Estonia says Russia ordered the August arson attack on Milrem Robotics’ Tallinn premises, an Estonian defense company supplying Ukraine with military ground robots.

Russian sabotage operations have been expanding across Europe in recent months, targeting companies, infrastructure and supply chains connected to Ukraine’s defense effort. European authorities have linked or investigated suspected Russian involvement in arson and other sabotage attempts in several countries, as Moscow seeks to disrupt support for Ukraine and intimidate its European backers.

Foreign Minister Margus Tsahkna said on 29 September that information gathered by Estonia’s Internal Security Service showed the fire at Milrem’s Tallinn premises on the night of 14–15 August was a Russian intelligence-directed sabotage operation. Estonia summoned Russia’s chargé d’affaires over the attack.

Three suspects detained

Estonian authorities had already detained three suspects in connection with the arson, with the suspects apprehended in Latvia. Tsahkna said the perpetrators had been taken into custody and no longer posed a threat to Estonia.

When the investigation was first announced in August, Estonian authorities had not publicly established a Russian connection or disclosed evidence linking Moscow to the fire.

Milrem supplies robots to Ukraine

Milrem Robotics makes THeMIS unmanned ground vehicles, which have been used by Ukrainian forces since 2022 for tasks including transporting ammunition, food and other supplies, evacuating wounded troops, and mine clearance.

The company said in August that the fire had not disrupted its production or deliveries to Ukraine. More than 200 of its robotic systems are expected to be operating in Ukraine by the end of 2026, including more than 150 vehicles funded by the Netherlands.

The attack is part of a growing series of suspected sabotage operations targeting companies and facilities connected to Ukraine’s defense effort. In August, Slovak authorities foiled an attempted arson attack on a Ukrainian drone factory, while European investigations have also examined suspected Russian involvement in attacks on defense-related facilities in Czechia, Lithuania and Bulgaria.

Estonia says sabotage will not weaken Ukraine support

Tsahkna said Russia’s campaign is intended to intimidate European countries, divide allies and weaken their support for Ukraine.

“Russia’s sabotage campaign will not achieve its objectives,” the Estonian Foreign Ministry said, adding that Estonia and its allies would continue increasing pressure on Russia and supporting Ukraine.

Tsahkna said Estonia would respond to the attack by increasing both its support for Ukraine and pressure on Russia.

Several recent incidents across Europe were conducted by Russia or are likely attributable to Russia, ISW assessed in its 24 September report, though authorities have not officially linked the Polish and German incidents to Moscow.

Russia's full-scale war against Ukraine has expanded into a parallel campaign of provocations against European defense and logistical infrastructure. The Kremlin is using drones, arson, and undersea cable sabotage to degrade Europe's will and ability to support Ukraine, while deliberately intensifying the frequency of airspace violations to erode the boundary between hybrid and kinetic war.

Drones over Moldova and Romania

Four Russian drones flew over Bukovyna and targeted an energy facility and border crossings with Moldova and Romania, Chernivtsi Oblast Military Administration head Ruslan Osypenko reported. Ukrainian forces shot down three. The fourth flew toward Suceava County in northeastern Romania.

A drone crashed in Cernița, Florești district, Moldova—preliminarily identified as a Russian Gerbera type, the first such device found in the country. It carried an onboard camera, hit a tree, and exploded, Moldovan police said. Romania's Defense Ministry reported a second aerial vehicle entered Romanian airspace for four minutes and crashed near Solca in the same border region; geolocated footage confirmed it was also a Gerbera, ISW noted. Poland evacuated the Hrubieszów and Dorohusk border crossings for 30 minutes, Prime Minister Donald Tusk said. Three countries were put on alert by a single night of Russian strikes.

"Intentional and accidental Russian drone incursions into NATO and Moldovan airspaces are likely part of the Kremlin's efforts to normalize airspace violations by intensifying their frequency," ISW assessed.

Sabotage in Poland and Germany

A fire engulfed the power system and backup generator at a Starlink ground station in Wola Krobowska, central Poland, on the evening of 23 September. Deputy Prime Minister Krzysztof Gawkowski confirmed it was sabotage aimed at cutting internet access, including for Ukraine's military. Authorities have not identified who was responsible, but the act aligns with Russia's "new" doctrine of attacks, Gawkowski said. The station is now operating normally.

German authorities suspended operations at Berlin-Brandenburg airport for 45 minutes the same evening after staff reported a drone sighting, Die Zeit reported. Federal police could not confirm it. ISW assessed both incidents fit Russia's wider pattern of sabotage against European defense assets, though neither has been officially attributed to Russia.

