ReutersAs summer temperatures in Europe smashed records this summer and many politicians shifted to holiday mode, Russia remained focused on its war.
Not only did its military attacks across Ukraine intensify last month, becoming ever more deadly for civilians, Russia also appears to have escalated its sabotage campaign across Europe.
This time, military and defence sector sites were the prime target.
A full month after drones packed with explosives were found at Leipzig’s airport, used by Ukraine to transport military goods, Germany’s interior minister has declared that “Russia is responsible”.
But the drones were just a dramatic start. August then brought a series of suspicious fires at defence facilities from Italy to Estonia.
Some of the affected countries have already blamed Russia; others are still investigating and some fires may eventually be ruled accidental, exactly as such attacks are designed to seem.
Poland’s interior minister is clear.
“There are many, many signals that Russia is changing its strategy and intensifying its activities, including terrorist and sabotage activities,” Marcin Kierwiński said, warning people to be on their guard.
August campaign across Europe
4 August Germany: The first drone at Leipzig airport is discovered.
10 August Bulgaria: A major fire breaks out at a factory of the defence firm EMCO, with initial reports that a truck ignited during a fuel delivery.
13 August Italy: A fire at KNDS Ammo Italy outside Rome triggers a large explosion.
The local prosecutor is looking into possible outside interference, La Repubblica newspaper reports. Publicly, his office will only confirm that a case has been opened for negligent disaster against “unknown persons”.
15 August Estonia: The Milrem Robotics factory in Tallinn, which the Kyiv Post says supplies drones to Ukraine, goes up in flames. Two suspects are arrested.
Estonian Prime Minister Kristen Michal says the possibility of Russian sabotage is being “taking seriously” by investigators.
25 August Slovakia: Police announce they have averted an arson attack on a Ukrainian-owned drone manufacturer and seized a “large amount of incendiary mixture”. The firm itself blames Russia and police arrest three suspects who they say were “following orders”. Slovakia is Russia’s close ally in Europe.
30 August Poland: A country which is heavily targeted for sabotage reports two more fires.
One is in Lublin at a company which produces helicopter components. Prime Minister Donald Tusk said arson “cannot be ruled out”.
An attack on the drone producer, WB Group, is clearer cut. A masked man is caught on CCTV throwing incendiary devices. Tusk calls it a “continuation of Russia’s escalatory activities”.
The pattern has continued into September with two Bulgarians arrested in Munich, Germany, for suspected arson after throwing incendiary devices from a car at defence firm Rhode & Schwartz.
EPAWhy is this happening now?
Attacks on military and defence targets are not new, although previous acts of sabotage linked to Russia include more puzzling targets – such as an Ikea store and a Polish paint store.
The novelty now is the concentration of cases.
“The intensity of military sites being attacked we’ve seen over the past couple of weeks is unusual,” Daniela Richterova of the Department of War Studies at King’s College says.
She links the spike to developments in Russia’s invasion of Ukraine.
“We’ve basically seen Ukraine take the war to Russia and strike deep inside Russian territory…They [Moscow] are under pressure, they have to do something.”
Whilst some sabotage is staged to sow chaos or fear, Richterova believes the Kremlin’s aim right now is “coercive signalling”: pressuring countries to stop supporting Kyiv by raising the stakes.
After a slow start, Germany is Ukraine’s biggest supplier of military aid.
There are other theories.
To some, Russia is less concerned about “turning off the taps” of supplies to Ukraine and more about testing Nato for weaknesses.
“Russia is probing the boundaries of what’s acceptable and collecting information on the results. They find out what works, and what’s vulnerable,” argues Keir Giles from the Chatham House think tank.
He sees the sabotage campaign as preparation for the “next phase”, as he puts it, of Russia’s aggression in Europe.
“They’re assessing the willingness of the victim country to actually do something about it.”
The International Institute for Strategic Studies (IISS), which tracks sabotage cases, points to a previous surge in 2024 when Ukraine’s allies began allowing it to use Western-supplied weapons deeper inside Russia.
2024 was the year of the parcel bomb plot, when Russia was accused of sending packages containing liquid explosive to the UK and Poland.
One ignited shortly before it was loaded on to a DHL cargo plane. It is thought this was a test run for something significantly bigger.
Police handout“That was a marked high in terms of their willingness to inflict mass casualties,” Giles adds.
It was a step so serious, the White House contacted the Kremlin to tell it to stop. Russia had probed and found the limit.
But the attacks have continued. German media on Friday quoted a federal police report that lists more than 165 suspected sabotage cases nationwide this year, though they don’t say who is responsible.
Who are the suspected saboteurs?
Reports from Germany suggest the men who loaded and launched the drones at Leipzig’s airport were Russian, and at least one may have entered the country specially for this job.
That would be unusual.
The vast majority of sabotage attacks in Europe have been carried out by Russian proxies: its so-called “gig economy saboteurs”.
They are usually Russian-speakers from former Soviet states, recruited online and driven by the cash, not political conviction.
In one case the BBC reported from Poland, the saboteurs-for-hire had previously fought for Ukraine as volunteers.
The “handlers” are generally thought to remain in Russia, co-ordinating operations online.
The IISS likened the proxies they used to kamikaze drones: cheap and easy to launch in large numbers, but disposable.
The amateurs can be sloppy or reckless, though. In the parcel plot, one man failed to find a pick-up point and the whole mission had to be aborted.
So if Moscow did send professionals for the Leipzig drone launch, it suggests it wanted precision – and success.
In fact, the devices appear to have malfunctioned.
Nato faced with Soviet-style campaign
Russia’s sabotage operations seem to come from the Cold War playbook. Daniela Richterova’s research shows very similar targets on Soviet sabotage lists, and agents-saboteurs were used in much the same way.
The idea, she says, was to have small, deniable attacks in peace-time that would escalate in times of war.
“I think we are still in the grey zone between the two, but the kind of attacks we’ve seen in the past weeks shrink that zone,” she says. “And I think that increases the risk of what happens next.”
As Nato scrambles to respond, questions like how many small, individual attacks add up to a sustained Russian assault – and demand action – remain unanswered.
Perhaps riskier than all is the potential for escalation by accident.
What if the exploding parcel had gone off mid-air and caused a crash? What if the Leipzig drone had brought down a plane?
“I think it could result in a big attack,” Richterova says. “Then Nato, in this heightened security environment, would not be able to ignore that, and have to react.”
