European defence sites face surge in suspected Russian sabotage attacks
Germany, Poland and several other European countries reported a series of fires and arson incidents at defence facilities in August, which officials largely attribute to Russian sabotage, while Moscow denies involvement.
A wave of fires and arson incidents targeting defence and military-related facilities has been reported across Europe in August. German authorities linked explosive-laden drones found at Leipzig airport to Russia, and Poland’s interior minister warned that “many, many signals that Russia is changing its strategy and intensifying its activities, including terrorist and sabotage activities.”
Incidents included a blaze at Bulgaria’s EMCO factory on 10 August, a fire and explosion at Italy’s KNDS Ammo plant on 13 August, the burning of Estonia’s Milrem Robotics factory on 15 August, an averted arson at a Ukrainian-owned drone maker in Slovakia on 25 August, and two further fires in Poland on 30 August, one of which was captured on CCTV as a masked individual throwing incendiary devices.
Polish Prime Minister Donald Tusk described the latter as “a continuation of Russia’s escalatory activities,” while Estonia’s prime minister said the possibility of Russian sabotage is being taken seriously. German federal police have recorded more than 165 suspected sabotage cases nationwide this year, though they have not publicly assigned responsibility.
Analysts note the concentration of attacks on military sites is unusual. Daniela Richterova of King’s College linked the spike to increased pressure on Moscow following Ukraine’s deep-strike operations inside Russia. Keir Giles of Chatham House suggested the sabotage could be testing NATO’s response and probing the limits of acceptable conduct. The International Institute for Strategic Studies highlighted a similar surge in 2024, including a parcel-bomb plot targeting the United Kingdom and Poland.
Most reported sabotage operations appear to involve Russian-speaking individuals recruited online, often described as “gig-economy saboteurs,” who act on instructions from handlers believed to be based in Russia. While some attacks may be accidental, officials warn that even small-scale incidents could trigger broader security responses if they lead to larger accidents.