Explore further

Russian attack puts three countries on alert as drones enter Moldova and Romania

Western intelligence warnings

A Lithuanian Defense Ministry source reported on 23 September that Russia could launch Gerbera drones from a shipping container in the Mediterranean against Spain, France, and Italy. Danish Defense Intelligence assessed on 24 September that Russia will intensify its hybrid war in coming months, including destructive cyber attacks and sabotage carrying a high risk of casualties, and that there is a low but growing risk of a limited Russian military attack on a NATO border state. It sees no indications of an outright invasion. The CIA reportedly warned Poland that Russia may sabotage underwater cables to disrupt its banking system, according to Newsweek Polska journalists.

NATO tracked and confronted Russian submersibles rehearsing deployment of a new cable-disabling weapon near Svalbard in spring 2026—no cables were damaged, but the operation demonstrated Moscow's intent, Reuters reported. Shadow fleet vessels likely served as drone-launch platforms for incursions into NATO airspace, ISW noted.

"The increasing frequency of such warnings suggests that Western intelligence agencies are picking up indicators that the Kremlin is looking to diversify its platforms and means for conducting attacks against NATO and European states and is considering conducting such attacks," ISW assessed.

ISW said it has not yet seen evidence that Russia has conducted the attacks the warnings describe.

Denmark's assessment—that a limited Russian military strike on a NATO border state could come in the coming months—suggests the boundary between hybrid provocations and military action is narrower than European policy has assumed. ISW's synthesis reframes what governments have treated as separate incidents into one campaign.

"Intentional and accidental Russian drone incursions into NATO and Moldovan airspaces are likely part of the Kremlin's efforts to normalize airspace violations by intensifying their frequency," ISW assessed.

"The increasing frequency of such warnings suggests that Western intelligence agencies are picking up indicators that the Kremlin is looking to diversify its platforms and means for conducting attacks against NATO and European states and is considering conducting such attacks," ISW assessed.

Investigators found what they believe is explosives meters from a crashed drone near the Bundeswehr's Wunstorf air base in Lower Saxony, Germany, and the device matches the construction of drones used in the GRU-attributed Leipzig airport attack, Süddeutsche Zeitung, NDR, and WDR reported on 22 September. Germany's federal prosecutor and the Federal Criminal Police Office (BKA) have taken over the investigation, and the same reporting traced one of the Leipzig suspects to a sanctioned GRU colonel who directs sabotage against countries arming Ukraine.

Russia's sabotage campaign against countries supporting Ukraine has escalated from arson packages and recruited proxies to explosives-laden drones targeting military infrastructure inside NATO. Germany's military counterintelligence has attributed repeated sabotage on German soil to Russia, while Finnish President Stubb called the broader alarm about Russian threats an "overreaction"—a position the accumulating evidence from Germany and Poland does not support.

Explosives found days after the drone crash

A farmer discovered the drone, broken into several pieces, on the evening of 14 September, about one kilometer from the Wunstorf air base, Militarnyi reported. Days later, police found a suspicious substance just meters from the crash site. Security sources told SZ, NDR, and WDR they believe it is an explosive, though forensic analysis has not yet been completed.

The drone's design is similar to the devices used in the Leipzig airport attack on 4 August, when attackers tried to destroy Ukrainian cargo planes with explosives-laden drones. At least one component was manufactured using a 3D printer, the reporting found. Investigators believe the drone may have been near the military airfield for a long time—possibly up to two years.

Wunstorf air base houses the Bundeswehr's entire A400M transport fleet. The facility is Germany's central hub for moving troops and materiel worldwide. An explosives-laden drone near this base would represent a direct threat to the Bundeswehr's central global logistics hub.

The Wunstorf find was discussed at the weekly intelligence briefing in the Chancellery on 22 September, the outlets reported.

Leipzig suspect linked to sanctioned GRU colonel

The federal prosecutor's investigation connects the Wunstorf case to the Leipzig attack. In that case, Germany's government has officially blamed Russia. Two suspects were identified: Oleg L., a Latvian with a Russian passport, and Andrei K., a dual Belarusian-Russian citizen whose DNA was found at the Leipzig scene.

SZ, NDR, and WDR reported that Oleg L. maintained years-long contacts with GRU Colonel Denis Smolyaninov. The EU sanctioned Smolyaninov for directing sabotage operations against countries supporting Ukraine. Andrei K. had previously been noticed for minor offenses in the Baltic states and Finland and entered Germany on an Italian tourist visa. Moscow denied involvement in the Leipzig attack.

