany is a significant supplier of military aid to Ukraine.
Another theory suggests Russia is testing NATO's weaknesses and assessing its response to such actions. Keir Giles of the Chatham House think tank views the sabotage campaign as preparation for a "next phase" of Russian aggression in Europe.
The International Institute for Strategic Studies (IISS) notes a previous surge in sabotage cases in 2024, coinciding with Western allies allowing Ukraine to use their weapons deeper inside Russia. This period also saw parcel bomb plots attributed to Russia, including one that ignited on a cargo plane.
German media reports cite a federal police report listing over 165 suspected sabotage cases nationwide this year, though responsibility is not always identified.
Who are the suspected saboteurs?
Reports from Germany suggest the individuals involved in the Leipzig airport drone incident were Russian, with at least one possibly entering the country specifically for the operation. However, most sabotage attacks in Europe are carried out by Russian proxies, often Russian-speakers from former Soviet states recruited online and motivated by payment.
These proxies are considered disposable, similar to kamikaze drones. The IISS likens them to agents-saboteurs used during the Cold War, capable of small, deniable attacks.
Nato is facing a Soviet-style campaign, with similar targets identified in historical Soviet sabotage lists. Daniela Richterova suggests these attacks are designed to escalate in times of war, shrinking the "grey zone" between peace and conflict and increasing the risk of accidental escalation.
The potential for accidental escalation, such as a drone incident causing a plane crash, could force NATO to react.