A drone violated the no-fly zone around NATO's missile shield base in Poland

The Wunstorf case came to light in the same week that a drone violated the no-fly zone around the US-operated Aegis Ashore missile defense base in Redzikowo, northern Poland, on 15 September.

Polish troops guarding the facility called civilian emergency services instead of neutralizing the drone, TVP World reported. Poland's defense ministry said the drone was a civilian device that "posed no threat" and remained under military surveillance, but Defense Minister Władysław Kosiniak-Kamysz ordered a full report into the incident.

Illia Bilyk, a 21-year-old Ukrainian national, admitted five counts of racially and religiously aggravated criminal damage on 17 September over graffiti at five Muslim institutions in east London, the BBC reported.

The BBC and Hope Not Hate linked Bilyk’s attacks to the same Russian network behind arsons targeting properties connected to former UK Prime Minister Keir Starmer. The network operated Direct Action UK, a fake British far-right group that recruited people through Telegram and shared images of the resulting vandalism. Investigations have documented the same recruitment model across Europe for surveillance, sabotage, and other criminal assignments.

The Metropolitan Police said Bilyk sprayed offensive graffiti at three mosques, Noor Ul Islam Primary School, and the Islamic Shariah Council on 23 and 25 January 2025. Images then appeared in a Direct Action UK Telegram group. Russian operators created the group to pose as a British far-right movement, the BBC reported. Bilyk will be sentenced on 19 October.

The handler, known as EL or “El Money,” also recruited through Telegram groups used by Ukrainians seeking work, the BBC found. Ukrainian builder Roman Lavrynovych was paid in cryptocurrency and steered from posters and graffiti to arson.

In May 2025, Lavrynovych set fire to a car and properties connected to Starmer. Nobody was injured. Lavrynovych was jailed for seven years, while Ukrainian-born Romanian national Stanislav Carpiuc was also convicted.

The BBC identified EL as Yevgeny Lyukshin, a 23-year-old Russian diplomat and son of a senior Foreign Ministry official. It cited matching personal details, his presence in the Direct Action UK chat, family connections, and information-warfare training from Rybar, a sanctioned pro-Kremlin Telegram outlet.

However, the BBC could not conclusively establish that Lyukshin was EL, while British police said they had no evidence the attacks were state-sponsored. Lyukshin did not respond. The Russian Embassy denied any connection between Russia or its Foreign Ministry and unlawful activity.

Paid local recruits make Russia-linked attacks look homegrown

The London operation is one of several cases across Europe and other continents.

UK intelligence warned that Moscow increasingly relies on non-state actors, meaning hired civilians and criminals outside its formal services, for espionage, sabotage, assassination, and information operations.

This month, US prosecutors alleged that another Russian network recruited local residents for surveillance, sabotage, and murder-for-hire.

A US-based recruit was promised up to $1,500 to surveil a prominent Russian dissident before being offered $40,000 to “eliminate” or “disappear” the target, the US Justice Department (DOJ) said on 15 September.

The charges connect that alleged plot to what prosecutors describe as a wider Russian assassination network operating since at least 2024 against dissidents, defectors, and countries perceived as supporting Ukraine.

A federal grand jury in Manhattan indicted five alleged members of what prosecutors call the “RIS Network”:

• Yuri Khrameev, 63: A Russian national and former colonel in the Russian intelligence services who allegedly recruited people to kill Russian dissidents.
• Kirill Khrameev, 27: Yuri Khrameev’s son and an officer in the FSB, Russia’s principal security service and a successor to the Soviet KGB.
• Oemis Romagoza Durruthy, 35: A Cuban national living in Russia who allegedly coordinated attacks and arranged travel for operatives.
• Yaidel Delgado Suarez, 35: A Cuban national accused of recruiting people in the US for surveillance and murder.
• Angel Eduardo Castro, 22: A Venezuelan national accused of helping Suarez recruit US residents to spy on and kill a Russian dissident.

Suarez sent the US resident two locations associated with the dissident, according to the indictment. After the resident delivered photographs and videos, prosecutors say, Suarez and Castro made the $40,000 offer. When the resident declined to carry out the killing, they allegedly asked whether he knew “someone [who] can do the work.”

In 2025, the indictment alleges, Kirill Khrameev recruited a US citizen to photograph a target in Lithuania for a promised $200. Yuri Khrameev then offered approximately $25,000 to kill the man. When the recruit refused, Khrameev allegedly proposed a “simpler job”: burning a warehouse or attacking an electrical substation. He said the purpose was to target countries helping Ukraine, according to prosecutors.

Prosecutors also allege that Durruthy coordinated travel and logistics for attacks in Prague, Czechia, in June 2024 and in Lithuania that September. The Justice Department did not specify what either attack involved.

All five defendants are charged with conspiracy to finance terrorism, carrying up to 20 years in prison. Yuri Khrameev, Suarez, and Castro also face a murder-for-hire conspiracy charge carrying up to 10 years.

All five remain at large. Kremlin spokesperson Dmitry Peskov said Moscow saw no need to comment without “credible evidence,” Reuters reported. An indictment is an allegation, and the defendants are presumed innocent.

From military espionage to alleged murder plots

Since Russia’s full-scale invasion, its covert campaign against Ukraine’s Western allies has combined intelligence gathering with escalating sabotage. CSIS found that suspected Russian attacks in Europe nearly tripled from 2023 to 2024, often using locally recruited agents against infrastructure and industries supporting Ukraine.

In August 2025, US prosecutors charged active-duty soldier Taylor Adam Lee with trying to transmit Abrams tank information and deliver hardware to someone he believed represented the Russian government, allegedly in exchange for Russian citizenship. That case involved an American insider allegedly offering military secrets, not a proven Russian recruitment operation.

Russia has made Germany a priority espionage target, and the threat from cheap, deniable sabotage carried out by civilians paid for one-off jobs is rising, Germany's Military Counterintelligence Service (MAD) said in its 2025 annual report—the first published under a new law obliging annual disclosure. MAD blamed Germany's geostrategic position in Europe and NATO, the expansion of the Bundeswehr, and the introduction of new weapons systems. Repeated sabotage cases on German soil last year were "with high probability" Russian-run, MAD said.

For two years Berlin has publicly warned about a Kremlin campaign of arson, surveillance, and drone incursions run through cheap local proxies—mostly at press briefings and closed sessions. A January 2026 transparency law now forces that warning onto the statutory public record, sharpening the burden of an operational answer. Germany hosts NATO's logistics spine for arming Ukraine—the very hub Moscow's proxies keep aiming at.

Sabotage on the cheap

"Hybrid attacks have increased in Germany," MAD said.

The threat from "low-level agents"—residents paid small sums to plant fires or photograph military sites—has significantly increased. Recent incidents match the model: a bomb-laden drone found in August beside a Ukrainian cargo aircraft at Leipzig/Halle airport was traced this month to a Russian intelligence operative and a Belarusian petty criminal, and two Bulgarian nationals were arrested over a September suspected arson near defense-electronics firm Rohde & Schwarz in Munich. Russia's Legalresidenturen — intelligence outposts inside embassies, semi-state bodies, and press agencies—remain a central instrument of Moscow's information-gathering.

Explore further

A masked figure got into a Polish drone-parts plant—Poland now suspects a foreign spy service set the fire

Chinese drones over bases, blackmail risk for soldiers

Some drone overflights and unauthorized entries at Bundeswehr sites are attributable to Chinese intelligence, MAD said, which is also drawing on parts of the Chinese diaspora in Germany.

The service flagged travel by German soldiers to Russia and Belarus: personnel with family ties there kept visiting despite the security climate, drawing the attention of Russian and Belarusian intelligence services and creating particular exposure to blackmail and threats.

German security services can now name two suspects in the drone attack on Leipzig/Halle airport with high probability, one of them attributed to Russian military intelligence, Welt am Sonntag reported, citing secret investigation files it obtained. The paper says that evidence is what allowed Berlin to blame Russia publicly a week and a half ago. Russia has denied any involvement.

The two men

The main suspects are a Belarusian citizen, Andrei Ka., and a Russian, Oleg Le., according to security sources cited by the paper. German investigators believe Le. was responsible for the preparation and logistics of the attack, and attribute him to the GRU, Russia's military intelligence agency.

Le. entered Germany through Türkiye, landing at Berlin Brandenburg airport, and later left from the same airport for Serbia. He is now back in Russia. Investigators knew at the point of entry that he was tied to the GRU's circle, and he was not surveilled afterward.

Explore further

A drone beside a Ukrainian cargo plane is costing Russia its last consulate in Germany

What was on the drone

The attack used three drones at Leipzig/Halle airport on the evening of 4 August, and two were destroyed at launch for reasons still unclear. The third landed beside a Ukrainian transport aircraft and sat there for hours. About 1.8 kg of Semtex, built into a vegetable can, failed to fire because a detonator tore loose. The Antonov it reached held 25,000 liters of kerosene, and investigators estimate a detonation would have destroyed parts of the airport.

How the trail was found

Forensic technicians recovered glove remains with DNA traces from the antenna used to fly the drone, and those traces were already on file in Finland and Lithuania, where Ka. has a record for ordinary criminal offenses, including theft in Finland. Polish prosecutors separately link him to a hardware-store fire in Łódź in the summer of 2024 that they treat as sabotage directed from Russia, which fits the pattern European authorities have documented since 2022: Russian services hiring residents, often migrants, to burn warehouses and malls. The Leipzig explosives are thought to have crossed from Bulgaria through Serbia in truck cavities and gone into buried caches, and police found several suspected hiding places after examining the suspects' rental-car data.

Explore further

Germany suspects Russian intelligence behind arson attack as hybrid warfare threat grows across Europe

What Berlin has done about it

German Foreign Minister Johann Wadephul and Interior Minister Alexander Dobrindt blamed Russia at a joint press conference on 1 September, ordering the closure of Russia's last consulate in the country and scrapping the agreement behind Moscow's cultural center in Berlin. Russia's embassy claims more than 150 of its mission staff and their families must now leave Germany, and Moscow answered by closing the German consulate in St Petersburg and the Goethe institutes.

Four days after the attribution, German investigators suspected Russian intelligence behind an arson attack on a defense company.

Fire tore through an ammunition depot belonging to the Bulgarian arms maker EMCO overnight on 12 September, according to RFE/RL. Nobody was hurt, and the interior minister says sabotage is among the versions being examined. It was the second fire at a site of the company, which supplies ammunition to Ukraine, in little over a month.

The warehouses burned one after another

The blaze started near the village of Gorni Varpishta, between Tryavna and Tsareva Livada in Dryanovo municipality. It was visible from Veliko Tarnovo, whose mayor, Daniel Panov, said the fire began around 23:00 on Friday. Gabrovo provincial governor Kristina Sidorova told reporters the fire had taken the depot base and was moving from one store to the next, and she had residents of nearby settlements warned through the BG-Alert emergency system.

Residents nearby heard a series of explosions. Two security guards were the only people on the site and both left in time, Bulgarian media reported. The nearest settlement lies more than a kilometer away, and firefighters ringed the area. EMCO production manager Slavcho Dimiev confirmed to Bulgarian National Television that the store held ammunition and powder, and he told Reuters it mainly contained ammunition, including a small quantity of medium-caliber rounds.

Explore further

Russia rehearsed how to disable Europe’s undersea communications cables near Svalbard. NATO forces drove them off

Sabotage among the versions

Interior Minister Ivan Demerdzhiev said on Saturday the fire was under control and an investigation was running.

"We will review previous cases in which similar fires occurred in the warehouses of this company, as well as at other companies, in order to look for a possible connection or a similar pattern," he said. "We are not ruling out outside interference."

Every ammunition depot in the country will now be inspected, Demerdzhiev said, because storage and security at such sites have been neglected. Dimiev also called for extra protection, saying that if the depots were being targeted, the attack was on the national interest rather than on one company. Lawmaker Bozhidar Bozhanov said the fires are too many and are aimed at one firm, whose owner Russian military intelligence tried to kill, and asked when the state would act.

The owner Russia tried to poison

EMCO belongs to Bulgarian arms trader Emilian Gebrev. He and his plants have been targeted repeatedly in operations attributed to Russian military intelligence over his ammunition deliveries to Ukraine. Gebrev, his son, and a colleague survived a Novichok poisoning attempt in 2015. In 2020 prosecutors charged three Russians whom investigators identified as officers of Russian military intelligence, the GRU.

Explore further

Italy joins Bulgaria in resisting EU sanctions on Patriarch Kirill

In 2024 Bulgaria issued arrest warrants for six Russians over EMCO depots destroyed between 2011 and 2020, which held rounds bound for Ukraine and Georgia. Prosecutors said they had grounds to suspect links between those blasts, the poisoning, and the 2014 explosions in Vrbětice, Czechia, that killed two. Moscow denies all of it. Bulgaria supplied Ukraine with weapons until this year's government moved to stop the transfers.

A month earlier, another EMCO site

Explosions and fire hit another EMCO depot on 10 August. Demerdzhiev said at the time that the preliminary version pointed away from external factors.

Founded in 1992, EMCO produces, repairs, and modernizes ammunition and military equipment. The Telegraph reported in late August, citing Western intelligence sources, that Russia had launched a fresh wave of attacks on European defense plants using local criminal groups.

Germany's authorities suspect Russian intelligence behind an arson attack on a defense firm last week, Estonia investigated a suspected arson at a military robot maker supplying Ukraine in August, and Czech police arrested four suspects over a fire at a plant making drones and thermal optics for Ukraine.